@bongos/core 1.17.0 → 1.17.1

package/tests/provision.mjs

@@ -46,6 +46,33 @@ t('dbCreateCmd / migrateCmd use the slug db + GDS-only migrate', () => {
   assert.match(P.migrateCmd(coTenant), /PGDATABASE=mercury MEDUSA_GDS_ONLY=1 \.\/scripts\/migrate\.sh/);
 });
 
+t('seedFirstVersionCmd: idempotent (only-if-empty) V1 seed against the slug db, track explicit, one criterion — the fix for the empty-versions bug (task 2119)', () => {
+  const cmd = P.seedFirstVersionCmd(coTenant);
+  // targets the instance's OWN db, matching createdb/migrate
+  assert.match(cmd, /psql .*-d mercury /, 'seeds the instance db');
+  assert.match(cmd, /ON_ERROR_STOP=1/, 'aborts on any error (atomic, no half-seed)');
+  // the version the greenfield init spec defines — ONE source of truth
+  const v = P.instanceInitSpec(coTenant).version;
+  assert.match(cmd, /INSERT INTO versions \(id, name, track, status, done_when\)/);
+  assert.match(cmd, new RegExp(`\\$v\\$${reEsc(v.id)}\\$v\\$`), 'seeds the spec version id (V1)');
+  assert.match(cmd, /\$v\$product\$v\$/, 'track is set EXPLICITLY (versions.track is NOT NULL, no default since mig 112)');
+  assert.match(cmd, /\$v\$building\$v\$/, 'status building, mirroring seedViaApi');
+  assert.ok(cmd.includes(v.done_when), 'carries the spec done_when verbatim (incl. the → arrows)');
+  // the IDEMPOTENT guard — only seeds when there is NO version yet, so it never disturbs an existing project
+  assert.match(cmd, /WHERE NOT EXISTS \(SELECT 1 FROM versions\)/, 'only-if-empty guard');
+  // one done-when criterion so /status has a finish line (matches seedViaApi's 'first-goal')
+  assert.match(cmd, /INSERT INTO done_when_criteria/);
+  assert.match(cmd, /\$v\$first-goal\$v\$/);
+  // dollar-quoted literals ⇒ the whole -c arg is single-quoted (safe inline / SSH / cloud-init)
+  assert.match(cmd, /-c '.*'/, 'the SQL is a single-quoted -c argument');
+  assert.doesNotMatch(cmd, /-c ".*"/, 'never double-quoted (would break cloud-init bash -lc "…")');
+});
+
+t('seedFirstVersionCmd: privileged runs psql as the postgres role; default is bare (peer auth) — mirrors createdb/migrate', () => {
+  assert.match(P.seedFirstVersionCmd(coTenant, { privileged: false }), /^psql /);
+  assert.match(P.seedFirstVersionCmd(coTenant, { privileged: true }), /^sudo -u postgres psql /);
+});
+
 t('serviceUnit binds the instance port + DB + per-instance env file, runs platform-server', () => {
   const u = P.serviceUnit(coTenant, { etcBase: '/etc' });
   assert.match(u, /Environment=PORT=3003/);
@@ -60,7 +87,7 @@ t('serviceUnit(standalone) runs the CORE PACKAGE server from the instance\'s OWN
   const u = P.serviceUnit(inst, { etcBase: '/etc' });
   const root = P.standaloneRoot(inst);
   assert.match(u, new RegExp('WorkingDirectory=' + reEsc(root)), 'runs from the instance\'s own repo dir');
-  assert.match(u, /ExecStart=\/usr\/bin\/node node_modules\/@cloudbongos\/core\/src\/platform-server\.js/, 'runs the pinned core package server');
+  assert.match(u, /ExecStart=\/usr\/bin\/node node_modules\/@bongos\/core\/src\/platform-server\.js/, 'runs the pinned core package server');
   assert.match(u, /Environment=PORT=3003/);
   assert.match(u, /EnvironmentFile=\/etc\/mercury\/web\.env/);
 });
@@ -70,7 +97,7 @@ t('standalone step generators: root under standaloneBase + pull / npm-ci / insta
   assert.match(P.standaloneRoot(inst), /\/mercury$/);
   assert.equal(P.standalonePullCmd(), 'git pull --ff-only origin main');
   assert.equal(P.standaloneInstallCmd(), 'npm ci --omit=dev');
-  assert.match(P.standaloneMigrateCmd(inst), /PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules\/@cloudbongos\/core\/scripts\/migrate\.sh/);
+  assert.match(P.standaloneMigrateCmd(inst), /PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules\/@bongos\/core\/scripts\/migrate\.sh/);
 });
 
 t('webEnvBody: OAuth creds use the LOADED pack\'s envPrefix (not the slug) + brand/port/db', () => {
@@ -98,6 +125,18 @@ t('webEnvBody: a domain writes the single-host origin overrides so the hall load
   assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_OAUTH_ORIGIN=${O}`));
 });
 
+t('webEnvBody: the repo target_ref seats the founding owner via <prefix>_FIRST_ADMIN (goal 35 / criterion 165)', () => {
+  // Regression (caught live on demo.cloudbongos.com, 2026-07-07): a provisioned instance
+  // MUST convey its founding owner, or src/bongos/auth.js maybeSeatFirstAdmin can never
+  // seat an Archon on first sign-in and the owner can't claim their own instance. Derived
+  // from the repo owner in target_ref — the SAME source instanceInitSpec uses for the
+  // scaffold's branding.firstAdmin, so the env override and config/branding.json agree.
+  const b = P.webEnvBody({ ...coTenant, hosting_shape: 'standalone', domain: 'mercury.example.com', target_ref: 'octocat/mercury' });
+  assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_FIRST_ADMIN=octocat`));
+  // No target_ref ⇒ the line is omitted (org-owned or unknown owner sets it by hand).
+  assert.doesNotMatch(P.webEnvBody(coTenant), /_FIRST_ADMIN=/);
+});
+
 t('caddyBlock: a domain → on-demand-TLS reverse_proxy to the local port; no domain → a comment', () => {
   const withDomain = P.caddyBlock({ ...coTenant, domain: 'mercury.example.com' });
   assert.match(withDomain, /mercury\.example\.com \{/);
@@ -142,11 +181,22 @@ t('healthzCmd hits the instance port /healthz', () => {
   assert.match(P.healthzCmd(coTenant), /127\.0\.0\.1:3003\/healthz/);
 });
 
-t('dedicatedUserData bakes createdb + migrate into cloud-init', () => {
+t('dedicatedUserData bakes createdb + migrate + first-version seed into cloud-init (task 2119: dedicated must not diverge)', () => {
   const ud = P.dedicatedUserData(coTenant);
   assert.match(ud, /^#cloud-config/);
   assert.match(ud, /createdb mercury/);
   assert.match(ud, /MEDUSA_GDS_ONLY=1/);
+  // the seed rides cloud-init too, so a dedicated droplet also comes up able to take tasks
+  assert.match(ud, /INSERT INTO versions/, 'seed baked into cloud-init');
+  // it must be its OWN runcmd line AFTER migrate (the schema must exist first)
+  const lines = ud.split('\n');
+  const iMig = lines.findIndex((l) => /migrate\.sh/.test(l));
+  const iSeed = lines.findIndex((l) => /INSERT INTO versions/.test(l));
+  assert.ok(iMig >= 0 && iSeed > iMig, 'seed line comes after the migrate line');
+  // the seed line is a valid bash -lc "…" item: single-quoted -c arg, NO double quotes to break the YAML scalar
+  const seedLine = lines[iSeed];
+  assert.match(seedLine, /- \[ bash, -lc, "psql .*" \]/, 'well-formed cloud-init runcmd item');
+  assert.doesNotMatch(seedLine.replace(/^.*-lc, "/, '').replace(/" \]$/, ''), /"/, 'the seed command carries no inner double quotes');
 });
 
 console.log('\nport allocation:');
@@ -215,12 +265,15 @@ await ta('provisionInstance(co-tenant) composes db → migrate → service → h
   const joined = cmds.join('\n');
   assert.match(joined, /createdb mercury/);
   assert.match(joined, /MEDUSA_GDS_ONLY=1/);
+  assert.match(joined, /INSERT INTO versions/, 'seeds the first version (task 2119)');
   assert.match(joined, /systemctl daemon-reload/);
   assert.match(joined, /systemctl enable --now mercury/);
   assert.match(joined, /healthz/);
-  // ordering: createdb before migrate before enable before healthz
+  // ordering: createdb before migrate before SEED before enable before healthz
   const idx = (re) => cmds.findIndex((c) => re.test(c));
   assert.ok(idx(/createdb/) < idx(/migrate\.sh/), 'createdb before migrate');
+  assert.ok(idx(/migrate\.sh/) < idx(/INSERT INTO versions/), 'migrate before the version seed (schema must exist)');
+  assert.ok(idx(/INSERT INTO versions/) < idx(/enable --now/), 'seed before service enable');
   assert.ok(idx(/migrate\.sh/) < idx(/enable --now/), 'migrate before service enable');
   assert.ok(idx(/enable --now/) < idx(/healthz/), 'service before healthz');
   // writes: the per-instance env file + the systemd unit
@@ -243,8 +296,9 @@ await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + n
   assert.match(joined, /git pull --ff-only origin main/, 'pulls the instance repo');
   assert.match(joined, /npm ci --omit=dev/, 'installs the pinned core');
   assert.match(joined, /createdb mercury/);
-  assert.match(joined, /node_modules\/@cloudbongos\/core\/scripts\/migrate\.sh/, 'migrates from the INSTANCE root\'s core');
+  assert.match(joined, /node_modules\/@bongos\/core\/scripts\/migrate\.sh/, 'migrates from the INSTANCE root\'s core');
   assert.ok(!cmds.some((c) => /\.\/scripts\/migrate\.sh/.test(c)), 'standalone does NOT use the control-plane checkout migrate');
+  assert.match(joined, /INSERT INTO versions/, 'standalone seeds its first version too (task 2119)');
   // ordering: clone → package-core → init → push → pull → npm ci → migrate → service
   const idx = (re) => cmds.findIndex((c) => re.test(c));
   assert.ok(idx(/git clone/) < idx(/package-core/), 'clone before tarball build');
@@ -253,6 +307,8 @@ await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + n
   assert.ok(idx(/push -u origin main/) < idx(/git pull/), 'scaffold push before the deploy pull');
   assert.ok(idx(/git pull/) < idx(/npm ci/), 'pull before npm ci');
   assert.ok(idx(/npm ci/) < idx(/migrate\.sh/), 'npm ci before migrate');
+  assert.ok(idx(/migrate\.sh/) < idx(/INSERT INTO versions/), 'migrate before the version seed');
+  assert.ok(idx(/INSERT INTO versions/) < idx(/enable --now/), 'seed before service enable');
   assert.ok(idx(/migrate\.sh/) < idx(/enable --now/), 'migrate before service enable');
   assert.ok(writes.some((w) => /\/mercury\.service$/.test(w)), 'wrote the (standalone) systemd unit');
 });
@@ -316,6 +372,47 @@ await ta('scaffoldStandaloneRepo: idempotent — a repo that already carries pac
   }
 });
 
+// ── ADR 0134 (task 2090): registry core-install path + fail-soft to vendored ──
+// Runs the scaffold against a FRESH standaloneBase (no package.json → it proceeds) with
+// an injected env, and asserts which core-resolution shape it chose from the commands.
+async function scaffoldWithEnv(env) {
+  const tmp = mkdtempSync(join(tmpdir(), 'scaffold-'));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = tmp;
+  try {
+    const { deps, cmds } = recorder({ apply: true });
+    await P.scaffoldStandaloneRepo(
+      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo' },
+      { ...deps, env },
+    );
+    return cmds.join('\n');
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+await ta('scaffoldStandaloneRepo: PROVISION_CORE_FROM_REGISTRY=1 + NPM_TOKEN → registry path (init --registry-core, no tarball build)', async () => {
+  const joined = await scaffoldWithEnv({ PROVISION_CORE_FROM_REGISTRY: '1', NPM_TOKEN: 'npm_readonly' });
+  assert.match(joined, /init\.js --from .* --dir .* --no-seed --force --registry-core/, 'materializes via --registry-core');
+  assert.ok(!/package-core\.js/.test(joined), 'does NOT build a core tarball on the registry path');
+  assert.ok(!/--vendor-core/.test(joined), 'does NOT vendor a tarball on the registry path');
+});
+
+await ta('scaffoldStandaloneRepo: registry requested but NO NPM_TOKEN → FAILS SOFT to the vendored tarball', async () => {
+  const joined = await scaffoldWithEnv({ PROVISION_CORE_FROM_REGISTRY: '1' });
+  assert.match(joined, /node scripts\/gds\/package-core\.js/, 'builds the core tarball (vendored fallback)');
+  assert.match(joined, /init\.js --from .* --dir .* --no-seed --force --vendor-core /, 'file:-pins the vendored tarball');
+  assert.ok(!/--registry-core/.test(joined), 'does NOT take the registry path without a token');
+});
+
+await ta('scaffoldStandaloneRepo: default (no registry env) stays on the vendored tarball path', async () => {
+  const joined = await scaffoldWithEnv({});
+  assert.match(joined, /node scripts\/gds\/package-core\.js/, 'vendored is the default');
+  assert.match(joined, /--vendor-core /);
+  assert.ok(!/--registry-core/.test(joined));
+});
+
 await ta('provisionInstance is idempotent: an already-active instance is a no-op', async () => {
   const { deps, cmds } = recorder();
   const r = await P.provisionInstance({ ...coTenant, status: 'active' }, deps);
@@ -323,10 +420,11 @@ await ta('provisionInstance is idempotent: an already-active instance is a no-op
   assert.equal(cmds.length, 0, 'no commands run for an active instance');
 });
 
-await ta('provisionInstance(dedicated) does NOT run local createdb/migrate (they ride cloud-init)', async () => {
+await ta('provisionInstance(dedicated) does NOT run local createdb/migrate/seed (they ride cloud-init)', async () => {
   const { deps, cmds } = recorder();
   await P.provisionInstance({ ...coTenant, hosting_shape: 'dedicated', tier: 's-2vcpu-4gb' }, deps);
   assert.ok(!cmds.some((c) => /createdb/.test(c)), 'dedicated does not run createdb locally');
+  assert.ok(!cmds.some((c) => /INSERT INTO versions/.test(c)), 'dedicated does not run the version seed locally (it rides cloud-init)');
 });
 
 console.log('\nDNS UPSERT composition (P4, CONFIG override):');
@@ -552,8 +650,8 @@ t('migrateCmd: privileged runs migrate as postgres via env+bash (survives sudo e
 
 t('standaloneMigrateCmd: privileged runs the instance-root migrate as postgres; default unchanged', () => {
   const inst = { ...coTenant, hosting_shape: 'standalone' };
-  assert.equal(P.standaloneMigrateCmd(inst), 'PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules/@cloudbongos/core/scripts/migrate.sh');
-  assert.equal(P.standaloneMigrateCmd(inst, { privileged: true }), 'sudo -u postgres env PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules/@cloudbongos/core/scripts/migrate.sh');
+  assert.equal(P.standaloneMigrateCmd(inst), 'PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules/@bongos/core/scripts/migrate.sh');
+  assert.equal(P.standaloneMigrateCmd(inst, { privileged: true }), 'sudo -u postgres env PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules/@bongos/core/scripts/migrate.sh');
 });
 
 t('makeWriteFile(privileged): a { sudo:true } write stages a temp file + `sudo install -D -m <mode>` (never writes /etc directly)', () => {
@@ -615,6 +713,7 @@ await ta('provisionInstance(co-tenant, privileged): createdb/migrate run as post
   const joined = cmds.join('\n');
   assert.match(joined, /sudo -u postgres createdb mercury/, 'createdb as postgres');
   assert.match(joined, /sudo -u postgres env PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash \.\/scripts\/migrate\.sh/, 'migrate as postgres');
+  assert.match(joined, /sudo -u postgres psql .*INSERT INTO versions/, 'first-version seed runs as postgres too (task 2119)');
   assert.match(joined, /sudo systemctl daemon-reload/, 'daemon-reload sudo-prefixed');
   assert.match(joined, /sudo systemctl enable --now mercury/, 'enable sudo-prefixed');
   assert.match(joined, /sudo systemctl reload caddy/, 'reload caddy sudo-prefixed');

package/tests/provisioning_github_app_routes.mjs

@@ -30,7 +30,7 @@ provisioning.attachManifestCode = async (_db, id, code) => ({ id, status: 'code_
 // A branding with a known publicOrigin so mothershipOrigin() resolves deterministically.
 const branding = require(`${ROOT}/src/branding.js`);
 const realBranding = branding.branding;
-branding.branding = () => ({ ...realBranding(), domains: { publicOrigin: 'https://cloudbongos.com' } });
+branding.branding = () => ({ ...realBranding(), identity: { ...(realBranding().identity || {}), productName: 'Cloud Bongos' }, domains: { publicOrigin: 'https://cloudbongos.com' } });
 
 // Inject the signed-in owner (the real requireBuilder needs a session).
 const api = require(`${ROOT}/src/module-api.js`);
@@ -66,6 +66,7 @@ console.log('POST /provisioning/instances/:id/github-app (mint the one-click lin
   t('post_url targets GitHub personal apps/new carrying the state', j.post_url === `https://github.com/settings/apps/new?state=${j.state}`, j.post_url);
   t('manifest.redirect_url is the MOTHERSHIP callback', j.manifest && j.manifest.redirect_url === 'https://cloudbongos.com/api/bongos/provisioning/github-app/callback', j.manifest && j.manifest.redirect_url);
   t('manifest.callback_urls are the INSTANCE sign-in (both prefixes)', j.manifest && j.manifest.callback_urls[0] === 'https://mercury.example.com/api/gds/auth/web/callback' && j.manifest.callback_urls[1] === 'https://mercury.example.com/api/bongos/auth/web/callback');
+  t('manifest.name is the instance domain (unique + matches the consent-screen redirect) within 34 chars', j.manifest && j.manifest.name === 'mercury.example.com' && j.manifest.name.length <= 34, j.manifest && j.manifest.name);
   t('org_url derived from the target_ref owner (acme)', j.org_url === `https://github.com/organizations/acme/settings/apps/new?state=${j.state}`, j.org_url);
   t('the attempt row was persisted with the minted state', !!(stored && stored.instanceId === 42 && stored.state === j.state && stored.requestedBy === 7));
 }
@@ -74,7 +75,7 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
 {
   const res = await fetch(`${base}/provisioning/github-app/callback?code=GHCODE123&state=GOODSTATE`);
   const html = await res.text();
-  t('good state → 200 text/html finishing-setup page', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /GitHub App created/.test(html) && /no secret/i.test(html), `status=${res.status}`);
+  t('good state → 200 text/html progress page wired to auto-open', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /Setting up your instance/.test(html) && /Placing credentials/.test(html) && /__CB_SETUP__/.test(html) && html.includes('GOODSTATE'), `status=${res.status}`);
   t('the page names the instance host', /mercury\.example\.com/.test(html));
 }
 {
@@ -87,6 +88,32 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
   t('missing code/state → 400', res.status === 400, `status=${res.status}`);
 }
 
+console.log('\nGET /provisioning/github-app/status (the page poll → auto-open signal):');
+{
+  const res = await fetch(`${base}/provisioning/github-app/status?state=GOODSTATE`);
+  const j = await res.json();
+  t('pending → 200 ok, not ready, names the domain', res.status === 200 && j.ok === true && j.status === 'pending' && j.ready === false && j.domain === 'mercury.example.com', `status=${res.status} ${JSON.stringify(j)}`);
+}
+{
+  // Swap the stub to a placed-credentials ('done') attempt to prove ready flips true.
+  const prev = provisioning.getOAuthManifestByState;
+  provisioning.getOAuthManifestByState = async (_db, state) => (state === 'GOODSTATE'
+    ? { id: 99, instance_id: 42, requested_by: 7, status: 'done', expires_at: new Date(Date.now() + 600000).toISOString() }
+    : null);
+  const res = await fetch(`${base}/provisioning/github-app/status?state=GOODSTATE`);
+  const j = await res.json();
+  t("status 'done' → ready:true + terminal:true", res.status === 200 && j.ready === true && j.terminal === true, JSON.stringify(j));
+  provisioning.getOAuthManifestByState = prev;
+}
+{
+  const res = await fetch(`${base}/provisioning/github-app/status?state=NOPE`);
+  t('unknown state → 404 (no oracle)', res.status === 404, `status=${res.status}`);
+}
+{
+  const res = await fetch(`${base}/provisioning/github-app/status`);
+  t('missing state → 400', res.status === 400, `status=${res.status}`);
+}
+
 console.log('\nparseId contract (the (req,res) signature — a bad id is a clean 400, not a 500):');
 {
   const res = await fetch(`${base}/provisioning/instances/not-a-number/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });

package/tests/served_paths_shipped.mjs

@@ -3,7 +3,7 @@
 // GUARD (task 2078): every static asset serve-internal.js reads at runtime from the
 // core tree MUST be included in the packaged core — i.e. isPublishable() per
 // scripts/gds/publish-manifest.js. A standalone instance runs the PACKAGED core
-// (@cloudbongos/core, ADR 0108), so a served path the publish boundary EXCLUDES is
+// (@bongos/core, ADR 0108), so a served path the publish boundary EXCLUDES is
 // simply absent on the box and 404s.
 //
 // This is exactly how demo.cloudbongos.com rendered a blank page: the browser client
@@ -101,7 +101,7 @@ test('every ROOT-served asset ships in the core package (isPublishable)', () =>
     offenders,
     [],
     `serve-internal.js reads these from ROOT but the publish boundary EXCLUDES them, so the ` +
-      `packaged core (@cloudbongos/core) omits them and a standalone 404s (task 2078): ${offenders.join(', ')}. ` +
+      `packaged core (@bongos/core) omits them and a standalone 404s (task 2078): ${offenders.join(', ')}. ` +
       `Fix: add each to PUBLISH_ALLOWLIST in scripts/gds/publish-manifest.js (or, if truly host-only, ` +
       `document it in INTENTIONALLY_UNSHIPPED in this test).`
   );

package/tests/task_cli.mjs

@@ -0,0 +1,99 @@
+// tests/task_cli.mjs
+//
+// task 2123 (demo-audit fix C1) — locks the PURE argv→body mapping of the new
+// `bongos task new` command (scripts/gds/task.js). Hermetic: no session/DB/network
+// (buildTaskBody never touches the API), so the pr-unit-tests gate auto-includes it.
+//
+// Run:  node tests/task_cli.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { buildTaskBody, VALID_KINDS, VALID_DISCIPLINES, csv, hallLink } = require('../scripts/gds/task.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+t('requires --title and --description', () => {
+  const { errors } = buildTaskBody([]);
+  assert.ok(errors.some((e) => /--title/.test(e)));
+  assert.ok(errors.some((e) => /--description/.test(e)));
+});
+
+t('minimal valid: defaults kind=feature, discipline=engineer, status=backlog', () => {
+  const { body, errors } = buildTaskBody(['--title', 'T', '--description', 'D']);
+  assert.equal(errors.length, 0);
+  assert.equal(body.title, 'T');
+  assert.equal(body.description, 'D');
+  assert.equal(body.kind, 'feature');
+  assert.equal(body.discipline, 'engineer');
+  assert.equal(body.status, 'backlog');
+  assert.equal(body.source, 'bongos-task-cli');
+  // optional fields absent unless provided
+  assert.equal('priority' in body, false);
+  assert.equal('version_id' in body, false);
+  assert.equal('goal_id' in body, false);
+});
+
+t('--ready flips status to ready', () => {
+  const { body } = buildTaskBody(['--title', 'T', '--description', 'D', '--ready']);
+  assert.equal(body.status, 'ready');
+});
+
+t('maps all optional flags → body', () => {
+  const { body, criteria, errors } = buildTaskBody([
+    '--title', 'Add X', '--description', 'Because Y',
+    '--kind', 'bug', '--discipline', 'ui', '--priority', '2',
+    '--version', 'BONGOS-V1', '--goal', '26', '--criteria', 'C1,gcarry-prod-vanilla',
+    '--touches', 'src/a.js,tests/', '--est-minutes', '45', '--manual-degree', '3', '--credits', '15',
+  ]);
+  assert.equal(errors.length, 0);
+  assert.equal(body.kind, 'bug');
+  assert.equal(body.discipline, 'ui');
+  assert.equal(body.priority, 2);
+  assert.equal(body.version_id, 'BONGOS-V1');
+  assert.equal(body.goal_id, 26);
+  assert.deepEqual(body.touches, ['src/a.js', 'tests/']);
+  assert.deepEqual(body.criterion_ids, ['C1', 'gcarry-prod-vanilla']);
+  assert.deepEqual(criteria, ['C1', 'gcarry-prod-vanilla']);
+  assert.equal(body.est_minutes, 45);
+  assert.equal(body.manual_degree, 3);
+  assert.equal(body.credits_reward, 15);
+});
+
+t('rejects an invalid kind', () => {
+  const { errors } = buildTaskBody(['--title', 'T', '--description', 'D', '--kind', 'nonsense']);
+  assert.ok(errors.some((e) => /--kind/.test(e)));
+});
+
+t('rejects a priority out of 1–5', () => {
+  const { errors } = buildTaskBody(['--title', 'T', '--description', 'D', '--priority', '9']);
+  assert.ok(errors.some((e) => /--priority/.test(e)));
+});
+
+t('rejects a non-positive --goal', () => {
+  const { errors } = buildTaskBody(['--title', 'T', '--description', 'D', '--goal', '0']);
+  assert.ok(errors.some((e) => /--goal/.test(e)));
+});
+
+t('csv trims + drops blanks', () => {
+  assert.deepEqual(csv(' a , b ,,c '), ['a', 'b', 'c']);
+  assert.deepEqual(csv(''), []);
+});
+
+t('hallLink builds a hall URL from the API base origin, falls back cleanly', () => {
+  assert.equal(hallLink('https://demo.cloudbongos.com/api/bongos', 7), 'https://demo.cloudbongos.com/builders#/task/7');
+  assert.equal(hallLink('not-a-url', 7), 'task #7');
+});
+
+t('enum vocab is the expected shape', () => {
+  assert.ok(VALID_KINDS.includes('feature') && VALID_KINDS.includes('bug'));
+  assert.deepEqual(VALID_DISCIPLINES, ['engineer', 'artist', 'ideator', 'ui']);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/upgrade.mjs

@@ -34,13 +34,13 @@ function scratchConsumer({ pinned = '1.14.1', installed = '1.14.1' } = {}) {
   const dir = mkdtempSync(join(tmpdir(), 'otb-upgrade-'));
   writeFileSync(join(dir, 'package.json'), JSON.stringify({
     name: 'test-consumer', version: '0.1.0',
-    dependencies: { '@cloudbongos/core': `file:vendor/cloudbongos-core-${pinned}.tgz` },
+    dependencies: { '@bongos/core': `file:vendor/bongos-core-${pinned}.tgz` },
     scripts: { migrate: 'true', start: 'true' },
   }, null, 2) + '\n');
   if (installed) {
-    const cd = join(dir, 'node_modules', '@cloudbongos', 'core');
+    const cd = join(dir, 'node_modules', '@bongos', 'core');
     mkdirSync(cd, { recursive: true });
-    writeFileSync(join(cd, 'package.json'), JSON.stringify({ name: '@cloudbongos/core', version: installed }) + '\n');
+    writeFileSync(join(cd, 'package.json'), JSON.stringify({ name: '@bongos/core', version: installed }) + '\n');
   }
   return dir;
 }
@@ -52,8 +52,8 @@ function fakeRun(calls, { dirty = '', installTo = null, dir = null } = {}) {
     calls.push(`${cmd} ${(args || []).join(' ')}`.trim());
     if (cmd === 'git' && args[0] === 'status') return { status: 0, stdout: dirty };
     if (cmd === 'npm' && args[0] === 'install' && installTo && dir) {
-      writeFileSync(join(dir, 'node_modules', '@cloudbongos', 'core', 'package.json'),
-        JSON.stringify({ name: '@cloudbongos/core', version: installTo }) + '\n');
+      writeFileSync(join(dir, 'node_modules', '@bongos', 'core', 'package.json'),
+        JSON.stringify({ name: '@bongos/core', version: installTo }) + '\n');
     }
     return { status: 0 };
   };
@@ -61,20 +61,20 @@ function fakeRun(calls, { dirty = '', installTo = null, dir = null } = {}) {
 
 // ---- 1. pure pin helpers ----------------------------------------------------
 t('versionFromTgzPath: extracts the version from a vendored tarball path', () => {
-  assert.equal(u.versionFromTgzPath('file:vendor/cloudbongos-core-1.14.1.tgz'), '1.14.1');
-  assert.equal(u.versionFromTgzPath('vendor/cloudbongos-core-1.15.0.tgz'), '1.15.0');
+  assert.equal(u.versionFromTgzPath('file:vendor/bongos-core-1.14.1.tgz'), '1.14.1');
+  assert.equal(u.versionFromTgzPath('vendor/bongos-core-1.15.0.tgz'), '1.15.0');
   assert.equal(u.versionFromTgzPath('^1.2.3'), null);
 });
 
 t('readPinnedCoreVersion / writePin: round-trip the file: dependency', () => {
   const dir = scratchConsumer({ pinned: '1.14.1' });
   assert.equal(u.readPinnedCoreVersion(dir), '1.14.1');
-  const prev = u.writePin(dir, 'vendor/cloudbongos-core-1.15.0.tgz');
-  assert.equal(prev, 'file:vendor/cloudbongos-core-1.14.1.tgz');
+  const prev = u.writePin(dir, 'vendor/bongos-core-1.15.0.tgz');
+  assert.equal(prev, 'file:vendor/bongos-core-1.14.1.tgz');
   assert.equal(u.readPinnedCoreVersion(dir), '1.15.0');
 });
 
-t('readInstalledCoreVersion: reads node_modules/@cloudbongos/core', () => {
+t('readInstalledCoreVersion: reads node_modules/@bongos/core', () => {
   const dir = scratchConsumer({ installed: '1.14.1' });
   assert.equal(u.readInstalledCoreVersion(dir), '1.14.1');
   assert.equal(u.readInstalledCoreVersion(mkdtempSync(join(tmpdir(), 'empty-'))), null);
@@ -83,13 +83,13 @@ t('readInstalledCoreVersion: reads node_modules/@cloudbongos/core', () => {
 // ---- 2. vendorTarball -------------------------------------------------------
 t('vendorTarball: copies the .tgz + side-car manifest under the canonical name', () => {
   const src = mkdtempSync(join(tmpdir(), 'src-'));
-  writeFileSync(join(src, 'cloudbongos-core-1.15.0.tgz'), 'TGZBYTES');
-  writeFileSync(join(src, 'cloudbongos-core-1.15.0.manifest.json'), '{"v":1}');
+  writeFileSync(join(src, 'bongos-core-1.15.0.tgz'), 'TGZBYTES');
+  writeFileSync(join(src, 'bongos-core-1.15.0.manifest.json'), '{"v":1}');
   const dir = scratchConsumer();
-  const rel = u.vendorTarball({ instanceDir: dir, fromTgz: join(src, 'cloudbongos-core-1.15.0.tgz'), targetVersion: '1.15.0' });
-  assert.equal(rel, join('vendor', 'cloudbongos-core-1.15.0.tgz'));
+  const rel = u.vendorTarball({ instanceDir: dir, fromTgz: join(src, 'bongos-core-1.15.0.tgz'), targetVersion: '1.15.0' });
+  assert.equal(rel, join('vendor', 'bongos-core-1.15.0.tgz'));
   assert.equal(readFileSync(join(dir, rel), 'utf8'), 'TGZBYTES');
-  assert.ok(existsSync(join(dir, 'vendor', 'cloudbongos-core-1.15.0.manifest.json')), 'manifest copied too');
+  assert.ok(existsSync(join(dir, 'vendor', 'bongos-core-1.15.0.manifest.json')), 'manifest copied too');
 });
 
 // ---- 3. step shims issue the right argv ------------------------------------
@@ -137,11 +137,11 @@ t('guard: already on the target refuses (unless --force)', async () => {
 // ---- 5. dry-run mutates nothing --------------------------------------------
 t('dry-run: plans without rewriting package.json or spawning npm', async () => {
   const src = mkdtempSync(join(tmpdir(), 'src-'));
-  writeFileSync(join(src, 'cloudbongos-core-1.15.0.tgz'), 'X');
+  writeFileSync(join(src, 'bongos-core-1.15.0.tgz'), 'X');
   const dir = scratchConsumer({ pinned: '1.14.1', installed: '1.14.1' });
   const calls = [];
   const res = await u.runUpgrade(
-    { to: '1.15.0', from: join(src, 'cloudbongos-core-1.15.0.tgz'), instance: dir, dryRun: true },
+    { to: '1.15.0', from: join(src, 'bongos-core-1.15.0.tgz'), instance: dir, dryRun: true },
     { log: () => {}, err: () => {}, run: fakeRun(calls, { dirty: '' }) }
   );
   assert.equal(res.ok, true);
@@ -153,13 +153,13 @@ t('dry-run: plans without rewriting package.json or spawning npm', async () => {
 // ---- 6. full happy-path (every side effect injected; ledger skipped, DB-free) ----
 t('full: pre-flight → pin → install → migrate → materialize → restart → verify', async () => {
   const src = mkdtempSync(join(tmpdir(), 'src-'));
-  writeFileSync(join(src, 'cloudbongos-core-1.15.0.tgz'), 'TGZ');
+  writeFileSync(join(src, 'bongos-core-1.15.0.tgz'), 'TGZ');
   const dir = scratchConsumer({ pinned: '1.14.1', installed: '1.14.1' });
   const calls = [];
   let materialized = null;
   let regenArgs = null;
   const res = await u.runUpgrade(
-    { to: '1.15.0', from: join(src, 'cloudbongos-core-1.15.0.tgz'), instance: dir, service: 'emersonian.service' },
+    { to: '1.15.0', from: join(src, 'bongos-core-1.15.0.tgz'), instance: dir, service: 'emersonian.service' },
     {
       log: () => {}, err: () => {},
       run: fakeRun(calls, { dirty: '', installTo: '1.15.0', dir }),
@@ -174,26 +174,26 @@ t('full: pre-flight → pin → install → migrate → materialize → restart
   assert.equal(res.versionOk, true, 'installed version must equal the target after install');
   // pin rewritten, tarball vendored
   assert.equal(u.readPinnedCoreVersion(dir), '1.15.0');
-  assert.equal(readFileSync(join(dir, 'vendor', 'cloudbongos-core-1.15.0.tgz'), 'utf8'), 'TGZ');
+  assert.equal(readFileSync(join(dir, 'vendor', 'bongos-core-1.15.0.tgz'), 'utf8'), 'TGZ');
   // steps ran, in the expected order
   assert.deepEqual(
     calls.filter((c) => c.startsWith('npm') || c.startsWith('git') || c.startsWith('systemctl')),
     ['git status --porcelain', 'npm install --no-audit --no-fund', 'npm run migrate', 'systemctl restart emersonian.service']
   );
   // materialize pointed at the freshly-installed core
-  assert.ok(materialized && materialized.coreRoot.endsWith(join('node_modules', '@cloudbongos', 'core')));
+  assert.ok(materialized && materialized.coreRoot.endsWith(join('node_modules', '@bongos', 'core')));
   assert.equal(materialized.instanceDir, dir);
   // task 2051: the API docs+client regen ran too, pointed at the same new core + instance
   assert.ok(regenArgs, 'regenerateApiArtifacts step invoked');
   assert.equal(regenArgs.instanceDir, dir);
-  assert.ok(regenArgs.coreRoot.endsWith(join('node_modules', '@cloudbongos', 'core')));
+  assert.ok(regenArgs.coreRoot.endsWith(join('node_modules', '@bongos', 'core')));
 });
 
 // ---- 6b. regenerate the API artifacts on upgrade (task 2051) ----------------
 t('regenerateApiArtifacts: spawns docs then client from the new core, targeting the instance', () => {
   const calls = [];
   const run = (cmd, args, opts) => { calls.push({ cmd, args, opts }); return { status: 0 }; };
-  const res = u.regenerateApiArtifacts({ instanceDir: '/inst', coreRoot: '/inst/node_modules/@cloudbongos/core' }, run, { existsSync: () => true });
+  const res = u.regenerateApiArtifacts({ instanceDir: '/inst', coreRoot: '/inst/node_modules/@bongos/core' }, run, { existsSync: () => true });
   assert.equal(res.ok, true);
   assert.deepEqual(res.ran, ['gen-api-docs.js', 'gen-api-client.js']);
   assert.equal(calls.length, 2);
@@ -225,11 +225,11 @@ t('regenerateApiArtifacts: a generator non-zero exit stops + reports (docs ran,
 
 t('runUpgrade: --skip-regen-docs skips the regen step', async () => {
   const src = mkdtempSync(join(tmpdir(), 'src-'));
-  writeFileSync(join(src, 'cloudbongos-core-1.15.0.tgz'), 'TGZ');
+  writeFileSync(join(src, 'bongos-core-1.15.0.tgz'), 'TGZ');
   const dir = scratchConsumer({ pinned: '1.14.1', installed: '1.14.1' });
   let regenCalled = false;
   const res = await u.runUpgrade(
-    { to: '1.15.0', from: join(src, 'cloudbongos-core-1.15.0.tgz'), instance: dir, skipRegenDocs: true },
+    { to: '1.15.0', from: join(src, 'bongos-core-1.15.0.tgz'), instance: dir, skipRegenDocs: true },
     {
       log: () => {}, err: () => {},
       run: fakeRun([], { dirty: '', installTo: '1.15.0', dir }),
@@ -352,6 +352,70 @@ t('pollHealth: a persistent non-2xx status is reported (not treated as ready)',
   assert.equal(res.timedOut, true);
 });
 
+// ---- 7. registry update channel (ADR 0134, task 2090) -----------------------
+t('versionFromDep: parses bare/caret/tilde semver; file: spec → null (tgz path is versionFromTgzPath\'s job)', () => {
+  assert.equal(u.versionFromDep('1.17.0'), '1.17.0');
+  assert.equal(u.versionFromDep('^1.17.0'), '1.17.0');
+  assert.equal(u.versionFromDep('~1.17.0'), '1.17.0');
+  assert.equal(u.versionFromDep('file:vendor/bongos-core-1.17.0.tgz'), null);
+  assert.equal(u.versionFromDep(''), null);
+  assert.equal(u.versionFromDep(null), null);
+});
+
+t('writeRegistryPin / readPinnedCoreVersion: round-trip an exact registry version', () => {
+  const dir = scratchConsumer({ pinned: '1.16.0', installed: '1.16.0' });
+  const prev = u.writeRegistryPin(dir, '1.17.0');
+  assert.equal(prev, 'file:vendor/bongos-core-1.16.0.tgz', 'returns the previous pin');
+  assert.equal(JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).dependencies['@bongos/core'], '1.17.0', 'pins the exact version (not file:)');
+  assert.equal(u.readPinnedCoreVersion(dir), '1.17.0', 'reads the registry pin back');
+});
+
+t('runUpgrade --registry (dry-run): plans a registry pin, no npm, pin unchanged', async () => {
+  const dir = scratchConsumer({ pinned: '1.16.0', installed: '1.16.0' });
+  const calls = [];
+  const res = await u.runUpgrade(
+    { to: '1.17.0', registry: true, instance: dir, dryRun: true },
+    { log: () => {}, err: () => {}, run: fakeRun(calls, { dirty: '' }) }
+  );
+  assert.equal(res.ok, true);
+  assert.equal(res.dryRun, true);
+  assert.equal(u.readPinnedCoreVersion(dir), '1.16.0', 'pin unchanged in dry-run');
+  assert.ok(!existsSync(join(dir, '.npmrc')), 'dry-run writes no .npmrc');
+  assert.ok(!calls.some((c) => c.startsWith('npm')), 'no npm spawned in dry-run');
+});
+
+t('runUpgrade --registry + --from: refuses (mutually exclusive core sources)', async () => {
+  const dir = scratchConsumer({ pinned: '1.16.0', installed: '1.16.0' });
+  const res = await u.runUpgrade(
+    { to: '1.17.0', registry: true, from: '/tmp/x.tgz', instance: dir },
+    { log: () => {}, err: () => {}, run: fakeRun([], { dirty: '' }) }
+  );
+  assert.equal(res.ok, false);
+  assert.match(res.error, /mutually exclusive/);
+});
+
+t('runUpgrade --registry (full): pins the exact version + writes the env-fed .npmrc, then install→migrate→verify', async () => {
+  const dir = scratchConsumer({ pinned: '1.16.0', installed: '1.16.0' });
+  const calls = [];
+  const res = await u.runUpgrade(
+    { to: '1.17.0', registry: true, instance: dir, service: 'demo.service' },
+    {
+      log: () => {}, err: () => {},
+      run: fakeRun(calls, { dirty: '', installTo: '1.17.0', dir }),
+      materialize: () => ({ skills: 1, settings: true, hooks: 1 }),
+      regenerateApiArtifacts: () => ({ ok: true, ran: [] }),
+      databaseUrl: '', pgDatabase: '',
+    }
+  );
+  assert.equal(res.ok, true, 'registry upgrade succeeds');
+  assert.equal(res.toVersion, '1.17.0');
+  assert.equal(JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).dependencies['@bongos/core'], '1.17.0', 'exact registry pin (no file:)');
+  const npmrc = readFileSync(join(dir, '.npmrc'), 'utf8');
+  assert.match(npmrc, /_authToken=\$\{NPM_TOKEN\}/, 'wrote the env-fed .npmrc');
+  assert.ok(calls.some((c) => /^npm install/.test(c)), 'ran npm install (resolves from the registry)');
+  assert.ok(!calls.some((c) => /vendor/.test(c)), 'did not vendor a tarball');
+});
+
 await Promise.all(pending);
 console.log(`\nupgrade: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);