@bongos/core 1.19.707 → 1.19.708

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.707",
-  "core_contract": "1.19.707",
-  "source_commit": "81f4406107cc23fffd1cd396faeba854cfab702e",
+  "core_version": "1.19.708",
+  "core_contract": "1.19.708",
+  "source_commit": "42f201a980e11b8b417c2afa527230ed1ab05775",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T06:08:10.442Z",
+  "built_at": "2026-09-13T06:14:54.451Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2639,
-  "tree_sha256": "b1f44a9ac5209bb3aef35739af94352c50892f50161818d2e805cdcb9fb92687",
+  "tree_sha256": "369223629e32da5858cc92a00ab2643eaa169ca59d1d89d6ab77ab8c50e3fd57",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "59033d82daa55e0e2bb8f357d076e5e0c36b6d708ec764ed28946248da86a1c6"
+      "sha256": "fd622c24f29995f2c8ebdd272cf5784f05285bbafc6c3da490308ed5e1730ba7"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0beecf6840022e259986573a8a0b444f9d4848dc0758f009b83e346f54769a1f"
+      "sha256": "4f9b97401aebd998dd23bf3ec95a333fd6c596c0ea5551dc02dc6e863ad92742"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bed665bc57c56a76e572401a1baed5fd08bfcca74a1a32e2dc744b6af2f79399"
+      "sha256": "9002e7fc0a70168d56042d71c7905aa045b541dbc36d61e88180a8dfb1e0f559"
     },
     {
       "path": "public-docs/index.html",
@@ -7982,7 +7982,7 @@
     {
       "path": "scripts/gds/box-infra.js",
       "mode": "0000644",
-      "sha256": "7890dee972f792b633a86d5ac9e6195bafdfc6c197195b8ac3f00c4a0f80d5c0"
+      "sha256": "431691aed02a415c619dc0ba33106ac1e832e539260eff5f526debebe2d8ffff"
     },
     {
       "path": "scripts/gds/box-sync.js",
@@ -9567,7 +9567,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6bf49d3b72dbd08d6ede9514f8381efcb22d45602ed5f5de84893c1181b38dce"
+      "sha256": "98205e89563b71f2e6ddbe44a9639464bdc589c20f3f0a8de12a2b968ac06569"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10012,7 +10012,7 @@
     {
       "path": "tests/box_infra_resolve.mjs",
       "mode": "0000644",
-      "sha256": "cf261fa549f36d47ee42343bac2a297b132638aedf03beb8f521370b0c45c0e3"
+      "sha256": "fde24a8c273a098c89bbbce6c006fa4400448c9522b93707f5cd3f4fb358c515"
     },
     {
       "path": "tests/box_onboard.mjs",

package/docs/module-api-changelog.md

@@ -1873,5 +1873,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.705 with no explicit bump. run 34740247460. (task 1002620)
   1.19.707 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.706 with no explicit bump. run 34741980536. (task 1002620)
+  1.19.708 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.707 with no explicit bump. run 34742245823. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.707",
+  "version": "1.19.708",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.707",
+      "version": "1.19.708",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.707",
+  "version": "1.19.708",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/box-infra.js

@@ -216,6 +216,9 @@ function readCloudInit({ authorizedKeysBlock = '', boxEnv = '', gdsSession = '',
   // below — they are minted per-provision, not read from infra/. A missing inlined
   // file is COLLECTED and fails loud after the render (ADR 0150) — a half-wired box
   // (that component silently never boots) is a bug, not something to warn past.
+  //
+  // Every name passed to fileGzB64 below is INSTANCE-owned and deliberately absent
+  // from the neutral core's own infra/ — see infra/README.md (ADR 0150).
   const missingInfra = [];
   const fileGzB64 = (name) => {
     try {
@@ -267,6 +270,36 @@ function readCloudInit({ authorizedKeysBlock = '', boxEnv = '', gdsSession = '',
       + `— a box would boot half-wired (ADR 0150). Fix the instance infra/ before provisioning.`,
     );
   }
+  // ADR 0150 prong B named this escalation and never implemented it: "assert no
+  // __…_B64__ placeholders survive the render, so a *partial* infra/ also surfaces
+  // rather than half-wiring". The missingInfra check above only catches files THIS
+  // file knows to ask for. It cannot catch the other direction — an instance
+  // template carrying a token box-infra.js does not substitute. That renders a
+  // cloud-init with the literal token in it, and cloud-init happily writes the
+  // garbage as a file: the box boots half-wired, silently, which is the one
+  // outcome ADR 0150 exists to prevent.
+  //
+  // The stakes are not hypothetical for one of them. __BUILDER_AUTHORIZED_KEYS_B64__
+  // is the baked SSH key block; if a template misspells it, the substitution never
+  // happens and the box comes up with a garbage authorized_keys — permanently
+  // unreachable over SSH, exactly the failure task 1003635 was filed about (it
+  // guessed the wrong mechanism, but the outcome it named was reachable this way).
+  //
+  // Same pattern the happy-path test has always asserted, now enforced in the code
+  // rather than only in the test.
+  // The pattern is the placeholder CONVENTION, so this assumes a template never
+  // carries a literal __UPPER_SNAKE__ it means to keep. Nothing in this tree does,
+  // and a false positive fails loud and legibly (it names the token) rather than
+  // shipping a bad box — the safe direction to be wrong in. An instance that ever
+  // needs a literal one should escape it in the template, not weaken this check.
+  const survivors = [...new Set(rendered.match(/__[A-Z0-9_]+__/g) || [])];
+  if (survivors.length) {
+    throw new Error(
+      `box cloud-init under ${infraDir} left ${survivors.length} placeholder(s) unsubstituted: `
+      + `${survivors.join(', ')} — box-infra.js does not know these tokens, so the box would `
+      + `boot half-wired (ADR 0150). Reconcile the instance template with this renderer.`,
+    );
+  }
   return rendered;
 }
 

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.707'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.708'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_infra_resolve.mjs

@@ -17,8 +17,12 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { makeRunner } from './helpers.mjs';
 
+// This repo's root — the boundary tests at the bottom read the REAL tree.
+const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
 const require = createRequire(import.meta.url);
 const box = require('../scripts/gds/box.js');
 
@@ -153,5 +157,90 @@ await test('readCloudInit renders a non-empty cloud-init with no leftover __PLAC
   assert.ok(!/__[A-Z0-9_]+__/.test(out), 'no unsubstituted __PLACEHOLDER__ tokens remain');
 });
 
+// ===========================================================================
+// An UNKNOWN placeholder half-wires the box (task 1003635, ADR 0150 prong B)
+//
+// missingInfra only catches files this renderer knows to ask for. The other
+// direction — an instance template carrying a token box-infra.js never
+// substitutes — used to render straight through, leaving the literal token in
+// the cloud-init for cloud-init to write out as a file. ADR 0150 named the
+// assertion as an escalation and it was never implemented.
+// ===========================================================================
+
+await test('an UNKNOWN __TOKEN__ in the instance template is refused, not rendered through', () => {
+  const { infra } = makeInfra();
+  fs.appendFileSync(path.join(infra, TEMPLATE), '\n# __SOME_FUTURE_THING_B64__\n');
+  assert.throws(
+    () => box.readCloudInit({ infraDir: infra }),
+    (err) => /__SOME_FUTURE_THING_B64__/.test(err.message) && /placeholder|half-wired|ADR 0150/i.test(err.message),
+    'an unsubstituted placeholder must fail loud — rendering it through writes garbage onto the box',
+  );
+});
+
+await test('a misspelled AUTHORIZED_KEYS token cannot ship a permanently SSH-unreachable box', () => {
+  // The stakes case. A template that spells the key block even slightly wrong
+  // gets no substitution, so the box boots with a garbage authorized_keys and
+  // nobody can SSH in — the outcome task 1003635 reported, by the mechanism it
+  // did not find. It must be refused before DigitalOcean is touched.
+  const { infra } = makeInfra();
+  fs.appendFileSync(path.join(infra, TEMPLATE), '\n# __BUILDER_AUTHORIZED_KEY_B64__\n');
+  assert.throws(
+    () => box.readCloudInit({ infraDir: infra, authorizedKeysBlock: 'ssh-ed25519 AAAA' }),
+    /__BUILDER_AUTHORIZED_KEY_B64__/,
+  );
+});
+
+await test('the happy path still renders — the assertion does not fire on a correct template', () => {
+  const { infra } = makeInfra();
+  const out = box.readCloudInit({
+    infraDir: infra, authorizedKeysBlock: 'ssh-ed25519 AAAA', boxEnv: 'X=1', gdsSession: '{"t":1}',
+  });
+  assert.ok(out && out.length > 0, 'a correct template must still render');
+});
+
+// ===========================================================================
+// The core / instance boundary (task 1003635)
+//
+// The absence of the cloud-init set from the core's own infra/ was filed once as
+// a P1 outage ("a dev box becomes permanently SSH-unreachable"). It is not one —
+// ADR 0150 says the neutral core ships no box cloud-init, and the two throws
+// above are what make a missing one legible instead of dangerous. These pin that
+// boundary against the REAL tree so the next reader gets a test telling them so.
+// ===========================================================================
+
+await test('the INLINED list is exactly what box-infra.js actually asks fileGzB64 for', () => {
+  // The list above says "kept in sync with box.js's fileGzB64 calls" — by hand.
+  // Derive it instead, so adding a 10th inlined file cannot leave these tests
+  // silently proving less than they claim.
+  const SRC = fs.readFileSync(path.join(REPO_ROOT, 'scripts/gds/box-infra.js'), 'utf8');
+  const called = [...SRC.matchAll(/fileGzB64\('([^']+)'\)/g)].map((m) => m[1]);
+  assert.ok(called.length > 0, 'found no fileGzB64 calls — did box-infra.js move or get renamed?');
+  assert.deepEqual([...new Set(called)].sort(), [...INLINED].sort(),
+    'the INLINED fixture list has drifted from box-infra.js — the happy-path test would stop covering every inlined file');
+});
+
+await test('the neutral core ships NO box cloud-init — that is ADR 0150, not a missing file', () => {
+  const coreInfra = path.join(REPO_ROOT, 'infra');
+  assert.ok(!fs.existsSync(path.join(coreInfra, TEMPLATE)),
+    `the core now ships infra/${TEMPLATE}. ADR 0150 says it must not ("The neutral core still ships no infra/") — the cloud-init is instance-owned. If that decision changed, amend ADR 0150 and this test together.`);
+  for (const name of INLINED) {
+    assert.ok(!fs.existsSync(path.join(coreInfra, name)),
+      `infra/${name} is a cloud-init asset and belongs to the host instance, not the core (ADR 0150)`);
+  }
+});
+
+await test("core infra/ carries only the CLONE-RIDE scripts, which is why it looks half-empty", () => {
+  // The other population: these run on the box out of /workspace/infra/, arriving
+  // with the cloned source rather than through cloud-init. Their presence beside
+  // nine absences is the thing that reads as "files are missing" — infra/README.md
+  // exists to answer that, so it is required to stay.
+  const coreInfra = path.join(REPO_ROOT, 'infra');
+  for (const name of ['box-heartbeat.sh', 'box-report-host-keys.sh', 'box-report-terminal.sh', 'box-report-version.sh']) {
+    assert.ok(fs.existsSync(path.join(coreInfra, name)), `infra/${name} rides the clone and must stay in the core`);
+  }
+  assert.ok(fs.existsSync(path.join(coreInfra, 'README.md')),
+    'infra/README.md explains the two populations — without it the nine absences read as breakage again (task 1003635)');
+});
+
 for (const d of tmps) { try { fs.rmSync(d, { recursive: true, force: true }); } catch { /* best-effort */ } }
 summary();