@bongos/core 1.19.150 → 1.19.151

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.150",
-  "core_contract": "1.19.150",
-  "source_commit": "ba28eaba03c65c990128c56929d0e30a18a2cb14",
+  "core_version": "1.19.151",
+  "core_contract": "1.19.151",
+  "source_commit": "6ffcec970cdf3d4340b66e42edb33a49257fd4c5",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T14:43:24.321Z",
+  "built_at": "2026-08-16T14:50:02.406Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 304,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1579,
-  "tree_sha256": "5429ba0237ab985ff79be4a1b9a03dd24cacd6260fdc604247b7eef8a36583dc",
+  "tree_sha256": "0b11b762ff3c5e42925fc4aa0d743f3bd3f3b77e4340e4d00013c3cefe401540",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1177,7 +1177,7 @@
     {
       "path": "docs/adr/0144-devbox-rehome-onto-cloudbongos-plane.md",
       "mode": "0000644",
-      "sha256": "e4ddc6e640919691a6f6143493158ee080bb6e9edb9e6bf0b8cc24832fb9c3b2"
+      "sha256": "6f3312ff0cdfdb824626375ca4e3e517e21f5f0f7087f579feee40e836bb3cc1"
     },
     {
       "path": "docs/adr/0144-federated-single-logout-backchannel.md",
@@ -1352,7 +1352,7 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "3967a6a48afbbd5e71d486f4f518f768fc3e3000ccd75ee310406a93977a3489"
+      "sha256": "49747f42b1229ee8a2ecc54c317fc7173a91a4340ddfe2033e1a78b0f6ed1482"
     },
     {
       "path": "docs/branding-contract.md",
@@ -4187,12 +4187,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "86e259a725603b58d5659d630124568731893e6497d933327cbc29ab733955b8"
+      "sha256": "739468093ef4eab580a28b005fd816fadee7f7cf1facf9db6f9f5cf9cc352b36"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cf358f722d2710aa11787645b256c890c6508e5c34ff735044ef8a9b28951d7e"
+      "sha256": "6f3fd6f5b9780d2e612b95a4d1ba8cba840b1d5c79be73aaa034d435a8da344b"
     },
     {
       "path": "public-docs/index.html",
@@ -4622,7 +4622,7 @@
     {
       "path": "scripts/gds/box.js",
       "mode": "0000644",
-      "sha256": "117b0ed6730e35559356403b50240d0ef5b6ab46752a8cf76de4e0a8ad244d42"
+      "sha256": "c8a79e6541a2e26e590bd8ee1bbf31cb0f7300c53dbd30c241f4c1f04a2af7bf"
     },
     {
       "path": "scripts/gds/build-bongos.js",
@@ -5782,7 +5782,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6cdc6cf28bcb58d18a41a575a253e9066e4fc6d1f86b8d1f7be60e12b99784db"
+      "sha256": "ac7dd33de47d132bc68dca844d0d7f0992a5fa14249516e84c32c21960b14ba6"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0144-devbox-rehome-onto-cloudbongos-plane.md

@@ -39,3 +39,6 @@ Stand up a **cloudbongos-native box plane** alongside (not replacing) the legacy
 2. **Cloudflare token scope.** Provision warned the ADR 0053 cookie-strip Transform Rule was **not** applied — `CLOUDFLARE_API_TOKEN` lacks "Transform Rules" edit scope on the cloudbongos.com zone. Add the scope (or apply the rule once in the dashboard) **before** other builders get boxes on `*.cloudbongos.com`, so platform cookies (`cookieDomain=<redacted> aren't sent to box subdomains.
 3. **Cosmetic `otb-` prefix.** Tunnel names (`otb-term-<login>`) and the droplet name (`otb-box-<login>`) are still hardcoded in `box-onboard.js`/`box.js`. Harmless (fleet separation is by tag, and DNS is per-zone), but a branding leak worth parameterizing.
 4. **Phase 4 — retire the legacy example plane** (owner decision) — **part (a) DONE in task 1002248 (2026-07-15).** Pre-checked read-only that the legacy fleet was empty (0 `otb-builder-box` droplets on DigitalOcean; cohost intent queue `ran=0`), then `systemctl disable --now` on the four `cohost-box-*` timers (intent-runner / idle-suspend / drift-reconcile / dormant-reclaim) on the control-plane host — now `disabled`/`inactive`; the native `cloudbongos-box-*` timers were left `enabled`/`active`. **Part (b) — disabling the dev-box module on example.com itself — NOT reachable from the control plane, flagged to owner:** example's web app + instance checkout are not co-located on the cloudbongos droplet (no local checkout, no ssh alias) and the local example GDS token is expired, so a durable module-disable needs owner access to example's own config/host. Harmless meanwhile: with the runners stopped there is no cost/security impact — worst case is a box request on the legacy instance that now hangs unfulfilled.
+5. **The control plane silently froze on core 1.19.2 — FIXED (task 1002738, 2026-08-16).** The four `cloudbongos-box-*` units were installed with `WorkingDirectory=/home/lars/cloudbongos` (§2 above), and `infra/core-node.sh` resolves the core from *that* root's `node_modules/@bongos/core` — pinned to the vendored `bongos-core-1.19.2.tgz`. The web app meanwhile moved to the npm registry pin and rode the nightly patch sweep to **1.19.146**. The two never converged, because `config/update-subscriptions.json` lists exactly ONE instance (`/home/lars/cloudbongos-instance`) and the box root was never added. Net effect: **every park/destroy/provision decision on this fleet was made by a core ~145 patches old**, so the whole point of tasks 1002726/1002727 — an idle box *parks* instead of being destroyed — was landed in `main`, released, deployed to the web app, and still **never executed**: `cmdSweepIdle` in 1.19.2 calls `deprovisionOne`. Nothing surfaced it; a shipped, released, deployed fix was simply inert.
+   **Fix.** A systemd drop-in on each of the four units re-points `WorkingDirectory` at `/home/lars/cloudbongos-instance` — the subscribed root the nightly sweep keeps current — and runs `node node_modules/@bongos/core/scripts/gds/box.js <cmd> --apply` directly. Same shape as the drop-ins already applied to `{selfhost,cohost}-provision-intent-runner`. The box lifecycle now inherits every core release with no second upgrade path to remember. The stale root is NOT retired: it still vendors `infra/` (the cloud-init + bring-up scripts the core package does not ship — follow-up 1 / ADR 0150), supplied to the units via `CLOUDBONGOS_BOX_INFRA_DIR=/home/lars/cloudbongos/infra`, the documented escape hatch that is candidate [#1](http://localhost:3000/builders#/task/1) in `boxInfraCandidates()`. Verified: all four commands dry-ran **identically** on old and new core before cutover (0 idle, 0 intents, DO⇄DB consistent, 0 dormant), then ran live under the drop-ins; the dormant sweep's new `warn >11d` window in the journal is the 1002727 code proving itself present.
+   **Why it stayed invisible, and the guard.** The sweep banner printed the *threshold* but never the *code*, so a stale plane looked identical to a current one in `journalctl`; diagnosing it needed a filesystem dig across two instance roots. `box.js` now prints one provenance line on every invocation — `box.js · running from @bongos/core@<version> · instance <root>` — naming the package it actually resolved. A frozen plane now announces itself in its own logs.

package/docs/architecture.md

@@ -11,7 +11,7 @@
 
 - **Domain:** `example.com` — registered at Cloudflare Registrar. DNS A records (apex + `www`) point to the droplet at `REDACTED_IP`. Cloudflare proxy is **ON (orange cloud)**. CF terminates TLS at the edge; the **Cloudflare Origin Certificate** handles the CF↔origin leg (valid through 2041-05-04). A `status` subdomain is added at PMS-V1 deploy time (see [`docs/pms-v1-deploy.md`](pms-v1-deploy.md)) with the same proxy/cert posture; Origin Cert needs `*.example.com` SAN. Real client IPs come in via `CF-Connecting-IP` / `X-Forwarded-For`, wired into Caddy's `trusted_proxies static` (the Cloudflare IP ranges) in the `infra/Caddyfile` global options block.
 - **Production droplet (co-hosting box):** DigitalOcean, hostname `example`, IPv4 `REDACTED_IP`, IPv6 `REDACTED_IP`. NYC3, Premium Intel 2 GB / 1 vCPU / 60 GB NVMe. Ubuntu 24.04 LTS. ~$14/mo. Hosts the OTB game + co-hosted project instances (`emersonian-circles.`, `staging.`).
-- **Cloud Bongos control-plane droplet (NEW 2026-07-05, [ADR 0126](adr/<redacted>.md), task [#2063](https://example.com/builders#/task/2063)):** DigitalOcean, hostname `cloudbongos`, IPv4 `REDACTED_IP`, NYC3, `s-1vcpu-2gb` (2 GB / 1 vCPU), Ubuntu 24.04, ~$12/mo, tag `cloudbongos-control`. Runs **cloudbongos.com + `builders.` + `status.`** (`src/platform-server.js`, Cloud Bongos brand, port 3002, own `cloudbongos` DB, checkout `/home/lars/cloudbongos`) and is the **sole token-holding control plane** — `/etc/cloudbongos/box.env` holds the account-wide Cloudflare token (IP-locked to this box) + the DigitalOcean token; this is where `provision.js` provisions instance subdomains. **Structurally separate SSH** (own `cloudbongos_ed25519` key). IPv6 egress disabled so the IPv4-locked CF token can't be spuriously rejected. cloudbongos.com was previously a co-tenant on the co-hosting box; that unit was decommissioned at cutover. **Follow-ups:** deploy automation (task [#2064](https://example.com/builders#/task/2064)) + fully stripping cloud tokens off the co-hosting box (task [#2065](https://example.com/builders#/task/2065)).
+- **Cloud Bongos control-plane droplet (NEW 2026-07-05, [ADR 0126](adr/<redacted>.md), task [#2063](https://example.com/builders#/task/2063)):** DigitalOcean, hostname `cloudbongos`, IPv4 `REDACTED_IP`, NYC3, `s-1vcpu-2gb` (2 GB / 1 vCPU), Ubuntu 24.04, ~$12/mo, tag `cloudbongos-control`. Runs **cloudbongos.com + `builders.` + `status.`** (`src/platform-server.js`, Cloud Bongos brand, port 3002, own `cloudbongos` DB, checkout `/home/lars/cloudbongos-instance`, the root subscribed to the nightly core-patch sweep) and is the **sole token-holding control plane** — a SECOND root, `/home/lars/cloudbongos`, survives only to vendor `infra/` (the box cloud-init the core package does not ship, ADR 0150); it is not subscribed, so nothing may resolve core code from it (task 1002738, [ADR 0144](adr/<redacted>.md) follow-up 5) — `/etc/cloudbongos/box.env` holds the account-wide Cloudflare token (IP-locked to this box) + the DigitalOcean token; this is where `provision.js` provisions instance subdomains. **Structurally separate SSH** (own `cloudbongos_ed25519` key). IPv6 egress disabled so the IPv4-locked CF token can't be spuriously rejected. cloudbongos.com was previously a co-tenant on the co-hosting box; that unit was decommissioned at cutover. **Follow-ups:** deploy automation (task [#2064](https://example.com/builders#/task/2064)) + fully stripping cloud tokens off the co-hosting box (task [#2065](https://example.com/builders#/task/2065)).
 - **Server stack:** Node.js 22 LTS · PostgreSQL 16 · Caddy 2.11.2. `example.service` (systemd) runs `node server.js` as user `lars` on `127.0.0.1:3000`; restart-on-failure.
 - **Hardening:** `lars` user with passwordless sudo; SSH key-only (root login disabled, password auth disabled); ufw allows 22/80/443; fail2ban active; unattended-upgrades enabled; timezone `America/New_York`.
 - **TLS:** Origin cert at `/etc/caddy/origin.crt` + `/etc/caddy/origin.key` for the example apexes on the co-hosting box. **cloudbongos.com's apexes moved to the dedicated control-plane droplet** ([ADR 0126](adr/<redacted>.md)) with their own copy of the Cloudflare Origin Cert (SAN `*.cloudbongos.com, cloudbongos.com`) at `/etc/caddy/cloudbongos-origin.{crt,key}` on `REDACTED_IP`. Cloudflare SSL/TLS mode = Full (strict). Renewal is a non-issue for ~15 years. **Provisioned instance hosts use a different, coexisting posture** ([ADR 0111](adr/<redacted>.md) §4 / task P4): Caddy **on-demand ACME** (Let's Encrypt) via the global `on_demand_tls { ask … }` block, gated to hostnames the `provisioning` module actually stood up (`/api/bongos/provisioning/tls-check`). Their DNS records are **proxied=false (grey cloud)** so the ACME challenge reaches Caddy — the opposite of the origin-cert apexes; do not enable the proxy on them or renewal breaks silently ([ADR 0003](adr/<redacted>.md)). Per-instance site snippets live in `/etc/caddy/sites/*.caddy` (`import`ed by `infra/Caddyfile`). **Tradeoff (accepted, SEC review of task 1945):** `proxied=false` publishes the box's real origin IP in public DNS for every co-tenant provisioned hostname — defeating, for those names, the Cloudflare-proxy IP-hiding the apexes enjoy (a co-tenant host resolves to the same `REDACTED_IP` that serves the main game). This is inherent to on-demand ACME (the challenge must hit the origin) and acceptable under the budget/trust model; prefer a **dedicated droplet** (its own IP) for any instance expected to draw hostile attention.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.150",
+  "version": "1.19.151",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.150",
+      "version": "1.19.151",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.150",
+  "version": "1.19.151",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/box.js

@@ -1447,11 +1447,38 @@ Named browser-terminal tunnel (#771, ADR 0038 — OPT-IN, default OFF):
 // never imports it, it is always spawned) it exposes the orchestration fns so the
 // dry-run/live contract can be exercised with injected fakes (#1034). The guard
 // keeps a require() from running the CLI + calling process.exit.
+// provenance() — WHICH core is making this fleet decision, and from which root.
+//
+// Task 1002738: the four cloudbongos-box-* units ran with WorkingDirectory pointed at
+// a root whose vendored @bongos/core was 1.19.2 while the web app had long since moved
+// to 1.19.146 — so every park/destroy/provision decision was made by a core ~145
+// patches behind, including a cmdSweepIdle that still DESTROYED an idle box. Nothing
+// in the journal said so: the sweep banner reports the THRESHOLD but never the code.
+// Diagnosing it took a filesystem dig across two instance roots.
+//
+// One line, printed by every invocation, makes that failure self-announcing: a stale
+// plane now says its own version in `journalctl -u cloudbongos-box-idle-suspend`, next
+// to the instance root that supplied it. Cheap, unconditional, and it can only be
+// wrong if the package it reads is the package it ran.
+// Names the package REPO_ROOT resolved to, not just its version: installed, that is
+// `@bongos/core@1.19.148`; in a monolith checkout it is the instance's own package, and
+// saying so is the point — the line must never let a monolith masquerade as a core pin.
+function provenance() {
+  let pkg = 'unknown';
+  try {
+    const p = require(path.join(REPO_ROOT, 'package.json'));
+    pkg = `${p.name || 'unknown'}@${p.version || 'unknown'}`;
+  } catch { /* a core with no readable package.json still runs — just say unknown */ }
+  const inst = instanceConfig.resolveInstanceRootExplicit() || process.cwd();
+  return `box.js · running from ${pkg} · instance ${inst}`;
+}
+
 async function main() {
   const args = process.argv.slice(2);
   const cmd = args[0];
   APPLY = hasFlag(args, '--apply');
   if (!cmd || cmd === '--help' || cmd === '-h' || cmd === 'help') { usage(); process.exit(0); }
+  console.log(provenance());
 
   const known = ['provision', 'onboard', 'park', 'wake', 'deprovision', 'run-intents', 'sweep-idle', 'sweep-dormant', 'reconcile', 'reconcile-drift', 'status'];
   if (!known.includes(cmd)) { console.error(`unknown command: ${cmd}\n`); usage(); process.exit(2); }

package/src/module-api.js

@@ -727,8 +727,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.148 with no explicit bump. run 31953207683. (task 1002620)
 //   1.19.150 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.149 with no explicit bump. run 31953504697. (task 1002620)
+//   1.19.151 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.150 with no explicit bump. run 31953827282. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.150'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.151'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');