@bongos/core 1.17.3 → 1.18.0

package/scripts/hall-preview/fixtures/me__sound-prefs.json

@@ -0,0 +1,67 @@
+{
+  "prefs": {},
+  "effective": [
+    {
+      "sound": "chime",
+      "label": "Chime",
+      "desc": "When Claude finishes a turn",
+      "default_enabled": true,
+      "override_enabled": null,
+      "enabled": true
+    },
+    {
+      "sound": "alert",
+      "label": "Alert",
+      "desc": "When Claude needs your input",
+      "default_enabled": true,
+      "override_enabled": null,
+      "enabled": true
+    },
+    {
+      "sound": "ship",
+      "label": "Ship",
+      "desc": "When a task ships",
+      "default_enabled": true,
+      "override_enabled": null,
+      "enabled": true
+    },
+    {
+      "sound": "triumph",
+      "label": "Triumph",
+      "desc": "When a big task ships",
+      "default_enabled": true,
+      "override_enabled": null,
+      "enabled": true
+    },
+    {
+      "sound": "fanfare",
+      "label": "Fanfare",
+      "desc": "When you earn a rank promotion",
+      "default_enabled": true,
+      "override_enabled": null,
+      "enabled": true
+    }
+  ],
+  "effective_map": {
+    "chime": true,
+    "alert": true,
+    "ship": true,
+    "triumph": true,
+    "fanfare": true
+  },
+  "volume": 100,
+  "defaults": {
+    "chime": true,
+    "alert": true,
+    "ship": true,
+    "triumph": true,
+    "fanfare": true
+  },
+  "known_sounds": [
+    "chime",
+    "alert",
+    "ship",
+    "triumph",
+    "fanfare"
+  ]
+}

package/scripts/hall-preview/fixtures/me__wandering.json

@@ -0,0 +1,43 @@
+{
+  "rank": "metic",
+  "levels": [
+    {
+      "n": 0,
+      "key": "locked",
+      "label": "Locked",
+      "blurb": "Strictly the claimed task. Off-task notes are filed silently, never raised.",
+      "allowed": true
+    },
+    {
+      "n": 1,
+      "key": "focused",
+      "label": "Focused",
+      "blurb": "On task, full in-task initiative; at most one captured follow-up at the end.",
+      "allowed": true
+    },
+    {
+      "n": 2,
+      "key": "balanced",
+      "label": "Balanced",
+      "blurb": "May surface a high-value tangent mid-task as \"capture or pursue?\" \u2014 your call.",
+      "allowed": true
+    },
+    {
+      "n": 3,
+      "key": "exploratory",
+      "label": "Exploratory",
+      "blurb": "A thinking partner \u2014 actively surfaces adjacent work and investigations.",
+      "allowed": true
+    }
+  ],
+  "default_level": 2,
+  "default_key": "balanced",
+  "max_level": 3,
+  "max_key": "exploratory",
+  "override_level": null,
+  "effective_level": 2,
+  "effective_key": "balanced",
+  "effective_label": "Balanced",
+  "contract": "Wandering: Balanced. Stay anchored to your claim, but if you hit a genuinely high-value or blocking tangent you may surface it briefly and ask \"capture or pursue?\" \u2014 leave the call to the user. Note anomalies as observations; don't rabbit-hole.",
+  "inject": false
+}

package/scripts/hall-preview/fixtures/override-requests.json

@@ -1 +1,15 @@
-{ "requests": [] }
+{
+  "requests": [
+    {
+      "id": "12",
+      "task_id": "777",
+      "task_title": "Synthetic: grader bypass ask for preview",
+      "requester_display_name": "Preview Builder",
+      "requester_login": "preview-builder",
+      "rationale": "Grader outage window \u2014 synthetic row.",
+      "credits_reward": 40,
+      "created_at": "2026-07-10T12:00:00.000Z",
+      "status": "open"
+    }
+  ]
+}

package/scripts/hall-preview/fixtures/security__docs.json

@@ -1 +1,10 @@
-{ "docs": [] }
+{
+  "docs": [
+    {
+      "title": "Synthetic engagement report",
+      "slug": "synthetic-engagement",
+      "updated_at": "2026-07-01T10:00:00.000Z",
+      "bytes": 4096
+    }
+  ]
+}

package/scripts/hall-preview/fixtures/security__reports.json

@@ -1 +1,31 @@
-{ "reports": [], "statuses": [] }
+{
+  "reports": [
+    {
+      "id": "31",
+      "severity": "high",
+      "title": "Synthetic: rate-limit missing on preview endpoint",
+      "target": "api/preview",
+      "status": "open"
+    },
+    {
+      "id": "32",
+      "severity": "medium",
+      "title": "Synthetic: verbose error leaks stack trace",
+      "target": "api/sample",
+      "status": "confirmed"
+    },
+    {
+      "id": "33",
+      "severity": "low",
+      "title": "Synthetic: cache header on static asset",
+      "target": "assets",
+      "status": "fixed"
+    }
+  ],
+  "statuses": [
+    "open",
+    "confirmed",
+    "fixed",
+    "disputed"
+  ]
+}

package/scripts/hall-preview/fixtures/sessions__search.json

@@ -1 +1,9 @@
-{ "totals": {}, "sessions": [] }
+{
+  "totals": {
+    "total": 214,
+    "builders": 6,
+    "tokens": 48200000,
+    "tool_errors": 12
+  },
+  "sessions": []
+}

package/scripts/hall-preview/server.js

@@ -19,6 +19,8 @@
 //                  window.__MODULES__ (verifies moduleOn() gating)
 //   --empty        serve every fixture with its arrays emptied — the
 //                  empty-state screenshot pass
+//   --rank archon  override the /me fixture's builder.rank so the Archon-gated
+//                  pages (watch, harbor, gate) render their content in preview
 //
 // Browse http://builders.localhost:<port>/ — Chromium resolves *.localhost,
 // and the `builders.` host prefix exercises the real subdomain serving path.
@@ -39,6 +41,11 @@ function arg(name) {
 }
 const PORT = Number(arg('--port')) || 4600;
 const EMPTY = process.argv.includes('--empty');
+// --rank: view the hall as a different rank — the /me fixture's builder.rank is
+// overridden in the response, so the Archon-gated pages (watch, harbor, gate)
+// render their real content instead of the sealed notice. Preview-only theatre:
+// the real pages are server-gated (requireArchonPage / ADR 0016).
+const RANK_OVERRIDE = arg('--rank');
 const MODULES_OFF = String(arg('--modules-off') || '').split(',').map((s) => s.trim()).filter(Boolean);
 // --modules-on: force-report modules as enabled — a dev box's local config
 // often lacks prod's instance modules (provisioning, dev-box), and their
@@ -68,6 +75,10 @@ const FIXTURE_FALLBACKS = [
   [/^goals\/\d+\/requests$/, 'goals__requests'],
   [/^goals\/\d+$/, 'goals__detail'],
   [/^tasks\/\d+$/, 'tasks__detail'],
+  // the #/idea/N + #/blocker/N deep-link overlay (task-detail.js) — one record
+  // fixture serves any id so the overlay seam assertion renders real content.
+  [/^inbox\/\d+$/, 'inbox__detail'],
+  [/^blockers\/\d+$/, 'blockers__detail'],
   [/^analytics\/builder\/\d+$/, 'analytics__builder'],
   [/^builders\/\d+\/active-claims$/, 'builders__active-claims'],
 ];
@@ -134,7 +145,13 @@ app.use((req, res, next) => {
     console.log(`  no fixture: ${apiPath}  (add scripts/hall-preview/fixtures/${apiPath.replace(/\//g, '__')}.json)`);
     return res.status(404).json({ error: { code: 'no_fixture', message: apiPath } });
   }
-  res.json(EMPTY ? emptied(fix) : fix);
+  let payload = EMPTY ? emptied(fix) : fix;
+  if (RANK_OVERRIDE && apiPath === 'me') {
+    payload = JSON.parse(JSON.stringify(payload));
+    if (payload.builder) payload.builder.rank = RANK_OVERRIDE;
+    else if ('rank' in payload) payload.rank = RANK_OVERRIDE;
+  }
+  res.json(payload);
 });
 
 // The hall pages, pre-auth-gate, through the real seams: boot-time stamped

package/src/module-api.js

@@ -199,8 +199,27 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         plus a THROWAWAY `updateCanary` marker removed in the phase-E follow-up. A
 //         backwards-compatible additive change with no API removal is exactly semver
 //         PATCH. Every `^1.x` / `^1.17` module pin is satisfied by 1.17.2.
+// 1.17.3 — task 2183 (R89 cutover prereq): republish so the packaged core carries the
+//         F6 migrate.sh fix (task 2180). Post-split, `scripts/migrate.sh` cd'd into the
+//         installed @bongos/core package before resolving the instance root, so a literal
+//         `npm run migrate` read the core's VANILLA module config and SILENTLY skipped
+//         every host + flag-gated module migration (rehearsal: 115 rows, no game schema;
+//         from the instance cwd, 121). 2180 fixed the script to resolve INSTANCE_ROOT from
+//         the invocation cwd (INIT_CWD/$PWD → the instance's bongos.config.json) and added
+//         a DB-free `--print-roots` regression guard. Published 1.17.2 PREDATES 2180, so a
+//         consumer pinning 1.17.2 would still skip host migrations — hence a PATCH republish
+//         at the F6-inclusive main. A functional-file bug fix with no doorway export change
+//         is exactly semver PATCH. Every `^1.x` / `^1.17` module pin is satisfied by 1.17.3.
+// 1.18.0 — task 2190 (R89 follow-up): first version cut from the cloud-bongos AUTHORITATIVE
+//         source repo. Re-seeds the standalone core (which had frozen at the 2026-07-03
+//         v1.14.0 extraction while core dev continued inside amazonprimea through 1.17.3)
+//         from amazonprimea's last-with-core commit 345494f2. Content is 1.17.3 PLUS the
+//         builders'-hall UI redesign (developed in amazonprimea as tasks 2171/2172/2173/2184) that
+//         post-dates the published 1.17.3 tarball — a new user-facing feature set with no
+//         doorway export removal, so semver MINOR. NOT yet published to npm (that is the
+//         follow-on release task); amazonprimea still runs the vendored 1.17.3.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.17.2'; // see the changelog above — 1.17.2 is the task-2148 canary upgrade-proof bump (adds /version coreVersion; no doorway export change)
+const CORE_VERSION = '1.18.0'; // see the changelog above — 1.18.0 is the first cut from the cloud-bongos authoritative source (re-seed task 2190); includes the builders'-hall UI redesign beyond published 1.17.3
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provision.mjs

@@ -100,6 +100,35 @@ t('standalone step generators: root under standaloneBase + pull / npm-ci / insta
   assert.match(P.standaloneMigrateCmd(inst), /PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules\/@bongos\/core\/scripts\/migrate\.sh/);
 });
 
+// ── nightly DB backup units (task 2213 — productizes the manual 2210 fix) ──────
+t('backup units: per-instance names + the DB set on the unit (fixes the task-2210 unset GDS_BACKUP_DB)', () => {
+  assert.equal(P.backupUnitName(coTenant), 'mercury-db-backup');
+  assert.equal(P.backupServicePath(coTenant), '/etc/systemd/system/mercury-db-backup.service');
+  assert.equal(P.backupTimerPath(coTenant), '/etc/systemd/system/mercury-db-backup.timer');
+  const svc = P.backupService(coTenant);
+  // the DB is pinned on the unit → no fallback to the nonexistent amazonprimea default
+  assert.match(svc, /Environment=GDS_BACKUP_DB=mercury/);
+  assert.match(svc, /Environment=GDS_BACKUP_DIR=\/var\/backups\/gds/);
+  assert.match(svc, new RegExp(`User=${reEsc('lars')}`), 'runs as the app user (mirrors serviceUnit)');
+  assert.match(svc, /ReadWritePaths=\/var\/backups\/gds/, 'the only writable path is the backup dir');
+  const timer = P.backupTimer(coTenant);
+  assert.match(timer, /OnCalendar=\*-\*-\* 04:00:00 UTC/);
+  assert.match(timer, /Unit=mercury-db-backup\.service/, 'the timer drives the per-instance service');
+});
+
+t('backupScriptPath resolves the CONSUMER LAYOUT, never the old /home/lars/amazonprimea monorepo path', () => {
+  // standalone → the script inside the instance's OWN pinned @bongos/core
+  const standalone = { ...coTenant, hosting_shape: 'standalone' };
+  const sPath = P.backupScriptPath(standalone);
+  assert.ok(sPath.startsWith(P.standaloneRoot(standalone) + '/'), 'under the instance root');
+  assert.match(sPath, /node_modules\/@bongos\/core\/scripts\/gds\/db-backup-nightly\.sh$/);
+  // co-tenant → this control-plane checkout's scripts/gds (mirrors serviceUnit's REPO_ROOT split)
+  assert.match(P.backupScriptPath(coTenant), /\/scripts\/gds\/db-backup-nightly\.sh$/);
+  // the regression this whole task fixes: NEVER the hardcoded old monorepo path
+  assert.doesNotMatch(P.backupService(standalone), /\/home\/lars\/amazonprimea/);
+  assert.doesNotMatch(P.backupService(coTenant), /\/home\/lars\/amazonprimea/);
+});
+
 t('webEnvBody: OAuth creds use the LOADED pack\'s envPrefix (not the slug) + brand/port/db', () => {
   const b = P.webEnvBody(coTenant); // coTenant.domain === null
   assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_GITHUB_CLIENT_ID=`));
@@ -280,6 +309,27 @@ await ta('provisionInstance(co-tenant) composes db → migrate → service → h
   assert.ok(writes.some((w) => /\/mercury\/web\.env$/.test(w)), 'wrote web.env');
   assert.ok(writes.some((w) => /\/mercury\.service$/.test(w)), 'wrote systemd unit');
   assert.ok(writes.some((w) => /\/mercury\.caddy$/.test(w)), 'wrote per-instance Caddy snippet');
+  // task 2213: EVERY instance is born with backups — dir + per-instance timer/service
+  assert.match(joined, /install -d -o lars -g lars -m 0750 \/var\/backups\/gds/, 'creates the backup dir');
+  assert.match(joined, /systemctl enable --now mercury-db-backup\.timer/, 'enables the per-instance backup timer');
+  assert.ok(writes.some((w) => /\/mercury-db-backup\.service$/.test(w)), 'wrote backup service unit');
+  assert.ok(writes.some((w) => /\/mercury-db-backup\.timer$/.test(w)), 'wrote backup timer unit');
+  // the backup timer is enabled AFTER the dir exists (else the first run exits 2)
+  assert.ok(idx(/install -d .*\/var\/backups\/gds/) < idx(/enable --now mercury-db-backup\.timer/), 'dir before timer enable');
+});
+
+await ta('provisionInstance(standalone): the backup unit ExecStart points at the instance\'s OWN pinned core (consumer layout)', async () => {
+  const { deps, writes } = recorder();
+  // capture the unit BODIES, not just paths, so we can assert the ExecStart path
+  const bodies = {};
+  deps.writeFile = (p, body) => { writes.push(p); bodies[p] = body; return { ok: true }; };
+  const inst = { ...coTenant, hosting_shape: 'standalone', target_ref: 'lars589/mercury' };
+  await P.provisionInstance(inst, deps);
+  const svc = bodies[P.backupServicePath(inst)];
+  assert.ok(svc, 'wrote the backup service unit');
+  const root = P.standaloneRoot(inst);
+  assert.match(svc, new RegExp('ExecStart=/bin/bash ' + reEsc(root) + '/node_modules/@bongos/core/scripts/gds/db-backup-nightly\\.sh'));
+  assert.match(svc, /Environment=GDS_BACKUP_DB=mercury/);
 });
 
 await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + npm ci) + migrates from the instance root', async () => {
@@ -427,6 +477,22 @@ await ta('provisionInstance(dedicated) does NOT run local createdb/migrate/seed
   assert.ok(!cmds.some((c) => /INSERT INTO versions/.test(c)), 'dedicated does not run the version seed locally (it rides cloud-init)');
 });
 
+await ta('dedicatedUserData bakes the nightly backup: unit files (b64) + dir + timer enable (task 2213)', async () => {
+  const inst = { ...coTenant, hosting_shape: 'dedicated' };
+  const cloudInit = P.dedicatedUserData(inst);
+  // the two unit files land via write_files (base64, so no YAML block-scalar escaping)
+  assert.match(cloudInit, /write_files:/);
+  assert.match(cloudInit, new RegExp('path: ' + reEsc(P.backupServicePath(inst))));
+  assert.match(cloudInit, new RegExp('path: ' + reEsc(P.backupTimerPath(inst))));
+  assert.match(cloudInit, /encoding: b64/);
+  // the base64 content round-trips to a real unit carrying the right DB
+  const b64 = cloudInit.match(/content: ([A-Za-z0-9+/=]+)/)[1];
+  assert.match(Buffer.from(b64, 'base64').toString('utf8'), /Environment=GDS_BACKUP_DB=mercury/);
+  // and the dir is created + the timer enabled on first boot
+  assert.match(cloudInit, /install -d -o lars -g lars -m 0750 \/var\/backups\/gds/);
+  assert.match(cloudInit, /enable --now mercury mercury-db-backup\.timer/);
+});
+
 console.log('\nDNS UPSERT composition (P4, CONFIG override):');
 
 // A recorder that also captures each exec's env (so we can assert the DNS hook env).
@@ -739,6 +805,9 @@ await ta('teardownInstance(privileged): systemctl + rm-under-/etc are sudo-prefi
   assert.match(joined, /sudo systemctl disable --now mercury/);
   assert.match(joined, /sudo rm -f \/etc\/systemd\/system\/mercury\.service/);
   assert.match(joined, /sudo systemctl daemon-reload/);
+  // task 2213: the backup units come down too (the dumps + dir are left in place)
+  assert.match(joined, /sudo systemctl disable --now mercury-db-backup\.timer/);
+  assert.match(joined, /sudo rm -f \/etc\/systemd\/system\/mercury-db-backup\.service \/etc\/systemd\/system\/mercury-db-backup\.timer/);
 });
 
 await ta('teardownInstance(default): NO sudo (bare, unchanged)', async () => {