@bongos/core 1.19.118 → 1.19.120

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.118",
-  "core_contract": "1.19.118",
-  "source_commit": "b2c7044681ffb9b34e63677b0487f02dba2111df",
+  "core_version": "1.19.120",
+  "core_contract": "1.19.120",
+  "source_commit": "aa2b9a92ce2984a3d4095b234ee2757098a5dd5a",
   "source_ref": "HEAD",
-  "built_at": "2026-08-14T19:32:31.077Z",
+  "built_at": "2026-08-14T20:14:51.707Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 302,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1562,
-  "tree_sha256": "d14e35ba8094c969d33de804077321c1dd6f7463d0d4a1d77585ebc85e501e7c",
+  "tree_sha256": "84cbdf23f5f59fa6d3b2561ccc3fd1427ed42f8a1254864738f696d9ad68b431",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1577,7 +1577,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "80d1e530d5c15bad53c3bcead244dfbb824236d1db0d281a41abd09f009f300d"
+      "sha256": "512d67da7fba233e31f318b3fa8aacb377fecaf4f1810696f8357507620424db"
     },
     {
       "path": "docs/recipes/devbox-app-release.md",
@@ -1642,7 +1642,7 @@
     {
       "path": "docs/recipes/ops-gotchas.md",
       "mode": "0000644",
-      "sha256": "1e35b15c1f366aae52aedbd12e4a193343f8fd13b2fc6bdec13f927b7a22e5f4"
+      "sha256": "bafbbe9d5b6cde72bd2bdbe0b5578550a282b20e73a5f025da6ab7fdb46f69b1"
     },
     {
       "path": "docs/recipes/overnight-builder.md",
@@ -4162,12 +4162,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a21e300cabe4c1a3af1b84fcb4b190c8ee109acd79d888e04351cb9064162457"
+      "sha256": "05d0b9f864bda27810fdb4395f11dbd2a10c154d990cb9a797b4861b12939200"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4faa734f756086158c7c1d7983352c08d52961e479c1487aadba9a770007d19e"
+      "sha256": "e3f4d846962f68ba3a7e53dc71476cf2d516dd7aa031bf03fa18abc9c09b3e07"
     },
     {
       "path": "public-docs/index.html",
@@ -4417,7 +4417,7 @@
     {
       "path": "public-landing/index.html",
       "mode": "0000644",
-      "sha256": "bddfd05afb8b2c93155efff9bfc6812a7e213ed7f4d66a8d4cd2db3c899d0088"
+      "sha256": "1fa06d66fc4c1bbe3849e6fbf402852caea8b7cfc80a4c69ecad26d921d4264d"
     },
     {
       "path": "public-landing/projects.html",
@@ -5742,7 +5742,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2e899e310368c74a25215b99d3dabced0755c87f85569d23a069417dd20c661a"
+      "sha256": "16aec96c16dd0b8315db0bc9879b36b75195a81f944ccae84ded61de76b5717f"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/recipes/core-release-pipeline.md

@@ -130,6 +130,59 @@ Also: an instance can have **more than one plane to update** (e.g. a web instanc
 
 ---
 
+## The pin-bump runbook — cloudbongos.com, one paste per step (task 1002767)
+
+The generic mechanics are [upgrading-the-core](upgrading-the-core.md); this is the **operational sequence for the live mothership** — registry pin, pull-deploy repo at `/home/lars/cloudbongos-instance`, `cloudbongos.service` serving `127.0.0.1:3002`. Every trap below cost a real round trip on the 2026-08-13 (`1.19.91 → 1.19.94`) run; the goal is that the next bump is one paste, not fifteen.
+
+**Cadence: bump once, at session end.** One upgrade covers every release the session landed (publish-on-merge cuts one per merge — you don't chase each). Don't bump per-ship.
+
+### Step 1 — pick the version (your machine, main checkout)
+
+```bash
+git fetch origin --tags
+git tag --list 'core-v*' --contains <your-merge-sha> | sort -V | head -1
+```
+
+**Failure this prevents — pinning a release that predates your work.** The version your own ship report printed is usually the release cut for the *previous* merge (ADR 0161 publishes *after* each land). The version to pin is the newest tag that **contains** your merge. If no tag contains it, the publish lane hasn't finished (or is disarmed): a green `publish` *check* is not evidence of a publish — read the Publish **step log** for `+ @bongos/core@<version>`. The package is private, so an anonymous `npm view` proves nothing either.
+
+### Step 2 — the bump (the owner runs this line, via `!` in the session)
+
+The permission classifier blocks the agent from running a mutating `sudo -u lars` over ssh, so this paste is the **owner's**. The `!` prefix also keeps ssh honest: a bare `ssh host` is non-interactive here — it connects, prints the MOTD, and exits — so the command must ride as an argument.
+
+```
+! ssh -i ~/.ssh/otb_builder jaxri@REDACTED_IP "sudo -n -u lars bash -c 'cd /home/lars/cloudbongos-instance && export NPM_TOKEN=\$(grep -oP \"(?<=_authToken=).*\" /home/lars/.npmrc | head -1) && [ -n \"\$NPM_TOKEN\" ] || { echo EMPTY NPM_TOKEN — aborting; exit 12; }; ./node_modules/.bin/bongos upgrade --registry --to <VER> --service cloudbongos.service --health-url http://127.0.0.1:3002/healthz --commit-pin'"
+```
+
+What each piece is for — each guards a failure that actually happened:
+
+- **Token extraction runs as lars** (the whole command is inside `sudo -u lars bash -c`). Reading `/home/lars/.npmrc` as `jaxri` is `Permission denied`, which yields an **empty** `NPM_TOKEN`, which sends npm to the **public** registry, which 404s on the private `@bongos/core` — and the upgrade rolls back cleanly, having taught you nothing. The `[ -n "$NPM_TOKEN" ] || exit` guard aborts instead of half-running.
+- **`--to <VER>` is required** — `bongos upgrade` refuses to guess a target.
+- **`--service` + `--health-url` buy the automatic rollback.** Point the health URL at `http://127.0.0.1:3002/healthz`, **not the public URL** — a pre-launch `basic_auth` on the apex makes a healthy boot look failed and triggers a needless rollback.
+- **`--commit-pin` commits AND pushes the pin.** The instance is a pull-deploy repo: the next sync runs `git reset --hard origin/main`, which reverts an uncommitted pin, and `npm ci` then reinstalls the old core. Nothing errors. This is exactly how live sat 13 releases behind (task 1002712). The same applies to any tracked instance-config edit (`config/branding.json`): commit + push or the next deploy tick undoes it. A commit that fails to *push* saves nothing — deploy.sh resets to the remote.
+- **The `core_upgrades` ledger row needs `PGDATABASE`.** The migrate step resolves the instance DB itself, but the ledger write reads only the env — under `sudo -u lars bash -c` there is none, so the run logs `ledger skipped (no DATABASE_URL or PGDATABASE)`. The bump still succeeds. If you want the row: read the DB name once (`! ssh -i ~/.ssh/otb_builder jaxri@REDACTED_IP "sudo -n -u lars grep -A1 '\"db\"' /home/lars/cloudbongos-instance/config/branding.json"`) and splice `export PGDATABASE=<name> &&` into the paste before the `bongos upgrade` call.
+
+### Step 3 — verify on the box, not from your browser
+
+```
+! ssh -i ~/.ssh/otb_builder jaxri@REDACTED_IP "curl -s http://127.0.0.1:3002/version"
+```
+
+`coreVersion` must equal the target. This is the proof; the deploy tool's own output is not.
+
+**Failure this prevents — trusting a stale or gated public view.** The apex may sit behind pre-launch `basic_auth`, and HTML rides the CDN. (The classic *stylesheet* staleness — new HTML styled by a 4-hour-old `cosmos.css` — was fixed by content-hashed asset URLs in task 1002766, so a broken-*looking* page is no longer expected; if you must check publicly, use a cold profile or `fetch(url, {cache:'reload'})`.)
+
+### Step 4 — prove the pin is durable
+
+The `--commit-pin` output already reports commit + push. To prove durability the hard way, force a deploy tick and re-read the version — a reverted pin shows up here and nowhere else:
+
+```
+! ssh -i ~/.ssh/otb_builder jaxri@REDACTED_IP "sudo -n systemctl start cloudbongos-deploy.service; sleep 5; curl -s http://127.0.0.1:3002/version"
+```
+
+If `coreVersion` regressed: the pin didn't reach `origin/main` — re-run the bump and watch for the `PIN NOT COMMITTED` warning text, or commit+push `package.json` + `package-lock.json` in the instance repo by hand.
+
+---
+
 ## Detecting divergence
 
 [`scripts/gds/deploy-divergence.js`](../../scripts/gds/deploy-divergence.js) is the comparison that was missing during the ten-day incident. It runs **warn-only at the end of every ship** and can be run by hand any time:

package/docs/recipes/ops-gotchas.md

@@ -198,6 +198,12 @@ Organized by topic, not chronology. New entries go in the matching section; crea
 - **Related:** publish-on-merge (ADR 0161) pushes a `release: core X.Y.Z` carrier commit after every land, so on an instance that DOES deploy, the deploy run belongs to the carrier's sha, not the merge commit's. A strict sha match never hit — hence the same permanent `pending`. The probe now also accepts a successful `main` deploy that started after the merge.
 - **The wait is bounded.** A probe stuck at `deploy=pending` for a reason that never resolves looks identical to a slow deploy on any single sweep, so after `<redacted>` (default 30 min) a task whose land is *provable on main* ships anyway, and the sweep logs `deploy still unconfirmed after Nmin`. This lifts only the deploy gate — the per-task land proof is untouched, so it can never become a branch-reuse false-ship. Raise the env var on an instance whose real deploy legitimately takes longer than 30 minutes.
 
+### Moving the live cloudbongos.com pin — use the runbook, not memory
+
+- **What:** the end-of-session pin bump (registry-pinned mothership) is a scripted sequence now: [the pin-bump runbook](core-release-pipeline.md#<redacted>). One paste per step; each step names the failure it prevents.
+- **The three that bite hardest** if you freelance it: an NPM token extracted as the wrong user comes back **empty**, npm silently hits the public registry, 404s on the private package, and rolls back cleanly (you learn nothing); a pin left **uncommitted or unpushed** is reverted by the pull-deploy's `git reset --hard` on the next tick — this is how live sat 13 releases behind; and a `--health-url` pointed at the **public apex** instead of `127.0.0.1:3002` reads pre-launch `basic_auth` as a failed boot and triggers a needless rollback.
+- **Cadence:** once per session, at close — one bump covers all the session's releases. The version to pin is the newest `core-v*` tag that **contains** your merge, not the one your ship report printed.
+
 ---
 
 ## Status page + monitoring

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.118",
+  "version": "1.19.120",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.118",
+      "version": "1.19.120",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.118",
+  "version": "1.19.120",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/index.html

@@ -79,11 +79,15 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
    The head is SKIN, not a card. It carries its own --skin-* tokens and must
    NEVER inherit --bg-card — that turns it black in dark mode. These are
    component-scoped (on .bongos, not :root) so they cannot collide with the
-   pack's contract tier. */
+   pack's contract tier.
+
+   The ground shadow follows cosmos.css's --shadow-card rule: ink-derived in
+   light (warm brown), plain black in dark — in dark, --ink is near-white and
+   an ink fill would glow, not shade. */
 .bongos{display:block;width:100%;height:auto;overflow:visible;
-  --skin-hi:#fffdf8;--skin-mid:#fff6e9;--skin-lo:#e8d3b6;}
-:root[data-mode="dark"] .bongos{--skin-hi:#fdf7ea;--skin-mid:#efe1c8;--skin-lo:#c3ae90;}
-@media (prefers-color-scheme:dark){:root:not([data-mode="light"]) .bongos{--skin-hi:#fdf7ea;--skin-mid:#efe1c8;--skin-lo:#c3ae90;}}
+  --skin-hi:#fffdf8;--skin-mid:#fff6e9;--skin-lo:#e8d3b6;--drum-shadow:var(--ink);}
+:root[data-mode="dark"] .bongos{--skin-hi:#fdf7ea;--skin-mid:#efe1c8;--skin-lo:#c3ae90;--drum-shadow:#000;}
+@media (prefers-color-scheme:dark){:root:not([data-mode="light"]) .bongos{--skin-hi:#fdf7ea;--skin-mid:#efe1c8;--skin-lo:#c3ae90;--drum-shadow:#000;}}
 .mascot{position:relative;}
 .mascot::before{content:"";position:absolute;inset:-8% -12%;z-index:-1;border-radius:50%;
   background:radial-gradient(ellipse at center,rgba(255,255,255,.95) 0%,rgba(255,255,255,.7) 45%,rgba(255,255,255,0) 72%);}
@@ -274,7 +278,7 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
 
         <ellipse class="glow" cx="222" cy="170" rx="215" ry="140" fill="url(#halo)"/>
         <ellipse class="bshadow" cx="220" cy="286" rx="142" ry="14"
-                 fill="var(--ink)" opacity=".22" filter="url(#soft)"/>
+                 fill="var(--drum-shadow)" opacity=".22" filter="url(#soft)"/>
 
         <!-- the joining block, behind both shells -->
         <path d="M 214,196 C 232,188 250,188 264,196 L 258,232 C 244,225 230,225 219,232 Z" fill="var(--accent-deep)"/>

package/src/module-api.js

@@ -663,8 +663,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.116 with no explicit bump. run 31830559253. (task 1002620)
 //   1.19.118 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.117 with no explicit bump. run 31833658900. (task 1002620)
+//   1.19.119 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.118 with no explicit bump. run 31835957309. (task 1002620)
+//   1.19.120 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.119 with no explicit bump. run 31836959112. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.118'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.120'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');