@bongos/core 1.19.678 → 1.19.679

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.678",
-  "core_contract": "1.19.678",
-  "source_commit": "f16c9e626ff2c55f717a95aee3d34d77b8d1d7cc",
+  "core_version": "1.19.679",
+  "core_contract": "1.19.679",
+  "source_commit": "f1aaf763da799cb5f4ab969af528d5f74c2433c9",
   "source_ref": "HEAD",
-  "built_at": "2026-09-11T22:19:41.718Z",
+  "built_at": "2026-09-11T23:20:02.319Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 474,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2622,
-  "tree_sha256": "f74a39b4cffb6701304f05814582718e8b1580ab01d97d6c6be2be8e2ff4e18f",
+  "tree_sha256": "0de186e89d491b293f3a8acef2deb589062a456c992a3a9ea94f80a7df5c776c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2792,7 +2792,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ec91ef553908baf5180767c401d6b91afc48d938740258e63a48fb88106f7177"
+      "sha256": "462f8656b5bcf15070e7cd7d711e05bdf39bb05c2217352217d7ccdfa24ff776"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7392,12 +7392,12 @@
     {
       "path": "modules/ui-design/kit/fixtures/featured-hub.json",
       "mode": "0000644",
-      "sha256": "efc0a57ad8f8f3bcb2e30c236be99d9d3d9efcce508187ea030374555d03cec9"
+      "sha256": "0acdc585b6c23e86ba1fe40671ae85c399ad1cf4edc3dadca99ed9e8a7282668"
     },
     {
       "path": "modules/ui-design/kit/fixtures/featured.json",
       "mode": "0000644",
-      "sha256": "569038c7cbe3a1ff12d361111d062715f38aebd73317816a87c400fa96c12b04"
+      "sha256": "84e23ea9a10dfd72d3c9c40f0bf7de4fd45da622546dff6bd25f0092498987c9"
     },
     {
       "path": "modules/ui-design/kit/fixtures/leaderboard.json",
@@ -7767,12 +7767,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0edc0468c32498fd329ba23692832935f7524f2b4d24065d9a53cf583728af49"
+      "sha256": "673d8ec9856db8cea795601e8055b820af45c0fbabd3694c72585efd1ca74ea6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "32048e9ab629a14af9beee43dba2b8620a0e29db73a806dc66f21d08061a3c8b"
+      "sha256": "23342005df25520523dd82a3991379e717b7146630e73564006381cf458477a8"
     },
     {
       "path": "public-docs/index.html",
@@ -9532,7 +9532,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "538fc4afaf5a3f0da5eb4bcc3d99533cdf03cc5898163e6b8bcf8ca1584d14ec"
+      "sha256": "90415725c895791b66d730f3d6d25988f76e748d2509ec2db13915e64c0fc163"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11227,7 +11227,7 @@
     {
       "path": "tests/hub_map_orb_states.mjs",
       "mode": "0000644",
-      "sha256": "cdbee4e7f252f01e4a72feb1b63a5e340d1110c3f7a88aa6db77da95bc1268cb"
+      "sha256": "531ef3dae5e1d0eeea1d9f1a89d1224cda58ef1b8f389e6113e6b0d1a0cc7917"
     },
     {
       "path": "tests/hub_profile_leak.mjs",

package/docs/module-api-changelog.md

@@ -1815,5 +1815,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.676 with no explicit bump. run 34650610723. (task 1002620)
   1.19.678 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.677 with no explicit bump. run 34653458123. (task 1002620)
+  1.19.679 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.678 with no explicit bump. run 34657605820. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ui-design/kit/fixtures/featured-hub.json

@@ -1 +1 @@
-{"_":"The hub's catalog (task 1003345): the landing's featured.json plus Tidewater, an all-null row nobody owns — the card-floor state opens ITS card, because Demo is owned by the signed-in stub (provisioning-instances.json) and an owned orb's plain click opens the manage view, never the card. Served under the name \"featured\" by projects.states.json's stub.fixtures alias; the landing keeps featured.json.","projects":[{"origin":"https://amazonprimea.com","name":"Off the Boats","tagline":"A singular shop, and a broader videogame in a persistent ancient Greek world that collides with modern day commerce & products.","art_url":"/assets/world/r2-chrome-blob-one.jpg","type":"game","template":"bead-wash","planet_template":null,"planet_accent":null,"card_backdrop":"nebula","created_at":"2026-07-15T22:12:57.732Z","builders":11,"tags":["art-pipeline","character-anim","demo","game"],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":["https://avatars.githubusercontent.com/u/283020391?v=4","https://avatars.githubusercontent.com/u/64553469?v=4","https://avatars.githubusercontent.com/u/290184380?v=4","https://avatars.githubusercontent.com/u/295990394?v=4","https://avatars.githubusercontent.com/u/35337514?v=4"],"shipped_30d":0,"shipped_30d_capped":false,"hall_origin":"https://builders.amazonprimea.com"},{"origin":"https://demo.cloudbongos.com","name":"Demo","tagline":"A live demo instance on Cloud Bongos.","art_url":null,"type":null,"template":"pair-gold-wash","planet_template":"pair-obsidian-tint","planet_accent":"sea","created_at":"2026-07-14T19:16:38.160Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null},{"origin":"https://emersonian-circles.cloudbongos.com","name":"Emersonian Circles","tagline":"An independent project built on Cloud Bongos.","art_url":null,"type":null,"template":null,"planet_template":null,"planet_accent":null,"created_at":"2026-07-25T02:21:55.641Z","builders":1,"tags":[],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":[],"shipped_30d":30,"shipped_30d_capped":true,"hall_origin":null},{"origin":"https://tidewater.cloudbongos.com","name":"Tidewater","tagline":"A project that has declared nothing yet.","art_url":null,"type":null,"template":null,"planet_template":null,"planet_accent":null,"created_at":"2026-07-20T08:00:00.000Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null}]}
+{"_":"The hub's catalog (task 1003345): the landing's featured.json plus Tidewater, an all-null row nobody owns — the card-floor state opens ITS card, because Demo is owned by the signed-in stub (provisioning-instances.json) and an owned orb's plain click opens the manage view, never the card. Served under the name \"featured\" by projects.states.json's stub.fixtures alias; the landing keeps featured.json. Every row carries the `state` + `orb` pair feedShapeFor() derives (projects-feed.js): the hub is FAIL-CLOSED on a render-type it does not recognise, so a row without one is dropped from the sky, the table and the count — pinned by tests/hub_map_orb_states.mjs (task 1003838).","projects":[{"origin":"https://amazonprimea.com","name":"Off the Boats","tagline":"A singular shop, and a broader videogame in a persistent ancient Greek world that collides with modern day commerce & products.","art_url":"/assets/world/r2-chrome-blob-one.jpg","type":"game","template":"bead-wash","planet_template":null,"planet_accent":null,"card_backdrop":"nebula","created_at":"2026-07-15T22:12:57.732Z","builders":11,"tags":["art-pipeline","character-anim","demo","game"],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":["https://avatars.githubusercontent.com/u/283020391?v=4","https://avatars.githubusercontent.com/u/64553469?v=4","https://avatars.githubusercontent.com/u/290184380?v=4","https://avatars.githubusercontent.com/u/295990394?v=4","https://avatars.githubusercontent.com/u/35337514?v=4"],"shipped_30d":0,"shipped_30d_capped":false,"hall_origin":"https://builders.amazonprimea.com","state":"public","orb":"planet"},{"origin":"https://demo.cloudbongos.com","name":"Demo","tagline":"A live demo instance on Cloud Bongos.","art_url":null,"type":null,"template":"pair-gold-wash","planet_template":"pair-obsidian-tint","planet_accent":"sea","created_at":"2026-07-14T19:16:38.160Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null,"state":"public","orb":"planet"},{"origin":"https://emersonian-circles.cloudbongos.com","name":"Emersonian Circles","tagline":"An independent project built on Cloud Bongos.","art_url":null,"type":null,"template":null,"planet_template":null,"planet_accent":null,"created_at":"2026-07-25T02:21:55.641Z","builders":1,"tags":[],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":[],"shipped_30d":30,"shipped_30d_capped":true,"hall_origin":null,"state":"public","orb":"planet"},{"origin":"https://tidewater.cloudbongos.com","name":"Tidewater","tagline":"A project that has declared nothing yet.","art_url":null,"type":null,"template":null,"planet_template":null,"planet_accent":null,"created_at":"2026-07-20T08:00:00.000Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null,"state":"public","orb":"planet"}]}

package/modules/ui-design/kit/fixtures/featured.json

@@ -1 +1 @@
-{"projects":[{"origin":"https://amazonprimea.com","name":"Off the Boats","tagline":"A singular shop, and a broader videogame in a persistent ancient Greek world that collides with modern day commerce & products.","art_url":"/assets/world/r2-chrome-blob-one.jpg","type":"game","template":"bead-wash","planet_template":null,"planet_accent":null,"created_at":"2026-07-15T22:12:57.732Z","builders":11,"tags":["art-pipeline","character-anim","demo","game"],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":["https://avatars.githubusercontent.com/u/283020391?v=4","https://avatars.githubusercontent.com/u/64553469?v=4","https://avatars.githubusercontent.com/u/290184380?v=4","https://avatars.githubusercontent.com/u/295990394?v=4","https://avatars.githubusercontent.com/u/35337514?v=4"],"shipped_30d":0,"shipped_30d_capped":false,"hall_origin":"https://builders.amazonprimea.com"},{"origin":"https://demo.cloudbongos.com","name":"Demo","tagline":"A live demo instance on Cloud Bongos.","art_url":null,"type":null,"template":"pair-gold-wash","planet_template":"pair-obsidian-tint","planet_accent":"sea","created_at":"2026-07-14T19:16:38.160Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null},{"origin":"https://emersonian-circles.cloudbongos.com","name":"Emersonian Circles","tagline":"An independent project built on Cloud Bongos.","art_url":null,"type":null,"template":null,"planet_template":null,"planet_accent":null,"created_at":"2026-07-25T02:21:55.641Z","builders":1,"tags":[],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":[],"shipped_30d":30,"shipped_30d_capped":true,"hall_origin":null}]}
+{"projects":[{"origin":"https://amazonprimea.com","name":"Off the Boats","tagline":"A singular shop, and a broader videogame in a persistent ancient Greek world that collides with modern day commerce & products.","art_url":"/assets/world/r2-chrome-blob-one.jpg","type":"game","template":"bead-wash","planet_template":null,"planet_accent":null,"created_at":"2026-07-15T22:12:57.732Z","builders":11,"tags":["art-pipeline","character-anim","demo","game"],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":["https://avatars.githubusercontent.com/u/283020391?v=4","https://avatars.githubusercontent.com/u/64553469?v=4","https://avatars.githubusercontent.com/u/290184380?v=4","https://avatars.githubusercontent.com/u/295990394?v=4","https://avatars.githubusercontent.com/u/35337514?v=4"],"shipped_30d":0,"shipped_30d_capped":false,"hall_origin":"https://builders.amazonprimea.com","state":"public","orb":"planet"},{"origin":"https://demo.cloudbongos.com","name":"Demo","tagline":"A live demo instance on Cloud Bongos.","art_url":null,"type":null,"template":"pair-gold-wash","planet_template":"pair-obsidian-tint","planet_accent":"sea","created_at":"2026-07-14T19:16:38.160Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null,"state":"public","orb":"planet"},{"origin":"https://emersonian-circles.cloudbongos.com","name":"Emersonian Circles","tagline":"An independent project built on Cloud Bongos.","art_url":null,"type":null,"template":null,"planet_template":null,"planet_accent":null,"created_at":"2026-07-25T02:21:55.641Z","builders":1,"tags":[],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":[],"shipped_30d":30,"shipped_30d_capped":true,"hall_origin":null,"state":"public","orb":"planet"}]}

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.678",
+  "version": "1.19.679",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.678",
+      "version": "1.19.679",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.678",
+  "version": "1.19.679",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.678'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.679'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hub_map_orb_states.mjs

@@ -31,6 +31,8 @@
 //   • the search box cannot surface a black hole
 //   • the viewer's OWN provisioning rows, which carry no feed `orb`, still draw —
 //     fail-closed must not delete the owner's own sky
+//   • the kit's featured fixtures carry a render-type the page will draw — a stub
+//     whose rows fail-closed silently drops is a stub that cannot probe the map
 //
 // Run:  node --test --test-reporter=tap tests/hub_map_orb_states.mjs
 
@@ -40,6 +42,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { ORB_BY_STATE } from '../modules/platform-identity/projects-feed.js';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
@@ -197,6 +200,30 @@ test('an unrecognised render-type is dropped, not drawn (fail-closed)', () => {
   assert.equal(sandbox.drawableCatalogRow({}), false, 'a row with no render-type at all is not drawn');
 });
 
+test("the kit's featured fixtures carry a render-type the page draws", () => {
+  // The drift this catches (task 1003838). The kit fixtures predated `orb`, so the
+  // fail-closed predicate above dropped EVERY catalog row: the design kit's stub
+  // served a sky with no orbs and a table three rows short, and six of the hub's
+  // 47 probes failed on a clean main. Fail-closed is right — the fixture was the
+  // thing that was wrong — but nothing said so, and standing failures make the
+  // probe run useless as a gate. A stub whose rows the page refuses to draw
+  // cannot probe the map, so that is asserted here rather than discovered again.
+  const { sandbox } = boot();
+  const FIXTURES = path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures');
+  for (const name of ['featured.json', 'featured-hub.json']) {
+    const rows = JSON.parse(fs.readFileSync(path.join(FIXTURES, name), 'utf8')).projects;
+    assert.ok(rows.length > 0, `${name} must carry catalog rows`);
+    for (const row of rows) {
+      assert.equal(sandbox.drawableCatalogRow(row), true,
+        `${name}: ${row.origin} must carry a render-type the hub draws`);
+      // the fixture stands in for the WIRE, so it carries the PAIR feedShapeFor()
+      // emits — not merely the one field this page happens to read today
+      assert.equal(ORB_BY_STATE[row.state], row.orb,
+        `${name}: ${row.origin} — state "${row.state}" and orb "${row.orb}" must agree with the feed's own mapping`);
+    }
+  }
+});
+
 test('the drop is wired into the browse list, not left as an orphan predicate', () => {
   // behaviour above proves the predicate; this proves the page actually asks it,
   // and asks it of the CATALOG (the viewer's own provisioning rows carry no feed