@bongos/core 1.19.338 → 1.19.339

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.338",
-  "core_contract": "1.19.338",
-  "source_commit": "7a51b75934f27cd81d4fa7aaccf913e1e8afcf8a",
+  "core_version": "1.19.339",
+  "core_contract": "1.19.339",
+  "source_commit": "2fec46ecdc4aff13a2b42b6dd37e7151fa7a7c6c",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T01:14:06.823Z",
+  "built_at": "2026-08-25T01:23:32.854Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 325,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1830,
-  "tree_sha256": "7cab4eb6fb2e313e4f6646f8a2c8c841dbdd8686e4902aadf116f948ec8ec8ca",
+  "tree_sha256": "7a407b4e4d5c929c91502bf31d949fb6bbf8634ce0a2ea6caa9b7dd48ddfbdd9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -707,7 +707,7 @@
     {
       "path": "docs/adr/0055-server-mediated-branch-publish.md",
       "mode": "0000644",
-      "sha256": "11ee013554922e0f9dadb582373c22d4aaa6433ddcb14af28386c4843a39497f"
+      "sha256": "5607ab08040d7127fbdad579cf091166b5be5eb6e39a88d3e7337e4f94171fee"
     },
     {
       "path": "docs/adr/0056-prod-deploy-script-mirror-and-healthcheck-retry.md",
@@ -1362,7 +1362,7 @@
     {
       "path": "docs/adr/0176-private-repo-deploy-keys.md",
       "mode": "0000644",
-      "sha256": "eb560b832629f708ad458f64c6a282bf55ae86c24626431d48d258e9ca0ac6d6"
+      "sha256": "80c1b9d283892454f45504fe3f20f3a215967de7cca66a5b3ef30970bb8eed47"
     },
     {
       "path": "docs/adr/0177-goal-membership-kind.md",
@@ -4727,12 +4727,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f93260c2c808c8595cbe376454489b8b39fd4e4c6270de72205222ab2ad20269"
+      "sha256": "d422f518f25f5a4063fa0f114cb86ee4b501e8362e8c0f0f526707d8d6ec137d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "33bd83c8a050c3642a8d29b5f559785a586456288417206392b6e46933ffd32c"
+      "sha256": "4988c346e6258b2eca07502ffdf4991652f381983258a2a13de47dc4cafc72b6"
     },
     {
       "path": "public-docs/index.html",
@@ -6557,7 +6557,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "03ea47b976cddc9763e12667759aa4ef9c90b2e81660f6020b954aa8aed1d0a6"
+      "sha256": "930f33a07876e76cf85203ff41de06eb1eebe120508946991f2ad0c73bd0a99c"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0055-server-mediated-branch-publish.md

@@ -49,5 +49,17 @@ A **fine-grained GitHub PAT** scoped to the single repo: `Contents: read/write`
 - A dev-box builder ships end-to-end: `/builder-reauth` → claim → edit → `/builder-stage` ([ADR 0046](<redacted>.md)) → `/builder-ship`, with the GDS doing the push. The box holds no GitHub credential, so the [ADR 0053](0053-scoped-dev-box-session.md) blast-radius argument still holds.
 - The blast radius moves from "box holds a push credential" to "server holds a branch-push-only PAT." This is the direction blocker [#15](https://example.com/builders#/blocker/15) ([SEC #863](https://example.com/builders#/task/863)) already wants — a server identity holding the push credential, not builder machines.
 - **Follow-up (hardening) — DONE + LIVE (task 1028 code, task 1043 cutover):** the standing PAT is replaced by a **GitHub App** (the server holds only the App private key and mints short-lived, repo-scoped installation tokens per push). See the *Update* above — the App is live on prod and the PAT has been removed.
+- **Verified end-to-end on hardware, 2026-08-25 (task 1003247)** — first proof since the
+  repo went private (~2026-08-15). The verification was performed by shipping from a live dev
+  box: `/builder-reauth` -> claim -> edit -> `/builder-ship`. The instance that carried it
+  through was **task 1003252**, whose ship published its branch and produced **PR #353**,
+  which auto-merged and deployed. Task 1003247 is the decision record of that verification --
+  it is not the branch PR #353 was opened from. The box demonstrably held no push credential
+  at the time: with a working READ credential in hand, `git push --dry-run` returned 403
+  `Write access to repository not granted`. A PR nonetheless existing is the proof that the
+  server, not the box, did the push. Also exercised: box source-fetch against a PRIVATE repo,
+  a non-box-scoped session, bundle upload to `POST /tasks/:id/publish-branch`, and the
+  confirmed->shipped flip.
+
 - **Residual:** the server verifies the bundle tip == the claimed sha and that the caller holds the claim, but does not cheaply prove every commit in the bundle was authored under the claim — branch protection + required checks on `main` (which the credential cannot bypass) are the real gate, exactly as for any PR.
 - **Operator action — DONE (blocker 31, resolved 2026-06-13):** the GitHub App was created and `GITHUB_APP_ID` + `GITHUB_APP_INSTALLATION_ID` + `GITHUB_APP_PRIVATE_KEY` set on the droplet (task 1043); `GITHUB_PUSH_TOKEN` then removed. To rotate the key: generate a new private key in the App's settings, replace `GITHUB_APP_PRIVATE_KEY` (single-line, literal `\n`) in `/etc/example/web-source.env`, restart `example`. To roll back to the PAT: restore `web-source.env.bak-task1043` and set a fresh `GITHUB_PUSH_TOKEN` (with the App vars absent, `resolveToken()` falls back to the PAT).

package/docs/adr/0176-private-repo-deploy-keys.md

@@ -51,8 +51,18 @@ best-effort revokes the key by title. Pushes keep preferring the owner-token HTT
 - The flip-to-private refusal on the manage page (task 1003045) stays until existing
   already-provisioned instances get the same wiring on flip — a follow-up task, since their
   origin still rides the shared alias.
-- Builder **dev boxes** of a private-repo project are out of scope here: their
-  `box-source-fetch.sh` clone uses box-side auth and needs the same treatment (follow-up).
+- Builder **dev boxes** of a private-repo project were parked here as out of scope.
+  **Answered on hardware 2026-08-25 (task 1003247): a box CAN read the private repo, and the
+  auth design needed no change.** The GDS-backed credential helper (`otb-git-credential`,
+  task 1002907) fetches a per-request, per-LIVE-rank credential from `/box/source-access`, so
+  `git ls-remote origin` succeeds against the private repo. ADR 0055's posture holds
+  underneath it: that same credential is read-only, so `git push` still returns 403 `Write
+  access to repository not granted`. The real gap was not box-side auth at all but a
+  config-dir mismatch -- `box-source-fetch.sh` and the helper read the legacy
+  `~/.config/otb/` while `/builder-reauth` writes to the branding `configDir`, so after a
+  re-auth both presented a dead token and every git op died with the opaque "could not read
+  Username". Task 1003252 fixed the four tracked `infra/box-*.sh` scripts; the two
+  instance-owned consumers are task 1003253.
 - `bongos upgrade --commit-pin` on a private instance pushes its pin via `origin` — now the
   read-only key, so GitHub refuses it and the pull-deploy reset can revert the bump.
   `upgrade.js` needs the owner-token push path (follow-up).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.338",
+  "version": "1.19.339",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.338",
+      "version": "1.19.339",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.338",
+  "version": "1.19.339",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1106,8 +1106,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.336 with no explicit bump. run 32795896926. (task 1002620)
 //   1.19.338 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.337 with no explicit bump. run 32796733697. (task 1002620)
+//   1.19.339 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.338 with no explicit bump. run 32797325535. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.338'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.339'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');