@bongos/core 1.19.672 → 1.19.673

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.672",
-  "core_contract": "1.19.672",
-  "source_commit": "72bde195eed5440b4cad741c01a811727d96a4d4",
+  "core_version": "1.19.673",
+  "core_contract": "1.19.673",
+  "source_commit": "9798ad8423cf89ef3bad579911f1f5ca8505e800",
   "source_ref": "HEAD",
-  "built_at": "2026-09-11T17:51:22.900Z",
+  "built_at": "2026-09-11T18:16:55.232Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 474,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2120,
+    "functional_verbatim": 2121,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2618,
-  "tree_sha256": "8fafd38c0b191dd28e39e21d624b758762e3316f76c64b203860de48e6539679",
+  "file_count": 2619,
+  "tree_sha256": "3be80c1f6787508e21f11f1b391ce342ad0c0e3b570a6360bd00d3e5b5cfa417",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2792,7 +2792,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "84eeb3cde0e92fb5bf32038fc8cd5abd7f5cc059c71cf0273a50873fc1325abe"
+      "sha256": "e1eb4883d1a25ac4b5b90ba00150f280c004569abeba0f9c0c4099982e587c6e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7767,12 +7767,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "46ab99aa32c6280e6c1bd7af17f26e534c1bcd45a43e873c9f2526ddd856dfae"
+      "sha256": "dfc25c3b8365e868e5119aff5e8447d41b1983dbb9db9c2669e13f9259726629"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c460db604d8c3d230a2a7af526c3bfe9288d5a9d1a4136d728ad81315b1bd177"
+      "sha256": "98edbd2fab2c33a96eebabd87c3c0c4dbd2f563fda40ca37bc737b186726fade"
     },
     {
       "path": "public-docs/index.html",
@@ -9532,7 +9532,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "057af9f0fddf1697d3368c2cddee50970b2319da68b2e73df11a3baa84f1be60"
+      "sha256": "6aaa55e88d207f52ea930ba86d7d292c06326cdcb7c08823dd225df4bff15e2f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13059,6 +13059,11 @@
       "mode": "0000644",
       "sha256": "456b20334164a710f59116d6a6c4b85090dc0e65668284d0a736e6ee1df5dea6"
     },
+    {
+      "path": "tests/wizard_born_first_board.mjs",
+      "mode": "0000644",
+      "sha256": "7a5260e3e09388bc59ea1752f3296cb2a58e7b81a2ebeb723ef916512fc89db7"
+    },
     {
       "path": "tests/wizard_draft_resume.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1803,5 +1803,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.670 with no explicit bump. run 34627255469. (task 1002620)
   1.19.672 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.671 with no explicit bump. run 34629971417. (task 1002620)
+  1.19.673 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.672 with no explicit bump. run 34632328471. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.672",
+  "version": "1.19.673",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.672",
+      "version": "1.19.673",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.672",
+  "version": "1.19.673",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.672'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.673'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/wizard_born_first_board.mjs

@@ -0,0 +1,116 @@
+// tests/wizard_born_first_board.mjs — the CONTRACT between the two halves that decide
+// whether a wizard-born owner lands on a board or on a blank hall (walk finding W4;
+// fixed by task 1003239, pinned here by task 1003508).
+//
+// WHY THIS FILE EXISTS. The fix spans two files that never import each other:
+//
+//   scripts/gds/provision-repo.js   seedFirstVersionCmd()  — seeds the instance's ONE
+//                                   version at standup, status 'building'
+//   modules/lifecycle/kickoff-seed.js  seedKickoffIfEmpty() — at the founder's first
+//                                   sign-in, files the checklist UNDER that version
+//
+// Each half is already unit-tested alone (tests/provision.mjs, tests/kickoff_seed.mjs).
+// Neither test would notice the coupling breaking — and when it breaks the symptom is
+// SILENT: `seedKickoffIfEmpty` returns `{ skipped: 'no_version' }`, the sign-in that
+// just seated the owner succeeds, and the founder simply sees an empty hall. That is
+// exactly W4, and it is the shape no existing test covers.
+//
+// DB-free: the provisioner half is read as the SQL it emits, the seed half runs against
+// an in-memory pool — the same seam tests/kickoff_seed.mjs uses.
+//
+// Run:  node --test tests/wizard_born_first_board.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const P = require('../scripts/gds/provision.js');
+const { seedKickoffIfEmpty, FIRST_VERSION_SQL } = require('../modules/lifecycle/kickoff-seed.js');
+const { kickoffChecklist } = require('../modules/lifecycle/kickoff-checklist.js');
+const { kickoffTasks } = require('../scripts/gds/init.js');
+
+// The control plane's own fixture shape (mirrors tests/provision.mjs).
+const coTenant = { id: 1, slug: 'mercury', hosting_shape: 'co-tenant', status: 'requested', owner_builder_id: 7, port: 3003, db_name: 'mercury', domain: null };
+const spec = { firstAdmin: 'founder', repo: { owner: 'o', name: 'n' }, domains: { publicOrigin: 'https://p.example' }, modules: [] };
+
+function fakePool({ taskCount, versions }) {
+  return {
+    query: async (sql) => {
+      if (/FROM tasks/.test(sql)) return { rows: [{ n: taskCount }] };
+      if (/FROM versions/.test(sql)) return { rows: versions };
+      throw new Error(`unexpected query: ${sql}`);
+    },
+  };
+}
+
+test('the version the provisioner seeds is the one the first-sign-in seed files under', async () => {
+  // Derived from the provisioner itself, never a pinned literal: instanceInitSpec is the
+  // single source both the standup seed and the greenfield `bongos init` read.
+  const seeded = P.instanceInitSpec(coTenant).version;
+  assert.ok(seeded.id, 'the init spec names a starter version');
+  assert.ok(
+    P.seedFirstVersionCmd(coTenant).includes(`$v$${seeded.id}$v$`),
+    'the standup SQL really inserts that version id'
+  );
+
+  const inserted = [];
+  const r = await seedKickoffIfEmpty(
+    { builderId: 7 },
+    { pool: fakePool({ taskCount: 0, versions: [{ id: seeded.id }] }), spec, createTask: async (row) => { inserted.push(row); return row; } }
+  );
+
+  assert.ok(r.seeded > 0, 'a wizard-born board is NOT empty at first sign-in (walk finding W4)');
+  assert.equal(r.versionId, seeded.id, 'filed under the version standup actually created');
+  for (const row of inserted) assert.equal(row.versionId, seeded.id);
+});
+
+test("the status standup writes is the status the kickoff query prefers ('building')", () => {
+  // The coupling neither side's own test can see: seedFirstVersionCmd hard-codes the
+  // status literal, FIRST_VERSION_SQL orders on it. Change one and the other silently
+  // stops preferring the starter version.
+  assert.ok(
+    P.seedFirstVersionCmd(coTenant).includes('$v$building$v$'),
+    'standup seeds the starter version as building'
+  );
+  assert.match(
+    FIRST_VERSION_SQL,
+    /\(status = 'building'\) DESC/,
+    'the first-sign-in seed prefers a building version — same literal as above'
+  );
+});
+
+test('a standup that seeded no version strands the founder on an empty hall, silently', async () => {
+  // The W4 failure mode itself, asserted at the composition level: no throw, no log the
+  // founder can see, sign-in still succeeds — just no board. This is why the bug survived
+  // a live walk, and why the two assertions above are worth keeping.
+  const inserted = [];
+  const r = await seedKickoffIfEmpty(
+    { builderId: 7 },
+    { pool: fakePool({ taskCount: 0, versions: [] }), spec, createTask: async (row) => inserted.push(row) }
+  );
+  assert.deepEqual(r, { seeded: 0, skipped: 'no_version' });
+  assert.equal(inserted.length, 0);
+});
+
+test('both entry points draw the checklist from one spec source', () => {
+  // The task's own requirement: "same spec source as `bongos init`'s kickoffTasks()".
+  // Pinned as an EQUALITY, not a shape check: init's export must stay a thin wrapper over
+  // the shared function, so a forked copy of the checklist inside init.js fails here.
+  assert.deepEqual(
+    kickoffTasks(spec),
+    kickoffChecklist(spec, { provisioned: false }),
+    'init.js kickoffTasks is kickoffChecklist, not a second copy of the list'
+  );
+
+  const viaSeed = kickoffChecklist(spec, { firstSignIn: true });
+  assert.ok(viaSeed.length > 0, 'the first-sign-in checklist has steps');
+  for (const t of viaSeed) assert.ok(t.title && t.description, 'every step is filable as a task');
+
+  // ...and the first-sign-in variant drops the steps the wizard already performed, rather
+  // than handing the founder a checklist half of which is done (the reason for the flag).
+  const seedTitles = new Set(viaSeed.map((t) => t.title));
+  for (const done of ['Register a GitHub OAuth app and set its credentials', 'Sign in once as founder to seat the founding owner']) {
+    assert.ok(!seedTitles.has(done), `a wizard-born founder is not asked to redo: ${done}`);
+  }
+});