@bongos/core 1.19.61 → 1.19.63

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.61",
-  "core_contract": "1.19.61",
-  "source_commit": "073b10995781fbdfae0a9da943fa8755002e51bf",
+  "core_version": "1.19.63",
+  "core_contract": "1.19.63",
+  "source_commit": "aecb337d2bcfb665111227e9aebaffa93f867699",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T00:24:52.611Z",
+  "built_at": "2026-08-12T01:29:46.616Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1532,
-  "tree_sha256": "c4d2ff9c96e88bf23e2c2c1acf1593d174589a1b9beeb7b3b12d61c65bb84113",
+  "tree_sha256": "165231bc8a6ec61199f57070fc8267562e283cff9b5804d340d4f3b57cc98de2",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1377,7 +1377,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "01f8ff6aaa583d333b466f4d5cff849c09327653c33dcb3d82d60cc46f913cb8"
+      "sha256": "4b3ee1ce8445659a2660263cbbd9e2a903d010410b8ff8f89e2ed61ed54c6eab"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2557,7 +2557,7 @@
     {
       "path": "modules/dev-box/app/test/unit.mjs",
       "mode": "0000644",
-      "sha256": "6c209f446990af95d16995720a4746d4890ed77c77ebc13f22293404ea0d3eea"
+      "sha256": "104360917db40f8c6de633ed692b50417e5cf55f316d97fc4d29285046ff2324"
     },
     {
       "path": "modules/dev-box/box-access.js",
@@ -4037,12 +4037,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9b320dfef27bca09c1ab23bb85c04b499724208dad01a608763f18b9c4e1d1b4"
+      "sha256": "ec06847fa5cf675d4847afeed5612e44a0fd336694a1187d342a9f60ef957b09"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d1720c6790a6aa61a091335cf8873dac1e75dfbb1250c7d484395c95fd8825c6"
+      "sha256": "612d7a22ac1c386d80c1c99b9aa52d70363c8a7a4f8ffb0598624c995578f060"
     },
     {
       "path": "public-docs/index.html",
@@ -5497,7 +5497,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "f39bb8e6269b64ce57e1a16d5369ccdbd384618172f742494c4aaa3c04392cba"
+      "sha256": "a5c939de500ba39d12f09e053e3b9079510716cb4af18cad0e13482952b02904"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -5662,7 +5662,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0126fe1e9af95f3daee985c7a9859e19b5937e023d6a54927b6c5dd7055a83ec"
+      "sha256": "dfd274bc93670afa2368e0abea4d79ab5bd415996ed11c56a14cbafb449aafc6"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6742,7 +6742,7 @@
     {
       "path": "tests/infra_exec_paths.mjs",
       "mode": "0000644",
-      "sha256": "0437795b927bf68baa1e08ba2e52ca5b1799d41938402159ffb01f2f5bff01b2"
+      "sha256": "2b905b00f873e082340af0fb6b460a31053d8b6cb77db121c97ed73383088973"
     },
     {
       "path": "tests/init.mjs",
@@ -6927,7 +6927,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "d97a0b97d4aa9d5609d830f9d0b0b20c29377b6d6232c1c69e75612dfc608928"
+      "sha256": "a1059f1995ba2b98436df0c4965a87b20e7553b6b72e80bb724c0b861e347ecf"
     },
     {
       "path": "tests/module_api.mjs",

package/docs/file-map.md

@@ -226,6 +226,7 @@
 │   (public-status/ moved to modules/status-ui/public/ in BV1.R84 — see the modules/ block above)
 │   (public-builders/ moved to modules/hall-ui/public/ in BV1.R85 — the authenticated builders' hall; see the modules/ block above. It keeps its DEDICATED serving block in src/bongos/serve-internal.js: the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection — partitioned out of the generic web-surface loop. index.html=the hall dashboard; work/board/roadmap/goals/watch/harbor/gate/pair/settings/ranks/sessions/primer/diagrams/atlas pages; profile.html/profile.js=the public, shareable builder profile page (/profile?id=N — rank, works, credits, karma, achievements; task 1467); task.html/task.js=the task-detail page (/task/:id, task 751 — replaced the old #/task/N overlay); builders.js=the controller; dom-utils.js/hall-widgets.js=the widget+settings-panel registries.)
 │
+├── infra/                          ← ON-BOX scripts (task 1002699): the four reporter/heartbeat crons every dev box runs from its /workspace clone — box-heartbeat.sh (idle-sweep activity signal), box-report-version.sh (HEAD → POST /box/version), box-report-host-keys.sh (SSH host keys → POST /box/host-keys), box-report-terminal.sh (ttyd URL+credential → POST /box/terminal). Delivered by the workspace clone itself (modules/dev-box/box-access.js sparse scope includes infra/); crons self-installed by box-source-fetch.sh's per-tick bring-up. API base resolves GDS_BASE env → session-file api_base → skip (no hardcoded host in the neutral core).
 ├── devbox-app/                     ← OTB Dev Box — Electron menu-bar/tray switch for the builder's box (#904, ADR 0045; internal). SELF-CONTAINED: own package.json (never feeds the droplet's npm ci); built by .github/workflows/build-devbox-app.yml; published to the public releases repo per config/devbox-app.json; release recipe docs/recipes/devbox-app-release.md
 │   ├── src/                        ← main process: main.js (tray/window/IPC), brand.js (ADR 0004 — the ONE civ-name string), pairing.js, box-controller.js, gds-client.js, session-store.js (shares ~/.config/otb/gds-session.json with the CLI), ssh-setup.js (key 600 + known_hosts replace + managed-settings install w/ elevation), tray.js, preload.js
 │   ├── renderer/                   ← the panel UI (sandboxed; parchment theme)

package/modules/dev-box/app/test/unit.mjs

@@ -447,7 +447,7 @@ const ENDPOINTS = [
   ['claimableTasks', [], 'GET', '/api/gds/tasks/claimable', undefined],
   ['claimTask', ['1002388'], 'POST', '/api/gds/claims', { task_id: '1002388' }],
   ['boxScope', [], 'GET', '/api/gds/box/scope', undefined],
-  ['latestRelease', [], 'GET', '/downloads/devbox/latest.json', undefined],
+  ['latestRelease', [], 'GET', '/downloads/devbox/version', undefined],
 ];
 
 for (const [name, args, method, urlPath, body] of ENDPOINTS) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.61",
+  "version": "1.19.63",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.61",
+      "version": "1.19.63",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.61",
+  "version": "1.19.63",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -192,6 +192,13 @@ const MODULE_GLOBS = {
   // (moduleWebSurfaces → serve-internal). Its public read endpoints stay SHARED
   // core in routes/public.js (the hall + the off-box mirror consume them too).
   'status-ui': ['modules/status-ui/'],
+  // The instance's public landing surface (index/world/gate/create), served by
+  // platform-server.js from the repo-root public-landing/ dir — not yet a carved
+  // module, so the glob lists where the code lives TODAY (the auto-tighten
+  // contract above). Its own key, not provisioning's: the front door is broader
+  // than instance hosting, and the web-surface precedent (hall-ui/status-ui) is
+  // one key per surface (task 1002690, goal 1000059).
+  'public-landing': ['public-landing/'],
   // --- feature modules ---
   // BV1.R49: game graduated to modules/game/ — src/rooms/, src/world/, src/seats.js,
   // src/db.js, migrations/game/, and public/ all moved there. src/preview-server.js
@@ -200,6 +207,15 @@ const MODULE_GLOBS = {
     'modules/game/', 'src/preview-server.js',
   ],
   'art-pipeline': ['modules/art-pipeline/'],
+  // --- instance provisioning: the web-tier REQUEST + STATE surface (module home)
+  //     plus the control-plane runner CLI — a command travels with its domain (the
+  //     lifecycle/dev-box precedent). Covers the projects-surface work (goal
+  //     1000059); previously NO key resolved these paths, so no goal could wall
+  //     them (task 1002690). ---
+  provisioning: [
+    'modules/provisioning/',
+    'scripts/gds/provision.js',
+  ],
   discord: [
     // The bot, broadcast, link/role seams, channels, and bug-attachments graduated
     // into modules/discord/ (BV1.R47); the outbound webhook lib + post CLI stay

package/src/module-api.js

@@ -549,8 +549,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.59 with no explicit bump. run 31548021746. (task 1002620)
 //   1.19.61 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.60 with no explicit bump. run 31550061440. (task 1002620)
+//   1.19.62 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.61 with no explicit bump. run 31552833331. (task 1002620)
+//   1.19.63 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.62 with no explicit bump. run 31553743979. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.61'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.63'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/infra_exec_paths.mjs

@@ -31,18 +31,22 @@ function test(name, fn) {
   catch (err) { console.error(`  FAIL ${name}`); console.error('    ', err.message); failed++; }
 }
 
-// infra/ is HOST topology (publish-manifest.js PROTECTED_TOPOLOGY_EXCLUDE) — the neutral
-// core carries no units and no launcher (task 1002470). The checks that read the REAL tree
-// only mean something where that tree exists; the synthetic counterfactuals below always run.
-const HAS_INFRA = fs.existsSync(path.join(REPO, 'infra'));
+// Host topology means systemd UNITS, not the bare infra/ directory: the neutral core
+// carries no units and no launcher (task 1002470), but it DOES ship the four ON-BOX
+// reporter scripts in infra/ (task 1002699 — dev boxes clone this repo and wire them
+// as crons). So the real-tree unit lint is gated on *.service files being present,
+// and the launcher checks on core-node.sh — the synthetic counterfactuals always run.
+const INFRA_DIR = path.join(REPO, 'infra');
+const HAS_UNITS = fs.existsSync(INFRA_DIR) &&
+  fs.readdirSync(INFRA_DIR).some((f) => f.endsWith('.service'));
 const HAS_LAUNCHER = fs.existsSync(LAUNCHER);
 function hostTest(name, present, fn) {
-  if (!present) { console.log(`  skip ${name} — infra/ is absent in this checkout (host topology)`); return; }
+  if (!present) { console.log(`  skip ${name} — host topology (units/launcher) absent in this checkout`); return; }
   test(name, fn);
 }
 
 // ---- A. the lint is green on the real tree, and covers all 11 core-script units ----------------
-hostTest('lint-infra-exec: every core-script unit resolves in a consumer layout (publishable + present)', HAS_INFRA, () => {
+hostTest('lint-infra-exec: every core-script unit resolves in a consumer layout (publishable + present)', HAS_UNITS, () => {
   const r = lintInfraExec({ instanceRoot: REPO, coreRoot: REPO });
   assert.deepEqual(r.violations, [], `expected no violations, got: ${JSON.stringify(r.violations)}`);
   assert.ok(r.ok, 'lint should pass');

package/tests/module-scope-map.mjs

@@ -86,3 +86,16 @@ test('the exported roster is frozen (immutable scope wall)', () => {
   assert.ok(Object.isFrozen(scope.scopeForModule('kernel')));
   assert.ok(Object.isFrozen(scope.scopeForModule('kernel').globs));
 });
+
+test('provisioning + public-landing joined the roster (task 1002690) — territory resolvable, non-protected', () => {
+  // Before this, modules/provisioning/ and public-landing/ were covered by NO
+  // key, so no goal could wall the projects-surface work (goal 1000059).
+  for (const k of ['provisioning', 'public-landing']) {
+    assert.ok(scope.isModuleKey(k), `roster missing module "${k}"`);
+    assert.equal(scope.isProtectedModule(k), false, `"${k}" must derive non-protected (no PROTECTED_GLOBS overlap)`);
+  }
+  const prov = scope.globsForModules(['provisioning']);
+  assert.ok(prov.includes('modules/provisioning/'), 'provisioning owns its module directory');
+  assert.ok(prov.includes('scripts/gds/provision.js'), 'the control-plane runner travels with its domain');
+  assert.ok(scope.globsForModules(['public-landing']).includes('public-landing/'), 'public-landing owns its surface directory');
+});