@bongos/core 1.19.13 → 1.19.14

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.13",
-  "core_contract": "1.19.13",
-  "source_commit": "9871ae1c84d380c804f27a2a8f2c8b31a1c0eae2",
+  "core_version": "1.19.14",
+  "core_contract": "1.19.14",
+  "source_commit": "7af64de71325c4fa0a2a3781aba4ba8027d58595",
   "source_ref": "HEAD",
-  "built_at": "2026-08-08T20:54:03.577Z",
+  "built_at": "2026-08-09T19:38:10.086Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 284,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1508,
-  "tree_sha256": "ee0b74c675d9eae8a9eacfe1e32c2c3b89f6b30cde100b786e5c4dd04f859ede",
+  "tree_sha256": "9537ad41abffa62130dfdbd1ef29089f42a32d6dc0ff7d828db93d186d859256",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1452,7 +1452,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "c544204fb13188ac17bdb8841866fcd61df2cd8a9a033f73bbca04b4cd1202e2"
+      "sha256": "80d1e530d5c15bad53c3bcead244dfbb824236d1db0d281a41abd09f009f300d"
     },
     {
       "path": "docs/recipes/devbox-app-release.md",
@@ -3997,12 +3997,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e651e8a285a3591a06a4562fef0fe2b92a412da95e879f12a891d743358f4dd9"
+      "sha256": "eec2d6c15c812a0a16eb34ed1faa512c2b54cca572fbec9848d912458f3b4582"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4649829e05fa95e32332b71cdc37037d194f4f15b7c47af6618eb1f00dd2f785"
+      "sha256": "09df25006c6b67eebe751541c4fc431ea3d436c846199b5385399a6791e615fd"
     },
     {
       "path": "public-docs/index.html",
@@ -5622,7 +5622,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "138d3c390e59579f2f8b68f2bed364df776af9e1374c62ce6d12dc9a0fe8a43d"
+      "sha256": "a3542f301db80c9e2a81edbee3d89c4d41be9db997ef38ad41be1f46a224efde"
     },
     {
       "path": "src/module-loader/loader.js",

package/docs/recipes/core-release-pipeline.md

@@ -126,6 +126,8 @@ The mechanics of the bump itself — pre-flight, pin-verify, migrate, `.claude/`
 
 Also: an instance can have **more than one plane to update** (e.g. a web instance plus a control plane that resolves its tooling from its own vendored core). Updating one does not update the other.
 
+**Worked example — cloudbongos.com (task 1002621).** The web instance moved off `file:vendor/...` onto a bare registry pin (`bongos upgrade --to <v> --registry --force`, then commit+push `package.json`/`package-lock.json`/`.npmrc` — no tarball) and is enrolled in [`config/update-subscriptions.json`](../../config/update-subscriptions.json) on the `patch` channel, with the `core-update-subscription` routine armed via a dedicated systemd timer on the control-plane box (daily; see [upgrading-the-core](upgrading-the-core.md) for the generic enroll/arm steps). The deploy service's `npm ci` and the routine's `npm view` both authenticate via a root-owned `NPM_TOKEN` env file wired in through each unit's `EnvironmentFile` — a read-only token never committed to any repo. The control plane's own tooling pin is a separate, not-yet-migrated plane (see above).
+
 ---
 
 ## Detecting divergence

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.13",
+  "version": "1.19.14",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.13",
+      "version": "1.19.14",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.13",
+  "version": "1.19.14",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -453,8 +453,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.11 with no explicit bump. run 31277905072. (task 1002620)
 //   1.19.13 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.12 with no explicit bump. run 31277989346. (task 1002620)
+//   1.19.14 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.13 with no explicit bump. run 31332130808. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.13'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.14'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');