@bongos/core 1.19.64 → 1.19.66

package/modules/lifecycle/module.json

@@ -4,6 +4,7 @@
   "description": "The build state machine — tasks · claims · versions · done-when criteria · goals · dependencies · the claim→ship→grade→credit lifecycle · override requests · the ship/confirm/promote orchestration · github-push + merge-lease + conflict-resolve + the publish reconciler. The LAST and most-coupled core domain carved out of the GDS core in BV1.R86 (ADR 0093 §1,§3, 02-module-map §4 — kept whole, never split). default-on; every instance runs the lifecycle. Registers the `lifecycle` kernel PORT (createTask · VOTABLE_TASK_STATUSES · classifyTaskKind · tallyPeerVotes + the work-tracking reads) that core read routes + the ideas/discord/autonomy modules resolve. As a transaction-participant it RESOLVES the `reward` + `onboarding` ports inside its claim/ship/confirm txns — but via resolveOptional (graceful, like sessions→reward), so consumes is empty: a vanilla instance without those modules degrades the credit/onboarding writes to best-effort no-ops, it does not fail.",
   "coreVersion": "^1.12.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["tasks", "claims", "versions", "done-when", "goals", "dependencies", "gate-approvals", "analytics", "lifecycle"],
     "pollers": ["publish-reconciler"]

package/modules/memory/module.json

@@ -4,6 +4,7 @@
   "description": "Per-builder session memory, the lexical recall/search retrieval layer (ADR 0060), and durable learnings. A core-domain module carved out of the GDS core in BV1.R72 (ADR 0091); default-on because every instance needs the build system's memory.",
   "coreVersion": "^1.5.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["memory", "search", "learnings"]
   },

package/modules/onboarding/module.json

@@ -4,6 +4,7 @@
   "description": "The newcomer ADMISSION + ORIENTATION domain — the public access-request → Archon-approval gate, the server-ticked onboarding state machine (the 'Path into the City' checklist that graduates a Xenos to Thetes), the friction analyzer (feedback-without-asking on consented onboarding transcripts), and the evergreen newcomer-chore restock (a fresh first-builder task is always waiting). A core-domain module carved out of the GDS core in BV1.R81 (ADR 0093 §1); default-on because every instance onboards its own builders. The access-requests admission routes mount here; the core lifecycle (db.js claim/ship), auth callbacks, and the me/builders profile readers resolve the `onboarding` kernel PORT for the state-machine + restock surface they need — never importing the module.",
   "coreVersion": "^1.9.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["onboarding"] },
   "provides": ["onboarding"],
   "consumes": []

package/modules/platform-identity/module.json

@@ -8,6 +8,7 @@
   "origin": "Cloud Bongos platform (cloudbongos.com)",
   "license": "AGPL-3.0",
   "maintainer": "Cloud Bongos maintainers",
+  "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["sso", "projects", "my-projects", "scouting"],
     "migrations": true,

package/modules/provisioning/module.json

@@ -8,6 +8,7 @@
   "origin": "Off the Boats (the first Cloud Bongos instance, amazonprimea.com)",
   "license": "AGPL-3.0",
   "maintainer": "Off the Boats maintainers",
+  "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["provisioning"],
     "migrations": true

package/modules/security/module.json

@@ -4,6 +4,7 @@
   "description": "The red-team / vulnerability-report intake and the bounty payout system (rank-gated Metic+): the /builder-redteam skill files a report, the Archon dashboard adjudicates (confirm/dispute/fix/link-fix), and the env-aware bounty table sets the per-severity drachmae payout. A core-domain module carved out of the GDS core in BV1.R79 (ADR 0093 §1; 02-module-map §5 — security-the-FEATURE, NOT security-the-property, which stays kernel). default-on because every instance can take red-team reports. Registers the `security` kernel PORT the core /public/bounty-table resolves for the payout schedule. Also owns the scan-before-install surface (goal 1000055): the artifact-scan engine (quarantine/manifest/mirror) and the security_tool_scans record — POST Metic+, GET every rank.",
   "coreVersion": "^1.8.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["reports", "scans"], "migrations": true },
   "provides": ["security"],
   "consumes": []

package/modules/sessions/module.json

@@ -4,6 +4,7 @@
   "description": "The session-records corpus + its data plane (POST /sessions upload, the Archon-gated cross-builder /sessions/search + /sessions/:id deep-dive), the BFG 'read-the-room' cross-builder scorer (ADR 0026 §6B), and the session-pulse / stale-claim heartbeat helpers. A core-domain module carved out of the GDS core in BV1.R82 (ADR 0093 §1); default-on because every instance records its builders' sessions for the BFG. Like the memory module, sessions registers no port — core never calls back into it: the ship-time digest write is an HTTP POST to the module's own /sessions route, and the only outward dependency is the economy `reward` kernel PORT it resolves (session token reward + sumCreditsForTasks) at upload time.",
   "coreVersion": "^1.10.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["sessions"], "pollers": ["session-reward-reconcile"] },
   "provides": [],
   "consumes": []

package/modules/status-ui/module.json

@@ -4,6 +4,7 @@
   "description": "The public build-status dashboard served at status.<apex> (status.amazonprimea.com) — the live up/down banner, version-progress rollups, cost summary, recent ships, leaderboard, and the ecosystem fingerprint, all polling the read-only /api/gds/public/* surface every 60s. A WEB-SURFACE core-domain module carved out of the GDS core in BV1.R84 (ADR 0093 §1; 02-module-map §6 — a web surface is first-class). default-on: a Cloud Bongos instance ships its status page like it ships its hall. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir) the loader hands serve-internal, which serves the module's public/ dir on the matching host exactly as it served public-status/ before. The public read endpoints it renders stay SHARED core in routes/public.js (the hall + the off-box mirror read them too).",
   "coreVersion": "^1.11.0",
   "default": true,
+  "maintenance": { "status": "core-maintained" },
   "contributes": {
     "webSurfaces": [
       { "host": "status.", "dir": "public" }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.64",
+  "version": "1.19.66",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.64",
+      "version": "1.19.66",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.64",
+  "version": "1.19.66",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/create.html

@@ -1007,7 +1007,7 @@ input[type=text].bad{border-color:var(--err);}
         : '<li data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
         '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + ghIcon + 'Create ' + repoLabel + ' on GitHub</a></li>'));
     if (!state.domain) {
-      steps.push('<li><b>Add a domain you own</b><p>Sign-in on your new instance needs a real domain. When you have one, come back here or ask your hall — the address gets wired in minutes.</p></li>');
+      steps.push('<li><b>Add a domain you own</b><p>Sign-in on your new instance needs a real domain. When you have one, attach it from <a href="/projects">your projects page</a> — the address gets wired in minutes.</p></li>');
     }
     if (oa) {
       steps.push('<li data-onboard-step="oauth-app"><b>Create the GitHub OAuth app</b><p>GitHub → <em>your account’s</em> Settings → Developer settings → OAuth Apps → New OAuth App. (Developer settings live under your account, not the repo.)</p>' +
@@ -1079,7 +1079,16 @@ input[type=text].bad{border-color:var(--err);}
     el.innerHTML = progressMarkup(0, 1, 'Filed. Watching for the standup to start…');
     function tick() {
       ticks += 1;
-      if (ticks > 400) { stopPolling(); return; } // ~33 min: stop quietly, the hall has it
+      if (ticks > 400) {
+        /* ~33 min: this tab stops watching, but the standup keeps going — hand
+           the long watch to /projects, the owner's durable surface (task
+           1002693). The old "stop quietly" here was a dead-end lie: the hall
+           card it assumed was removed in task 1002675. */
+        $('liveProgress').innerHTML = progressMarkup(1, 1,
+          'Still building — this tab will stop watching now. Follow it any time on <a href="/projects">your projects page</a>.');
+        stopPolling();
+        return;
+      }
       fetch(API + '/provisioning/instances/' + encodeURIComponent(id), { credentials: 'same-origin' })
         .then(function (res) {
           if (res.status === 401) { throw new Error('gone:Your session expired — <a href="' + API + '/auth/web/start?return=/create">sign in again</a> to keep watching.'); }