@bongos/core 1.19.307 → 1.19.309

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.307",
-  "core_contract": "1.19.307",
-  "source_commit": "b8d2ed227fd6cb0b948128e23f0daf0070b50bcc",
+  "core_version": "1.19.309",
+  "core_contract": "1.19.309",
+  "source_commit": "725e32b7a94f36cdc81dd834470b1b66f526097a",
   "source_ref": "HEAD",
-  "built_at": "2026-08-23T20:16:34.186Z",
+  "built_at": "2026-08-23T20:35:56.294Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 322,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1418,
+    "functional_verbatim": 1420,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1762,
-  "tree_sha256": "2ce3db5cb1a893df39826469894f19d4acdee021e5729859eaa8d429933be04d",
+  "file_count": 1764,
+  "tree_sha256": "3cc77df63f396bc4dd00a837f27e9ec425e865292ef87c68631cd21424c2b3a4",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1417,12 +1417,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "d545aada2bc0127be904c5df12c393c3ab8756f84ef86cc7bcee1348074769f9"
+      "sha256": "a654d9def4780d3210c66031193198f58fd0d7d84f5088c4ce7e6d0a58682193"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "828558b3bd6cc8d7c9c720eef962e098e4f886ab33360833b2c6d3946acbd1d1"
+      "sha256": "e0b531f19187a3c00a54917bff4e2827a75b250f1aaa761229660a974a4f6217"
     },
     {
       "path": "docs/architecture.md",
@@ -1667,7 +1667,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "100a1bd6bde327c60f37727ce85f75cf5539b007473359692de7ab87876c936b"
+      "sha256": "b42d8b4620355bef0e27480b2ddfaa07140e322de988839f0e102f1a1545ac47"
     },
     {
       "path": "docs/recipes/devbox-app-release.md",
@@ -3777,7 +3777,7 @@
     {
       "path": "modules/ideas/routes/blockers.js",
       "mode": "0000644",
-      "sha256": "7c61821b9ddf9a9255f6a9916659140881a6436dbd50f3d53b4cf818640a39a4"
+      "sha256": "2247bb4499e6296fca8ccde3614b6726a50435786fc3cf634eaacd35982ef3f4"
     },
     {
       "path": "modules/ideas/routes/inbox.js",
@@ -3927,7 +3927,7 @@
     {
       "path": "modules/lifecycle/routes/done-when.js",
       "mode": "0000644",
-      "sha256": "7fb4a74237c1f84a5c20591663e634a7b190861e6a3f1c5804e22145ef58f6be"
+      "sha256": "73dee3ef1546bf873a27bac8a160c8de64a6dbb5d0da6f3b68648d3a90e07d21"
     },
     {
       "path": "modules/lifecycle/routes/gate-approvals.js",
@@ -4577,12 +4577,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4815e8ce78e80ac2fff7dad9f77bef508e2f0090459c67e59722b65af3e27294"
+      "sha256": "773974cb943d497f52079b0a6c08f0847b26c1838ebbe19bc17c1d8dd645c014"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bdeee91142d9d7f3930c99134be76d03f28329222adcf293deaa8f8354ab2cd8"
+      "sha256": "55f105febecf217cd1bab4e0b599fea8440a9f4b7cde870d64d379777130e79e"
     },
     {
       "path": "public-docs/index.html",
@@ -5067,7 +5067,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "e2d6f177e1ee5eda21b5d8711145b7de79b41a9f8dc1a1b9e2836dde2f1c0143"
+      "sha256": "a044b7ea705a87e569f903eb4fb19c941a1fbfd11b069563a2bc767be339d184"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -5309,6 +5309,11 @@
       "mode": "0000644",
       "sha256": "75130de4a880fc7d76f5a8d79ed65750238df94847c1ccfdc974188f9300a1e6"
     },
+    {
+      "path": "scripts/gds/go-live.js",
+      "mode": "0000644",
+      "sha256": "05734e21763cc0b0614275efa76b7b68afabee8be93f3f2d797400d6a97e86c1"
+    },
     {
       "path": "scripts/gds/goal.js",
       "mode": "0000644",
@@ -6157,7 +6162,7 @@
     {
       "path": "src/bongos/routes/healthz.js",
       "mode": "0000644",
-      "sha256": "da50a75349d36f7fee03c00b5f89697cf97fba91d4778fe304257d29470fedb5"
+      "sha256": "26f4992c484d2fc5882131c695c4173db950e4c815424fad68385bfa64fa7ab8"
     },
     {
       "path": "src/bongos/routes/instance.js",
@@ -6192,7 +6197,7 @@
     {
       "path": "src/bongos/routes/public.js",
       "mode": "0000644",
-      "sha256": "fbfc3422f111e6d3f1429cefec78741d4a919c89985bc9d69f0a7a8e070c52b5"
+      "sha256": "295b4bafc8a7bf832ed33fb0d35f4487a788caaff994383cda451cc24de2c6c7"
     },
     {
       "path": "src/bongos/routes/security.js",
@@ -6247,7 +6252,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "90436d6db6e32424c48549f61ad48a3a77f5c7cac1ae16d5559b7db76fee7b4a"
+      "sha256": "568f4581ec3aaece8686d24935541d7a8783e8fbf0c9bb76b9fdf9be7150dff2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6722,7 +6727,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "ad3daf4c6cc3a0f56d8d205077c835397b1d112a0219dabb05a7e8b3a8da9492"
+      "sha256": "5ca8997f238d8395663992c9ce9ccef08ea2b09fbee6735c44f119050ef9455b"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",
@@ -7164,6 +7169,11 @@
       "mode": "0000644",
       "sha256": "d0d10628a17717fdef505dcf501915ecfcc31a0c99d9e5d4cf6dc06b47d8c883"
     },
+    {
+      "path": "tests/go_live.mjs",
+      "mode": "0000644",
+      "sha256": "90c8cbfd8bf0b446261f9fd837b9b08b1035210f1cbf1f7ff81998ec535c32f1"
+    },
     {
       "path": "tests/goal_abuse_matrix.mjs",
       "mode": "0000644",

package/docs/api/openapi.json

@@ -1269,7 +1269,7 @@
           "blockers"
         ],
         "summary": "GET /blockers",
-        "description": "List currently-open blockers + the tasks each is blocking. Public: anyone landing on /builders or status.amazonprimea.com can see what's stuck on Lars. rank: public — open blocker list; documented \"Public: anyone landing on /builders or status.amazonprimea.com can see what's stuck on Lars\" in the handler comment above.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "List currently-open blockers + the tasks each is blocking. Public: anyone landing on /builders or the status dashboard (status.<apex>) can see what's stuck on the owner. rank: public — open blocker list; documented \"Public: anyone landing on /builders or the status dashboard can see what's stuck on the owner\" in the handler comment above.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/ideas/routes/blockers.js",
         "responses": {
@@ -6167,7 +6167,7 @@
           "healthz"
         ],
         "summary": "GET /healthz",
-        "description": "liveness probe; status.amazonprimea.com hits this anonymously.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "liveness probe; the status dashboard (status.<apex>) hits this anonymously.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/healthz.js",
         "responses": {
@@ -10623,7 +10623,7 @@
           "public"
         ],
         "summary": "GET /public/tasks/:id",
-        "description": "Single-task resolver for \"#NNN\" deep links. Our docs reference GDS task IDs as bare \"#NNN\"; read on github.com those collide with GitHub's own PR/issue autolinker (a separate number space) and mis-link, so they are rewritten to status-dashboard permalinks (status.amazonprimea.com/#/task/N) that resolve here. Privacy gate: a full title/summary is exposed ONLY for already-public work (status shipped|confirmed — same surface as /public/recent-shipped). In-flight tasks return status + version with the title WITHHELD, so unshipped or security-sensitive task names never leak to the open web. `kind`/`priority` are non-sensitive and always returned. rank: public — single-task resolver for doc deep links (title gated to shipped/confirmed).\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "Single-task resolver for \"#NNN\" deep links. Our docs reference GDS task IDs as bare \"#NNN\"; read on github.com those collide with GitHub's own PR/issue autolinker (a separate number space) and mis-link, so they are rewritten to status-dashboard permalinks (status.<apex>/#/task/N) that resolve here. Privacy gate: a full title/summary is exposed ONLY for already-public work (status shipped|confirmed — same surface as /public/recent-shipped). In-flight tasks return status + version with the title WITHHELD, so unshipped or security-sensitive task names never leak to the open web. `kind`/`priority` are non-sensitive and always returned. rank: public — single-task resolver for doc deep links (title gated to shipped/confirmed).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
         "parameters": [
@@ -10693,7 +10693,7 @@
           "public"
         ],
         "summary": "GET /public/versions",
-        "description": "read-only surface for status.amazonprimea.com.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "read-only surface for the status dashboard (status.<apex>).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/public.js",
         "responses": {
@@ -13471,7 +13471,7 @@
           "versions"
         ],
         "summary": "GET /versions/:id/done-when",
-        "description": "Public: status.amazonprimea.com fetches this every 60s alongside other public/* surfaces. No auth, same Cache-Control posture as the other status feeds. rank: public — status.amazonprimea.com fetches every 60s anonymously.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "Public: the status dashboard (status.<apex>) fetches this every 60s alongside other public/* surfaces. No auth, same Cache-Control posture as the other status feeds. rank: public — the status dashboard (status.<apex>) fetches every 60s anonymously.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/lifecycle/routes/done-when.js",
         "parameters": [

package/docs/api-reference.md

@@ -256,7 +256,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/healthz` | `public` | — | liveness probe; status.example.com hits this anonymously. |
+| GET | `/api/bongos/healthz` | `public` | — | liveness probe; the status dashboard (status.<apex>) hits this anonymously. |
 
 ## `inbox` (14)
 
@@ -439,7 +439,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/public/repo-info` | `public` | — | GitHub URL bases for the deployed checkout (V3.R13-followup-2 task 411). |
 | GET | `/api/bongos/public/tasks/:id` | `public` | — | Single-task resolver for "#NNN" deep links. |
 | GET | `/api/bongos/public/uptime` | `public` | — | Uptime: current status + 90-day history bucketed by hour. |
-| GET | `/api/bongos/public/versions` | `public` | — | read-only surface for status.example.com. |
+| GET | `/api/bongos/public/versions` | `public` | — | read-only surface for the status dashboard (status.<apex>). |
 
 ## `scouting` (1)
 
@@ -536,7 +536,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/versions` | `public` | — | read-only version list; mirrors /public/versions. |
 | POST | `/api/bongos/versions` | `metic+archon` | `id`, `name`, `status`, `track`, `done_when`, `scope_doc_path`, `criteria` | POST /versions — create a version + its done-when criteria in one call. |
-| GET | `/api/bongos/versions/:id/done-when` | `public` | — | Public: status.example.com fetches this every 60s alongside other public/* surfaces. |
+| GET | `/api/bongos/versions/:id/done-when` | `public` | — | Public: the status dashboard (status.<apex>) fetches this every 60s alongside other public/* surfaces. |
 | POST | `/api/bongos/versions/:id/done-when` | `metic+archon` | `criterion_id`, `criterion_md`, `goal_id`, `sort_order` | Auth (Metic+, then the goal's own authority): create a done-when criterion at RUNTIME. |
 | GET | `/api/bongos/versions/:id/progress` | `public` | — | Per-criterion progress rollup: each done-when criterion → the tasks that gate it (task_criteria, migration 055) → live statuses → what re… |
 | GET | `/api/bongos/versions/close-suggestions` | `public` | — | Close-flow gate suggestions for every version still 'building'. |

package/docs/recipes/core-release-pipeline.md

@@ -136,6 +136,38 @@ The generic mechanics are [upgrading-the-core](upgrading-the-core.md); this is t
 
 **Cadence: bump once, at session end.** One upgrade covers every release the session landed (publish-on-merge cuts one per merge — you don't chase each). Don't bump per-ship.
 
+### Step 0 — try the one command first (task 1003189)
+
+The whole sequence below is deterministic, so it is also a script. `go-live.js` composes the
+same parts this runbook narrates — `deploy-divergence.js` for the gap, the registry for proof a
+release exists, and `bongos upgrade --registry --commit-pin` for the bump itself — and reports
+once instead of forty times:
+
+```bash
+node scripts/gds/go-live.js
+```
+
+That is **plan-only and read-only**: it prints live-vs-target, checks the registry actually
+carries the target, and names every halt condition it found. Add `--apply` to move the pin.
+
+It **halts rather than guessing** on exactly the things that need judgement — unreleased commits
+on `main`, a registry missing the target, a dirty tree on either end, a failed health check, an
+uncommitted pin. When it halts, fall through to the manual steps below and use your own head;
+that is what the rest of this section is for.
+
+Two flags worth knowing:
+
+- `--verify-marker <path>=<needle>` refuses a target that does not actually contain your change.
+  This is the guard for the trap in Step 1: the carrier sitting on `main` when your fix merged
+  was usually cut *before* it, so deploying "the version main was on" is a textbook-clean go-live
+  that changes nothing — and every downstream check agrees it worked.
+- `--allow-unreleased` downgrades the UNRELEASED halt to a warning. Reach for it only when you
+  have already confirmed *why* main is ahead of its last release.
+
+Host topology (ssh alias, box paths, service names, health URL) lives in a host-owned
+`config/go-live.json`, never in the core — run `node scripts/gds/go-live.js --help` for the
+schema. A core that named one instance's box would not be a core.
+
 ### Step 1 — pick the version (your machine, main checkout)
 
 ```bash

package/modules/ideas/routes/blockers.js

@@ -10,10 +10,10 @@ module.exports = function buildBlockersRouter() {
   const router = express.Router();
 
   // List currently-open blockers + the tasks each is blocking.
-  // Public: anyone landing on /builders or status.amazonprimea.com can see
-  // what's stuck on Lars.
+  // Public: anyone landing on /builders or the status dashboard (status.<apex>)
+  // can see what's stuck on the owner.
   // rank: public — open blocker list; documented "Public: anyone landing on /builders
-  // or status.amazonprimea.com can see what's stuck on Lars" in the handler comment above.
+  // or the status dashboard can see what's stuck on the owner" in the handler comment above.
   router.get('/blockers', async (req, res) => {
     try {
       // R14 (#2001 / ADR 0119): the open-blocker list is public + grows with the

package/modules/lifecycle/routes/done-when.js

@@ -80,10 +80,10 @@ function authorizeCriterionCreate({ goal, version, actorId, actorRank, actorMemb
 module.exports = function buildDoneWhenRouter() {
   const router = express.Router();
 
-  // Public: status.amazonprimea.com fetches this every 60s alongside other
-  // public/* surfaces. No auth, same Cache-Control posture as the other
+  // Public: the status dashboard (status.<apex>) fetches this every 60s alongside
+  // other public/* surfaces. No auth, same Cache-Control posture as the other
   // status feeds.
-  // rank: public — status.amazonprimea.com fetches every 60s anonymously.
+  // rank: public — the status dashboard (status.<apex>) fetches every 60s anonymously.
   router.get('/versions/:id/done-when', asyncHandler('GET /versions/:id/done-when', async (req, res) => {
     const versionId = String(req.params.id || '').trim();
     if (!versionId) return res.fail('version_id_required', 400);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.307",
+  "version": "1.19.309",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.307",
+      "version": "1.19.309",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.307",
+  "version": "1.19.309",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claude-materialize.js

@@ -82,6 +82,13 @@ function hostOf(origin) { try { return new URL(String(origin)).host || null; } c
 // instance-config uses, so nothing here is ever a founder literal (R76-safe).
 function effConfigDir(b) { return (b && b.configDir) || ic.FALLBACK_DIR; }
 function effEnvPrefix(b) { return (b && b.envPrefix) || ic.FALLBACK_ENV_PREFIX; }
+// The brand token outbound User-Agents are built from, mirroring src/branding.js
+// userAgent(): repo name, else env prefix, lowercased. Kept in sync by the
+// tests/claude_materialize.mjs UA-rule case + tests/hook_user_agents.mjs.
+function effUaBase(b) {
+  const base = (b && b.repo && b.repo.name) || (b && b.envPrefix) || '';
+  return String(base).toLowerCase();
+}
 
 // Ordered source→target rebrand rules from two branding objects. PURE + exported.
 function buildRebrandRules(from = {}, to = {}) {
@@ -109,6 +116,15 @@ function buildRebrandRules(from = {}, to = {}) {
   add(`[${fc}]`, `[${tc}]`);
   // The instance env-var prefix (e.g. OTB_ → CLOUDBONGOS_), bounded by its underscore.
   add(`${effEnvPrefix(from)}_`, `${effEnvPrefix(to)}_`);
+  // task 1002672: the bare User-Agent brand token (e.g. `amazonprimea-gds-cli/1.0`
+  // in a hook's outbound fetch). It carries no TLD, so none of the HOST rules above
+  // ever matched it and a founder-branded UA leaked into every materialized
+  // instance verbatim. Bounded by the `-gds` suffix (the userAgent() convention)
+  // so a bare founder word in prose is NOT rewritten — only the UA token shape.
+  // Both bases must resolve: an empty side would degenerate into a bare `-gds`
+  // rule that rewrites every occurrence of the suffix itself.
+  const fromUa = effUaBase(from), toUa = effUaBase(to);
+  if (fromUa && toUa) add(`${fromUa}-gds`, `${toUa}-gds`);
   // Longest literal first so a full host is replaced before any bare token inside it.
   rules.sort((x, y) => y.pattern.source.length - x.pattern.source.length);
   return rules;