@bongos/core 1.19.734 → 1.19.736

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.734",
-  "core_contract": "1.19.734",
-  "source_commit": "46c30e30da893738941d1e8d7215a614e2dc4d08",
+  "core_version": "1.19.736",
+  "core_contract": "1.19.736",
+  "source_commit": "917ef53331537c93796fb9db9a8b77be72cffe22",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T15:57:45.460Z",
+  "built_at": "2026-09-13T17:30:35.415Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 478,
+    "docs_redacted": 479,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2107,
+    "functional_verbatim": 2108,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2609,
-  "tree_sha256": "d26fac7aafe1ccc924b1fd6f5b92d1e322ba6f8646329350bb14cfe25af04899",
+  "file_count": 2611,
+  "tree_sha256": "4cd2b02aa80c6f20919a54413b4983dd572af10e199bf5401e6e75ee8914b543",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1157,7 +1157,7 @@
     {
       "path": "docs/adr/0134-private-first-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "ea38d4ba314674d432781fdacc0baee33ef765eabd6bcef37ab797b8ee858f73"
+      "sha256": "47b4d52804d291c8fd8952d8a2e8ad673f173a965cf0b5fe100aa6b93d850cd6"
     },
     {
       "path": "docs/adr/0135-module-upstream-submission-interim-queue.md",
@@ -1919,10 +1919,15 @@
       "mode": "0000644",
       "sha256": "1cd5710392b4226c27af4ce4f661ee6228f80ce16e9f9adb1fb43c3ebb9b5d24"
     },
+    {
+      "path": "docs/adr/0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md",
+      "mode": "0000644",
+      "sha256": "7060acdff9fde6dbe4831ea1873e5f75bc25acf6e3207a084ac3ddb33ee1a2ff"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "44bb02316957a38c19f8187aaeef3e3828202348b53e3fc45b6592022a9021a0"
+      "sha256": "872911d695cd9e3bf27b5bb4995acb2e814c73bbb7cabac2f7852ad10e3e1710"
     },
     {
       "path": "docs/api-reference.md",
@@ -2487,7 +2492,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "90a6bceef8a95c93d98b36cf8496fc22ba0a9aa505e96e8c620c57afb1d684f5"
+      "sha256": "8dc183ec4dc010d5897f8cca67dd0f55bb6abe5620e358388e9ed07a2f6521a8"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2697,7 +2702,7 @@
     {
       "path": "docs/recipes/private-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "9b64bb0c1af1f05d1af7c814e025abf820e59878a8a35ed85dd08c6beec1307e"
+      "sha256": "33e4f7f3083b8ac5d10f117d4d93e78b9d8b7b4d082087051b69698cb67b03b1"
     },
     {
       "path": "docs/recipes/redteam-patrol.md",
@@ -7532,12 +7537,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "028d0931d03fd623ced3e64412ebe17596c7475efc99912bbcf15166f1586e35"
+      "sha256": "014dc18dcf764c17d7927fe5475436f4d6e2acf18e7baa6f16b7852306dc89e0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c4d4049eec4c21014dd7e675c2db8420d5b0ccf0666945b8e2945eda6ef596db"
+      "sha256": "96f124d7dee1ff76d006c102798790ab7b59b27c0fbacdb36c545d658c185f39"
     },
     {
       "path": "public-docs/index.html",
@@ -8327,7 +8332,7 @@
     {
       "path": "scripts/gds/package-core.js",
       "mode": "0000644",
-      "sha256": "e927900fc296f5cf840425978e77232cd5cdc75de825144255050c8a5ba2f538"
+      "sha256": "89ec2a080f397e1af5c0dede40a7eb22a2e3343d219da4b4a4ba903337bcc420"
     },
     {
       "path": "scripts/gds/paste-token.js",
@@ -9337,7 +9342,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2260aaf94b97ca5be01a845df8edfd2af7a10716306e46e7d1507d863b995e00"
+      "sha256": "ad6748bac62f397b729ead21e7f591bc8e03fe771fff22855eb3813b066663da"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11374,6 +11379,11 @@
       "mode": "0000644",
       "sha256": "f6097301300cdb559d3620a5c602b763b70f1acc14816a7e70e1cdb61bb42d95"
     },
+    {
+      "path": "tests/leak_scan_fail_closed.mjs",
+      "mode": "0000644",
+      "sha256": "e5968a1df544680db05c66eeec803ebdbbbe98932bfec31a5287617c6dc01466"
+    },
     {
       "path": "tests/lib_sh_resolution.mjs",
       "mode": "0000644",
@@ -11742,7 +11752,7 @@
     {
       "path": "tests/package_core.mjs",
       "mode": "0000644",
-      "sha256": "65d341212de55a3c66c35e98ba55629220edc333d0ede83f4f5a223558dd4080"
+      "sha256": "a8278101d0de34bb8214f4c7a5a68760b5546099df27044c20d5c360fdc4442f"
     },
     {
       "path": "tests/parallel-load.mjs",

package/docs/adr/0134-private-first-npm-distribution.md

@@ -1,6 +1,6 @@
 # 0134 — Private-first npm distribution for the core + client (paid scoped, then public at launch)
 
-- **Status:** Accepted for the CORE; the **client half is superseded** by [task 1003742](https://cloudbongos.com/builders#/task/1003742) (2026-09-09) — see the note under Decision. Publish path + private-by-default config built in task 2089; the real publish is a gated owner step.
+- **Status:** **Superseded.** The **core half** — the private-by-default posture — is superseded by [ADR 0283](0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md) ([task 1003872](https://cloudbongos.com/builders#/task/1003872), 2026-09-13): `@bongos/core` now publishes **public**. This ADR's own "public at launch" step is the thing that happened; what remains accurate here is the *reasoning* for the pre-launch posture and the scoped-package mechanics. The **client half** was already superseded by [task 1003742](https://cloudbongos.com/builders#/task/1003742) (2026-09-09) — see the note under Decision. Publish path built in task 2089.
 - **Date:** 2026-07-07
 - **Deciders:** example-owner (owner/Archon), Claude. Owner asked to have the npm/CLI onboarding commands ready but kept private pre-launch, choosing paid private npm over the free GitHub Packages option.
 - **Task:** [#2089](https://example.com/builders#/task/2089) (publish path + private config) · [#2092](https://example.com/builders#/task/2092) (the `@cloudbongos` → `@bongos` scope rename + first real publish) · **Goal:** 35 (project-creation flow), criterion 165.

package/docs/adr/0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md

@@ -0,0 +1,53 @@
+# ADR 0283 — The core publishes publicly, because access was never the thing protecting it
+
+- **Status:** accepted
+- **Date:** 2026-09-13
+- **Task:** [1003872](https://cloudbongos.com/builders#/task/1003872) (goal 1000090, working area 4 — Bongos Core distribution). Gated on [1003869](https://cloudbongos.com/builders#/task/1003869) (sweep the literals), [1003870](https://cloudbongos.com/builders#/task/1003870) (fail-closed leak scan), [1003871](https://cloudbongos.com/builders#/task/1003871) (fixture confirmation). Records the owner decision behind [1003502](https://cloudbongos.com/builders#/task/1003502) ("public repo, public npm, or wait for the mirror" — **public npm**). That task is *not* closed by this ADR: its remaining work is repointing the gate's open-source link, which lives in a separate static site with no auto-deploy, and should follow once the registry flip is live.
+- **Supersedes:** [ADR 0134](0134-private-first-npm-distribution.md)'s **core half** — the pre-launch private-by-default posture. (Its client half was already superseded by task 1003742.)
+- **Adjacent:** [ADR 0258](0258-the-public-cli-is-a-generated-client-package-not-the-published-core.md) (the public CLI, which exists *because* the core was private) · [ADR 0136](0136-update-channel-subscription-policy.md) (the subscription lane this unblocks) · [ADR 0099](0099-delayed-redacted-mirror-export.md) (the mirror pipeline this path deliberately does not use) · [ADR 0161](0161-publish-on-merge.md) (the lane that performs the publish).
+
+## Context
+
+ADR 0134 chose **private-first**: `@bongos/core` publishes as a restricted scoped package on a paid npm org, with "public at launch" named as a later, deliberate step. That was the right call pre-launch. This ADR is that later step.
+
+The posture had a cost that grew quietly, because every symptom looked like a different bug:
+
+- **A tokenless `npm install` returns a flat E404** — indistinguishable from "no such package". Every co-tenant and downstream instance upgrade needs a credential to move at all.
+- **The nightly auto-upgrade sweep died on 2026-08-25 and reported `failed=0`.** Its systemd unit passed no `NPM_TOKEN`, the instance's env-fed `.npmrc` expanded to empty, and the private read 404'd. A skip is not a failure in that script's accounting, so nothing anywhere complained while the instance stopped receiving core updates.
+- **Any Anthropic-hosted cloud session** working on an instance repo cannot install the dependency at all.
+- **A newly scaffolded instance's README step 1 is `npm install`** — which is also what installs the `bongos` command. Without a token the owner does not get a stale instance; they get no working instance.
+- **[ADR 0258](0258-the-public-cli-is-a-generated-client-package-not-the-published-core.md) exists only because of this.** `@cloudbongos/cli` was built, and its require-closure painstakingly delazified, so that a new builder could reach the board without a private-registry credential.
+
+The decisive point is that **access control was never what protected this artifact.** Three gates decide what is *in* the tarball, and all three now hold:
+
+1. The in-build **no-leak gate** (branding-derived literals + live credential shapes) — fail-closed, 2,624 files clean.
+2. The **prior-instance leak scan** — fatal by default since task 1003870, with `--no-leak-scan` the only escape; a real build passes with `✓ no prior-instance literals in the built artifact`.
+3. The **fixture confirmation** of task 1003871 — all 14 credential-shape files checked against each provider's real key format (11 too short to have ever been valid, 3 alphabet sequences or Amazon's own published documentation example).
+
+`--access restricted` decides *who may fetch* the artifact. Those three decide *what is in it*. Conflating them is what made the private posture feel like a security control rather than a launch-timing choice.
+
+## Decision
+
+**`@bongos/core` publishes as a public scoped package.**
+
+- `buildPackageJson` sets `publishConfig.access: "public"`, and `publishArgs` passes `--access public`. Both, deliberately: the belt-and-braces of the restricted era, pointed the other way, so neither drifting alone can silently take the package back to private.
+- **`.github/workflows/publish.yml` passes `--access public` too.** This is the site that actually releases — `package-core --publish` is the manual owner path. Flipping only `package-core.js` would have left every real release restricted while the code claimed otherwise: precisely the failure shape of task 1003870, where the workflow did not arm the gate its own header comment advertised. A test now reads the workflow and fails if `restricted` reappears anywhere in the lane.
+- **The one-time registry flip is a separate, deliberate owner step:** `npm access set status=public @bongos/core`. `--access` on publish governs what *that publish* declares, and has historically been a no-op when re-publishing an already-private package. The package read `private` on the registry when this ADR was written, so the flag alone cannot be assumed sufficient — the flip is verified by a tokenless install from a clean `HOME`, not by the flag's presence.
+- **Provenance stays off.** The *package* is public; the *source repository* is not. npm refuses to generate provenance from a private repo, so `NPM_CONFIG_PROVENANCE: 'false'` remains required until the source repository itself goes public. Turning it on before then fails every publish.
+- **The npm path does not run ADR 0099's mirror pipeline, by design.** `package-core` performs its own redaction (476 docs redacted, 24 agent-docs stubbed, `package.json` synthesized). That is why gates 1–3 carry the whole safety burden here, and why they had to land first.
+
+## Consequences
+
+- `npm install @bongos/core` works from any machine with no credential. Co-tenant upgrades, the nightly sweep, cloud sessions and fresh scaffolds all stop needing a token they were never given.
+- The sweep's `NPM_TOKEN` dependency becomes vestigial for reads. It should be removed from that path rather than left as a trap that appears to work.
+- **[ADR 0258](0258-the-public-cli-is-a-generated-client-package-not-the-published-core.md) is largely redundant and should be revisited, not deleted reflexively.** `@cloudbongos/cli` is published, works, and has a deliberately narrow verb set; the question is whether a public core makes it a maintenance burden or a still-useful thin entry point.
+- **This does not fix the 22 co-tenants.** Twenty of them pin `file:vendor/bongos-core-<v>.tgz` — a local path with no registry channel to follow. Public access is necessary but not sufficient; converting them is separate work.
+- The source repository stays private. Public package ≠ public repo, and nothing here changes who can read the source repository.
+- Going public is effectively **one-way**. A published tarball is mirrored and cached beyond our control; `npm unpublish` has a 72-hour window and does not reach mirrors. This is why the flip is an owner action and why gates 1–3 were non-negotiable prerequisites.
+
+## Rejected
+
+- **A rank-gated registry proxy** — the server holds the npm token, builders authenticate with their existing Bongos CLI session, and the server proxies to npmjs.org after a per-request rank check. This is the correct design *if the core must stay private*: nothing is handed out, revocation is instant and per-builder, and every fetch is auditable. It was rejected because it manages the problem that going public deletes, and because it would entrench the private posture the owner chose to leave.
+- **Handing builders the npm read token, gated by rank.** Rank-gating the handout does not rank-gate the use: a token, once held, is held forever and can be passed on, and revocation means rotating it for everyone. It is access control in name only.
+- **Keeping the vendored-tarball path as the answer.** It is what co-tenants do today, and it is exactly why twenty of them are frozen on the version current at their provisioning date.
+- **Making the repository public in the same change.** A larger decision with its own review, and not required for any of the benefits above. Keeping them separate also keeps the provenance question honest.

package/docs/adr/README.md

@@ -374,3 +374,4 @@ This keeps the decision history honest and traceable.
 | 0280 | [**The unattended lane may drive a co-tenant, because the roster entry IS the per-instance decision** ([task 1003843](https://cloudbongos.com/builders#/task/1003843) · goal 1000106; from [task 1003521](https://cloudbongos.com/builders#/task/1003521), which built co-tenant mode into `go-live.js` and deliberately left this caller alone). `subscribe.js` keeps a SECOND COPY of go-live's target contract, and it drifted: `GO_LIVE_REQUIRED` still listed `deployTimer` after 1003521 made it optional, so `goLiveTargetFor()` returned `missing: ['deployTimer']` for every provisioned co-tenant, and `rawTopologyFor()`'s fixed field list dropped `pinMode` before the target was built — the same stale-normalizer trap that function's own comment was written to fix, one field later. **1003521 deferred this as a policy judgement call; reading the fallback shows the premise was wrong.** `mapped.ok === false` never meant "skip this instance" — it meant "deploy it the WEAKER way": a bare `bongos upgrade`, no backup, no deploy-timer guard, and a pin COMMITTED AND PUSHED into the co-tenant's own repo, which is exactly what `pinMode` exists to prevent. The lane was already auto-deploying co-tenants; the only open question was whether it did so well. A THIRD defect sat behind the other two and would have turned the silent downgrade into a hard failure had only the first been fixed: the normalizer yields `deployTimer: null`, an explicit null SURVIVES `JSON.stringify` into `--target-json`, and go-live's `validateTarget` runs `isSafeToken(null)` on it and rejects the whole target. A FOURTH sat PAST the go-live call and is what separates "reachable" from "safe": after any successful upgrade the lane runs its own pin net, `commitPin()`, which commits the pin files and PUSHES them to `origin` — a net that predates `pinMode`. Under `local-commit` go-live leaves the tree clean so it no-ops by luck; under **`leave-dirty`** the pin is in the working tree BY DESIGN, so the net committed it and pushed it into the customer's own repo — the lane honouring `pinMode` right up to the moment it undid it. **Decision: the lane may drive a co-tenant and needs no new gate, because listing an instance in `config/update-subscriptions.json` already IS the explicit per-instance operator decision** — the roster ships empty, nothing is touched until an operator lists it, and the routine is autonomy-gated (`requiresAutonomy: true`, default OFF) on top of that; a second consent gate asks the same person the same question twice. So: `GO_LIVE_REQUIRED` now MIRRORS go-live's `REQUIRED_FIELDS`, with a test reading BOTH source files and failing on drift; `deployTimer` moves to the optional-field loop so a co-tenant OMITS the key rather than carrying a null; `rawTopologyFor` carries `pinMode`; `resolveGoLive` gains a `needsCoTenant` probe leg; and `goLiveEngineFor()` makes the decision ONCE for both the dry run and the apply path, which had re-derived it separately. The pin net now obeys the same `pinMode` go-live was given — `commitPin()` takes `push` (default true, so the platform instance is unchanged), `local-commit` commits without pushing, `leave-dirty` skips the net, the rollback tidy follows the same rule, and the "not durable" advice stops telling an operator to `git push` a repo we do not own; its refusal to touch a worktree carrying NON-pin changes is unchanged in every mode. **The probe is CONDITIONAL on purpose** — demanding `pinMode` of every target would strip the go-live path from any instance between the `--target-json` release and 1003521's, trading a live regression for a hypothetical one. Rejected: a second consent gate (an `allowCoTenant` flag); deferring to the unspecced fleet control plane ([task 1001948](https://cloudbongos.com/builders#/task/1001948)) — which does not leave co-tenants alone, it leaves them pushing pins into customer repos; dropping `deployTimer` from `GO_LIVE_REQUIRED` and nothing else (the fix as proposed — trades a silent downgrade for a hard rejection); probing unconditionally; reaching co-tenant mode WITHOUT teaching the durability net about it (nominal support that breaks its own promise seconds later); and teaching `loadSubscriptions()` about `pinMode` instead, since that normalizer ships in the control plane's vendored core that nobody bumps — the exact trap `rawTopologyFor` routes around.](0280-the-unattended-lane-may-drive-a-co-tenant-because-the-roster-is-the-decision.md) | core distribution / unattended deploy |
 | 0281 | [**An instance’s identity is its own unix account and its own password-authed Postgres role** ([task 1003369](https://cloudbongos.com/builders#/task/1003369) · goal 1000094, audit ref `B3` of the 2026-08-29 security audit). [ADR 0111](0111-instance-hosting-provisioning-module.md) made standup automatic and [ADR 0128](0128-provisioning-runner-privilege-and-db-auth-model.md) settled how the RUNNER escalates; neither settled who the INSTANCE is once it runs, and the answer was that everybody was the same person. `serviceUnit` hardcoded `User=lars`, and **co-tenant is the default shape** — so on a shared box every instance’s process ran under one uid, and `pool.js` connected by **passwordless peer auth**. Two consequences, neither a bug in any route: a unix user may read `/proc/<pid>/environ` of its own processes, so every instance could read every sibling’s `GITHUB_APP_PRIVATE_KEY`, hub client secret and OAuth secret; and peer auth answers “which unix user are you”, so any code as `lars` could open a pool against **any** database on the box by naming it — including the control plane’s own `builders` and `builder_sessions`. The `0600` `web.env` and the per-instance DB were already correct: sound walls with one door, and every instance had the key. **Decision: each instance gets its own unix account and its own password-authed PG role, both derived from its slug, both created by the provision run.** The account is `bongos-<slug>`, hash-folded past utmp’s 32 chars — prefixed because a project may legally be called `postgres`, and hash-suffixed because two slugs sharing a 16-char prefix would otherwise fold onto ONE account, which is the shared identity being removed. Its home is `/var/lib/<user>` and deliberately **not** under `/home`, since the unit sets `ProtectHome=read-only` and the server writes `builder-secret.key` inside its config home on first boot — a `/home` account would make that `EROFS`. The unit gains `ProtectSystem=strict` / `ProtectHome=read-only` / `PrivateTmp=true` with `ReadWritePaths` as the whole allow-list; **the checkout the service runs is deliberately not writable by it**. The role is `LOGIN` + password, owns its own DB, and is NOT superuser/CREATEDB/CREATEROLE — with **`REVOKE CONNECT … FROM PUBLIC` as the half that actually isolates**, because PG grants `CONNECT` to `PUBLIC` by default and per-role passwords alone leave a sibling one peer-auth hop away. Grants run in a SECOND statement **after** the migrate, since the privileged migrate runs as `postgres` and owns every table it creates; `ALTER DEFAULT PRIVILEGES` aims the same grant forward. The password is minted per run and never stored — the same run sets it on the role and rewrites the `0600` env file, so **every provision rotates it** — and `pool.js` reads `PGUSER`/`PGPASSWORD` **explicitly** rather than via `pg`’s env defaults, because the whole defect was a connection whose identity nothing in the code stated. **Absence is the old behavior:** no password ⇒ no credential lines and no pool keys, so an instance provisioned before this keeps its peer auth and the rollout cannot brick a box. Two consequences worth the record. (1) **The generated SQL contains no double quote, and that is load-bearing** — every literal is dollar-quoted and every identifier goes through `format(%I)`, because these commands are embedded in the dedicated droplet’s cloud-init as `- [ bash, -lc, "…" ]`, a YAML DOUBLE-QUOTED scalar: a plain `"role"` identifier reads fine in `psql` and silently truncates the line. A test asserts the absence rather than leaving it to habit. (2) **A partial, stated honestly** — the account is added to the app-user group so it can read the checkout it runs from (without it the unit fails at exec with `EACCES`), so FILE-level co-tenant separation is not what this delivers; the process and database boundaries are. Rejected: a `DATABASE_URL` in `web.env` (needs no pool change, but trades a stated, assertable identity for a socket-path parse that is `pg-connection-string`’s business); per-role passwords WITHOUT the `PUBLIC` revoke (reads like isolation, and peer auth walks around it); `ProtectSystem=full`, or `strict` with the working directory writable (makes the code the service executes writable by the service, in a change whose subject is containment); keeping `User=lars` and isolating with a second mechanism (the shared uid IS the `/proc` vector); storing the password in `provisioning_instances` (a live credential in plaintext, to buy stability the rotation does not need).](0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md) | tenant isolation / provisioning / DB auth |
 | 0282 | [**A module that spends money for its callers DECLARES so, and the core refuses to enable it where anyone can sign up and nobody is on the hook** ([task 1003884](https://cloudbongos.com/builders#/task/1003884), owner decision 2026-09-13). A fire from `modules/agents` costs ~$0.90, `POST /agents/:name/invoke` answers **202** so the caller does not even wait, and the route is gated at `requireBuilder` and nothing else — deliberately, because a v1 agent is hard-read-only by plumbing. That bounds CAPABILITY, not SPEND, and `lib/fire-budget.js` says so in its own header: it is a blast radius, explicitly NOT a budget, and it defers the real cap to `agents_runs.cost_usd`. The cap did not exist. The exposure is three reasonable facts composed: a fire is expensive and async; invoke admits any **any-builder**; and with the join door `open`, any GitHub account IS one seconds after sign-up. **Decision: the MODULE declares `"spend": { "requiresPayer": true }` and the CORE refuses to enable it when the composed join door (ADR 0247 — the door, never the `joinability` knob alone) is `open` with no configured payer.** The declaration lives in the manifest because fitness Check 10 forbids the kernel from naming a discovered module key — a constraint that turns out to be the better design, since the next metered module inherits the guard by declaring one line rather than by someone remembering to widen a list. The refusal is at **config load**, so the routes never mount and the migrations never run: a per-request check would let the module mount, advertise its routes and read as enabled everywhere the UI looks, then refuse callers one at a time — a broken feature, not a closed door. It is applied AFTER config, env and default alike, because `<PREFIX>_MODULE_<KEY>` is exactly the knob a hurried deploy reaches for and a wall env could outrank is a suggestion. An UNREADABLE posture refuses too, inverting this file’s usual fail-to-unchanged default: "I could not tell whether strangers can sign up" has to mean "assume they can", and the cost of being wrong is one module resolving off. `spend_payer` (`none|project|builder`) joins `SETTINGS_VOCAB` on ADR 0241’s transport, and `agents_runs` gains `payer_kind` + `payer_builder_id` — **stored, not derived**, because the setting is a live knob and deriving would make last month’s bill change when an owner flips it. `none` is NOT a third payer: a run always has a real one and `none` attributes to the project, so a CLOSED-door instance is unchanged and `none` is fatal only where it is also dangerous. An EVENT fire has no caller, so it bills the project rather than nobody — otherwise the event path is the one unbounded route. The per-payer monthly ceiling (`lib/spend-ceiling.js`) is a SECOND wall that must never merge into the first: a rate ceiling cannot bound a bill (~$650/month/builder at 10 fires an hour) and a spend ceiling cannot bound a loop (it reads spend already landed). It records NOTHING — the ledger is the tally, and a second tally is the disagreeing answer fire-budget’s header refuses to become. It honours the finding of abandoned [task 1001393](https://cloudbongos.com/builders#/task/1001393), which caught the autonomy brake reading month-to-date spend from a DB it could not reach and **failing open**: every unknown refuses (no cap, non-finite cap, no payer, a read that threw, a sum absent or unparseable), answering **402** rather than fire-budget’s 429 so "the money is gone" and "too fast" stay distinguishable. Writing the absent-sum clause down was not paranoia — the first draft admitted the fire on a null sum because `Number(null)` is `0`, and the test for that clause is what caught it. The overshoot is STATED: in-flight fires are invisible to the read, bounded by concurrency × ~$0.90, and what bounds concurrency is fire-budget — each wall’s blind spot is the other’s window. The cost-needs-a-payer constraint is added `NOT VALID` so it binds every future write without failing the migration of an instance whose history predates the column. **What it does not do:** nobody is billed; `builder` attributes spend, it does not collect.](0282-a-module-that-spends-for-its-callers-declares-a-payer-and-the-core-refuses-it-without-one.md) | modules / spend attribution / agents |
+| 0283 | [**The core publishes publicly, because access was never the thing protecting it** ([task 1003872](https://cloudbongos.com/builders#/task/1003872) · goal 1000090 — *Working area 4, Bongos Core distribution*; owner decision 2026-09-13, resolving [task 1003502](https://cloudbongos.com/builders#/task/1003502)). [ADR 0134](0134-private-first-npm-distribution.md) chose private-first and named "public at launch" as a later deliberate step; this is that step. The restricted posture had a cost that grew quietly because every symptom read as a different bug: a tokenless `npm install` returns a flat **E404**, indistinguishable from "no such package", so every co-tenant and downstream upgrade needed a credential to move at all; the nightly auto-upgrade sweep **died on 2026-08-25 and reported `failed=0`** (its unit passed no `NPM_TOKEN`, the env-fed `.npmrc` expanded to empty, and a skip is not a failure in that script's accounting, so nothing complained while the instance stopped receiving core updates); an Anthropic-hosted cloud session could not install the dependency at all; and a fresh scaffold's README step 1 IS `npm install`, which is also what installs the `bongos` command — so without a token an owner got no working instance rather than a stale one. [ADR 0258](0258-the-public-cli-is-a-generated-client-package-not-the-published-core.md)'s `@cloudbongos/cli`, require-closure delazification and all, exists ONLY because of this. **The decisive point is that access control was never what protected the artifact:** three gates decide what is IN the tarball — the in-build no-leak gate (branding literals + credential shapes, fail-closed, 2,624 files clean), the prior-instance leak scan (**fatal by default since [task 1003870](https://cloudbongos.com/builders#/task/1003870)**, `--no-leak-scan` the only escape), and the fixture confirmation of [task 1003871](https://cloudbongos.com/builders#/task/1003871) (all 14 credential-shape files checked against each provider's real key format: 11 too short to have ever been valid, 3 alphabet sequences or Amazon's own published doc example). `--access restricted` decides who may FETCH it; those three decide what is IN it, and conflating them is what made a launch-timing choice feel like a security control. **Decision: publish public — at all three sites.** `publishConfig.access` and `publishArgs` both say `public` (belt-and-braces of the restricted era pointed the other way, so neither drifting alone reverts it), **and so does `publish.yml`** — the site that ACTUALLY releases, `package-core --publish` being the manual owner path. Flipping only `package-core.js` would have left every real release restricted while the code claimed otherwise: exactly task 1003870's shape, where the workflow did not arm the gate its own header comment advertised. A test reads the workflow and fails if `restricted` reappears anywhere in the lane. **The one-time registry flip stays a separate owner step** (`npm access set status=public`): `--access` governs what THAT publish declares and has historically been a no-op when re-publishing an already-private package — the package read `private` on the registry when this was written — so it is verified by a tokenless install from a clean `HOME`, never by the flag's presence. **Provenance stays off:** the PACKAGE is public, the SOURCE REPO is not, and npm blocks provenance on the repo's visibility — turning it on before the source repository goes public fails every publish. The npm path deliberately does not run [ADR 0099](0099-delayed-redacted-mirror-export.md)'s mirror pipeline (`package-core` runs its own redaction: 476 docs redacted, 24 agent-docs stubbed), which is why gates 1–3 carry the whole safety burden and had to land first. **Going public is effectively one-way** — a published tarball is mirrored and cached beyond our control and `npm unpublish` has a 72-hour window that does not reach mirrors. **Does NOT fix the 22 co-tenants:** twenty pin `file:vendor/bongos-core-<v>.tgz`, a local path with no registry channel to follow, so public access is necessary but not sufficient. Rejected: a **rank-gated registry proxy** (server holds the token, builders authenticate with their existing Bongos session, per-request rank check — the RIGHT design if the core must stay private, rejected because it manages the problem going public deletes); **handing builders the read token gated by rank** (rank-gating the handout does not rank-gate the use — a token once held is held forever and revocation means rotating it for everyone: access control in name only); keeping the vendored tarball as the answer (it is why twenty co-tenants are frozen at their provisioning date); making the REPO public in the same change (a larger decision, not required for any of this, and separating them keeps the provenance question honest).](0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md) | core distribution / npm access |

package/docs/module-api-changelog.md

@@ -1942,5 +1942,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.732 with no explicit bump. run 34766569496. (task 1002620)
   1.19.734 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.733 with no explicit bump. run 34767120578. (task 1002620)
+  1.19.735 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.734 with no explicit bump. run 34768136326. (task 1002620)
+  1.19.736 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.735 with no explicit bump. run 34771773838. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/private-npm-distribution.md

@@ -2,7 +2,7 @@
 
 > **This is one leg of three.** For the whole path from a change on core `main` to a live instance — and for when publishing to npm is *not* what moves an instance — start at [the core release pipeline](core-release-pipeline.md).
 >
-> Implements [ADR 0134](../adr/0134-private-first-npm-distribution.md), **core half only**. Pre-launch, `@bongos/core` publishes as a **private, scoped** npm package on the owner's paid `bongos` npm org (the canonical brand); at launch it flips to public. The daily command is `bongos` regardless of package name.
+> **⚠️ The private half of this recipe is HISTORY as of 2026-09-13.** `@bongos/core` publishes **public** — [ADR 0283](../adr/0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md) ([task 1003872](https://cloudbongos.com/builders#/task/1003872)) supersedes [ADR 0134](../adr/0134-private-first-npm-distribution.md)'s core half. A tokenless `npm install @bongos/core` now works, so **anything below telling you to set `NPM_TOKEN` for a READ is obsolete**; a token is still needed to *publish*. The build, redaction, manifest-pin and no-leak-gate mechanics are unchanged and still accurate. The daily command is `bongos` regardless of package name.
 >
 > **`@bongos/client` is no longer part of this.** It was published once (2026-07-07, 0.0.2), never updated while the API moved 500+ core versions, and had **zero** consumers the whole time — every consumer vendors a copy instead. The owner removed it from npm on 2026-09-09; ADR 0134's client half is superseded ([task 1003742](https://cloudbongos.com/builders#/task/1003742)). The generated client still exists and still regenerates — it is simply not a package.
 >

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.734",
+  "version": "1.19.736",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.734",
+      "version": "1.19.736",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.734",
+  "version": "1.19.736",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",
@@ -21,7 +21,7 @@
     "node": ">=22"
   },
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
   "dependencies": {
     "express": "^4.21.2",

package/scripts/gds/package-core.js

@@ -59,16 +59,20 @@
 //                    (task 1002218 / audit H3) — deterministic + network-free.
 //   --self-verify-boot   ALSO `npm install <tgz>` into a throwaway consumer + boot /healthz
 //                    (reuses tests/consumer_layout_boot.mjs; needs npm/registry access).
-//   --leak-scan-strict   make the post-build leak scan FATAL on any prior-instance literal
-//                    (default: the scan runs + WARNS; --no-leak-scan skips it). task 1002220 / H6.
+//   --no-leak-scan   THE ONLY ESCAPE from the post-build leak scan: skips it entirely.
+//                    The scan is FAIL-CLOSED by default — an un-allowlisted prior-instance
+//                    literal in the built artifact aborts the build (task 1003870 / H6).
+//   --leak-scan-strict   accepted as an explicit no-op; fatal IS the default since task
+//                    1003870. Kept so CI can state the intent it relies on out loud.
 //   Outputs (nothing is committed — dist/ is gitignored):
 //     dist/bongos-core-<version>/           the redacted core tree (inspectable)
 //     dist/bongos-core-<version>.tgz        the installable unit
 //     dist/bongos-core-<version>.manifest.json   the PIN (tree hash + per-file hashes)
-//   --publish        after building, `npm publish` the .tgz as a PRIVATE scoped
-//                    package (--access restricted). DRY-RUN unless --live is added
-//                    (task 2089 / ADR 0134). Private publish needs the cloudbongos
-//                    npm org on a paid plan + `npm login`; this script holds no token.
+//   --publish        after building, `npm publish` the .tgz as a PUBLIC scoped
+//                    package (--access public). DRY-RUN unless --live is added
+//                    (task 1003872 / ADR 0283, superseding ADR 0134's restricted
+//                    posture). Needs `npm login` as a member of the @bongos org;
+//                    this script holds no token.
 
 const fs = require('node:fs');
 const os = require('node:os');
@@ -303,13 +307,18 @@ function buildPackageJson({ version, sourceDeps, sourceOverrides }) {
       './module-seams': './src/module-seams.js',
     },
     engines: { node: '>=22' },
-    // Pre-launch distribution posture (task 2089 / ADR 0134): publish PRIVATE by
-    // default. `access:"restricted"` makes a scoped package private on publish, so a
-    // paid npm org can ship it where only members can install — no accidental public
-    // leak if someone forgets the CLI flag. Going public at launch is one step:
-    // `npm access public @bongos/core` (or flip this to "public"). The name must
-    // stay SCOPED to be private at all — unscoped npm names are always public.
-    publishConfig: { access: 'restricted' },
+    // Distribution posture: PUBLIC (task 1003872, ADR 0283 — supersedes ADR 0134's
+    // pre-launch `restricted`). The private posture existed so a pre-launch artifact
+    // could not leak; what it actually cost was that a tokenless `npm install` 404s,
+    // which broke every co-tenant upgrade, the nightly auto-upgrade sweep (silently,
+    // since 2026-08-25), and every newly scaffolded instance.
+    //
+    // The safety this replaces is NOT "nobody can read it" — it is the three gates
+    // that now run on every build: the branding/credential no-leak gate, the
+    // prior-instance leak scan (fatal by default since task 1003870), and the
+    // fixture confirmation of task 1003871. Those decide what is IN the tarball;
+    // access decides who may fetch it. Do not re-conflate them.
+    publishConfig: { access: 'public' },
     dependencies,
   };
   if (sourceOverrides && sourceOverrides.undici) pkg.overrides = { undici: sourceOverrides.undici };
@@ -551,12 +560,20 @@ function arg(name, fallback = null) {
 // npm is `npm.cmd` on Windows and can't be execFile'd bare; unix uses `npm`.
 const NPM_BIN = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 
-// Pure — the exact `npm publish` argv for the built core tarball. Scoped packages
-// publish PRIVATE via publishConfig.access:"restricted" (buildPackageJson); we ALSO
-// pass `--access restricted` so a stray `publishConfig` edit can't silently make the
-// pre-launch artifact public. `--dry-run` unless `live` (the permanent owner step).
+// Pure — the exact `npm publish` argv for the built core tarball. The package
+// publishes PUBLIC via publishConfig.access:"public" (buildPackageJson); we ALSO
+// pass `--access public` so the posture is stated at the call site and a stray
+// `publishConfig` edit can't silently take it back to restricted — the same
+// belt-and-braces the restricted era used, pointed the other way (task 1003872).
+//
+// NOTE for whoever reads this after a failed rollout: `--access` on publish governs
+// what THIS publish declares. A package that is already `private` on the registry
+// also needs the one-time, registry-side `npm access set status=public @bongos/core`
+// — the flag alone has historically been a no-op on re-publish. ADR 0283 records
+// that flip as a separate, deliberate owner step for exactly that reason.
+// `--dry-run` unless `live` (the permanent owner step).
 function publishArgs(tgzPath, live) {
-  const a = ['publish', tgzPath, '--access', 'restricted'];
+  const a = ['publish', tgzPath, '--access', 'public'];
   if (!live) a.push('--dry-run');
   return a;
 }
@@ -629,6 +646,18 @@ function scanKindOf(pathRel) {
   return 'functional';
 }
 
+// The post-build leak scan's POLICY, split out of main() so a test can plant a literal and prove
+// the build refuses without running a full 2-minute package (task 1003870). Pure: argv in, verdict
+// out. Fail-closed — any un-allowlisted prior-instance literal is fatal unless the operator has
+// explicitly said --no-leak-scan, which skips the scan altogether rather than downgrading it.
+// `--leak-scan-strict` is honoured as a no-op: it named this behaviour before it became default.
+function leakScanVerdict(remainingLiteralHits, argv = process.argv) {
+  if (argv.includes('--no-leak-scan')) return { run: false, fatal: false, reason: 'skipped' };
+  const n = (remainingLiteralHits || []).length;
+  if (n === 0) return { run: true, fatal: false, reason: 'clean' };
+  return { run: true, fatal: true, reason: 'prior-instance-literals' };
+}
+
 // Independent post-build leak scan over the built core file set (task 1002220 / audit H6). Two layers:
 //   • INSTANCE LITERALS — findLeaks() over PRIOR_INSTANCE_LITERALS (+ the public-IP floor) across
 //     EVERY shipped file: brand/owner/history that must not ship in a portable core. This is the
@@ -942,14 +971,14 @@ function main() {
 
   // Post-build leak scan (task 1002220 / audit H6): independent verification that the BUILT
   // artifact carries no prior-instance identity, + a warn-level secret-shape scan over functional
-  // files. Runs on every build (skip with --no-leak-scan). Prior-instance literals are a WARNING
-  // by default and a hard FAILURE under --leak-scan-strict (the trunk still carries residual
-  // history until task 1002219 sweeps it + task 1002217 adds the fail-closed floor gate). A
-  // secret-shape hit is ALWAYS a non-fatal warning — the R88 functional-verbatim fix is preserved.
+  // files. Runs on every build and is FAIL-CLOSED: an un-allowlisted prior-instance literal aborts
+  // the build. The trunk sweep (task 1003869) cleared the residue those literals used to represent,
+  // so warning instead of failing would only let it creep back (task 1003870). --no-leak-scan is
+  // the sole escape. A secret-shape hit stays a non-fatal warning — those 14 files were each
+  // confirmed a test fixture (task 1003871) and the R88 functional-verbatim fix is preserved.
   if (!process.argv.includes('--no-leak-scan')) {
     const scanFiles = staged.map((s) => ({ path: s.name.startsWith(TAR_ROOT) ? s.name.slice(TAR_ROOT.length) : s.name, content: s.buf }));
     const scan = scanArtifactForLeaks(scanFiles);
-    const strict = process.argv.includes('--leak-scan-strict');
     // Named, reasoned exceptions (task 1003869). A detector must carry the pattern it
     // detects and a "public IPs are flagged" test must be handed a public IP, so those
     // hits are real but not leaks. Each is listed per (file, literal) with its reason in
@@ -966,17 +995,21 @@ function main() {
       for (const e of stale) console.error(`   ${e.path}  [${e.literal}]`);
     }
     scan.literalHits = remaining;
+    const verdict = leakScanVerdict(scan.literalHits);
     if (scan.literalHits.length) {
       const byLit = {};
       for (const h of scan.literalHits) byLit[h.sample] = (byLit[h.sample] || 0) + 1;
       const summary = Object.entries(byLit).sort((a, b) => b[1] - a[1]).map(([k, n]) => `${k}×${n}`).join(', ');
       const files = [...new Set(scan.literalHits.map((h) => h.path))];
       console.error('');
-      console.error(`[leak-scan] ${strict ? 'FAILED' : 'WARNING'} — ${scan.literalHits.length} prior-instance literal hit(s) across ${files.length} shipped file(s): ${summary}`);
+      console.error(`[leak-scan] FAILED — ${scan.literalHits.length} prior-instance literal hit(s) across ${files.length} shipped file(s): ${summary}`);
       for (const p of files.slice(0, 30)) console.error(`   ${p}`);
       if (files.length > 30) console.error(`   … +${files.length - 30} more file(s)`);
-      if (strict) { console.error('[leak-scan] --leak-scan-strict: refusing to certify a leaky artifact.'); process.exit(1); }
-      console.error('[leak-scan] non-fatal for now — the trunk sweep (task 1003869) is clearing the residue; it becomes a hard gate when task 1003870 arms publish.yml. Run --leak-scan-strict to enforce today.');
+      console.error('[leak-scan] refusing to certify a leaky artifact. Either remove the literal at SOURCE (check what');
+      console.error('[leak-scan] REGENERATES the file — a generator re-leaks on every run, task 1003911), or, if the hit is');
+      console.error('[leak-scan] a detector carrying its own pattern, add a named (path, class) reason to');
+      console.error('[leak-scan] scripts/gds/leak-scan-allowlist.js. --no-leak-scan skips this gate entirely.');
+      if (verdict.fatal) process.exit(1);
     } else {
       console.error('[leak-scan] ✓ no prior-instance literals in the built artifact.');
     }
@@ -1021,6 +1054,8 @@ module.exports = {
   selfVerify, reproducePinFromTree,
   // task 1002220 (audit H6) — post-build leak scan (prior-instance literals + functional secret shapes)
   scanArtifactForLeaks, PRIOR_INSTANCE_LITERALS,
+  // task 1003870 — the fail-closed verdict the build acts on (pure, so a test can plant a literal)
+  leakScanVerdict,
   // task 1002217 (audit H4) — the fixed neutral floor injected into the doc-redaction + fail-closed gate
   PRIOR_INSTANCE_FLOOR,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.734'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.736'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/leak_scan_fail_closed.mjs

@@ -0,0 +1,108 @@
+// tests/leak_scan_fail_closed.mjs
+//
+// Task 1003870 — the post-build leak scan must FAIL CLOSED. The detector (task 1002220) and
+// the neutral floor (task 1002217) both landed, but strictness was opt-in and the publish lane
+// never opted in, so a leaky artifact could have gone to npm while the workflow's own header
+// comment claimed a fail-closed gate. This locks both halves:
+//   1. the POLICY — planting a prior-instance literal makes the build refuse, with no flag,
+//   2. the WIRING — the publish lane still arms the gate and never disarms it.
+// (2) is the half that was actually broken, and a policy test alone would not have caught it.
+//
+// Run:  node tests/leak_scan_fail_closed.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { scanArtifactForLeaks, leakScanVerdict, PRIOR_INSTANCE_FLOOR } = require('../scripts/gds/package-core.js');
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+// This file is itself published, so it DERIVES the literal it plants instead of spelling it
+// out — the self-leak invariant the allowlist and mirror-redact both hold about themselves.
+// It also means a future rename of the prior instance cannot quietly gut this test: the plant
+// follows the floor, rather than pinning a string that would stop matching.
+const TOKEN = PRIOR_INSTANCE_FLOOR.tokens[0];
+const OWNER = PRIOR_INSTANCE_FLOOR.owners[0];
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+console.log('\nthe planted literal makes the build refuse (no flag required):');
+
+t('a planted prior-instance token in a functional file is FATAL by default', () => {
+  const files = [{ path: 'src/some-module.js', content: `const host = "${TOKEN}";\n` }];
+  const scan = scanArtifactForLeaks(files);
+  assert.ok(scan.literalHits.length > 0, 'the scan must see the planted token');
+  const v = leakScanVerdict(scan.literalHits, ['node', 'package-core.js']);
+  assert.equal(v.run, true, 'the scan runs when no escape flag is passed');
+  assert.equal(v.fatal, true, 'THE LOAD-BEARING ASSERTION: a leak aborts the build with no flag');
+  assert.equal(v.reason, 'prior-instance-literals');
+});
+
+t('a planted prior-instance OWNER is fatal too, not just the token', () => {
+  const files = [{ path: 'scripts/thing.js', content: `// maintained by ${OWNER}\n` }];
+  const scan = scanArtifactForLeaks(files);
+  assert.ok(scan.literalHits.length > 0, 'the scan must see the planted owner');
+  assert.equal(leakScanVerdict(scan.literalHits, ['node', 'x']).fatal, true);
+});
+
+t('a clean artifact is NOT fatal (the gate does not fire on everything)', () => {
+  const files = [{ path: 'src/clean.js', content: 'const x = 1;\n' }];
+  const scan = scanArtifactForLeaks(files);
+  assert.equal(scan.literalHits.length, 0);
+  const v = leakScanVerdict(scan.literalHits, ['node', 'x']);
+  assert.equal(v.fatal, false);
+  assert.equal(v.reason, 'clean');
+});
+
+t('--leak-scan-strict is a no-op: it cannot be the thing that makes it fatal', () => {
+  const files = [{ path: 'src/some-module.js', content: `x = "${TOKEN}"\n` }];
+  const hits = scanArtifactForLeaks(files).literalHits;
+  const withFlag = leakScanVerdict(hits, ['node', 'x', '--leak-scan-strict']);
+  const without = leakScanVerdict(hits, ['node', 'x']);
+  assert.deepEqual(withFlag, without, 'strict must add nothing — fatal is the default now');
+});
+
+t('--no-leak-scan is the only escape, and it skips rather than downgrades', () => {
+  const files = [{ path: 'src/some-module.js', content: `x = "${TOKEN}"\n` }];
+  const hits = scanArtifactForLeaks(files).literalHits;
+  const v = leakScanVerdict(hits, ['node', 'x', '--no-leak-scan']);
+  assert.equal(v.run, false, 'the scan does not run at all');
+  assert.equal(v.fatal, false);
+  assert.equal(v.reason, 'skipped');
+});
+
+console.log('\nthe publish lane arms the gate (the half that was actually broken):');
+
+const publishYml = readFileSync(join(ROOT, '.github/workflows/publish.yml'), 'utf8');
+const packLine = publishYml.split('\n').find((l) => l.includes('package-core.js') && l.includes('--ref HEAD'));
+
+t('publish.yml still invokes package-core to build the release artifact', () => {
+  assert.ok(packLine, 'no package-core invocation found — the lane was rewired, re-check this test');
+});
+
+t('the publish invocation arms the leak gate explicitly', () => {
+  assert.ok(packLine.includes('--leak-scan-strict'),
+    'the publish lane must state the gate it depends on, even though fatal is the default');
+});
+
+t('nothing the publish lane RUNS disarms the leak scan', () => {
+  // Executable lines only: a YAML/shell comment may legitimately name the escape flag while
+  // explaining why the lane never uses it, and matching prose would fail on its own docs.
+  const executable = publishYml
+    .split('\n')
+    .filter((l) => !/^\s*#/.test(l))
+    .join('\n');
+  assert.ok(!executable.includes('--no-leak-scan'),
+    'the one lane that makes an artifact permanent and public must never skip the scan');
+});
+
+console.log(`\n${passed} passed, ${failed} failed\n`);
+if (failed) process.exit(1);

package/tests/package_core.mjs

@@ -16,7 +16,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import zlib from 'node:zlib';
 import crypto from 'node:crypto';
-import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 
@@ -385,18 +385,35 @@ t('buildPackageJson: prunes to express+pg+pino, keeps the source ranges + the un
   assert.equal(pkg.exports['./module-loader/loader'], './src/module-loader/loader.js');
   assert.equal(pkg.exports['./modules'], './src/modules.js');
   assert.equal(pkg.exports['./module-seams'], './src/module-seams.js');
-  // task 2089 / ADR 0134 — the synthesized package publishes PRIVATE by default.
-  assert.deepEqual(pkg.publishConfig, { access: 'restricted' });
+  // task 1003872 / ADR 0283 — the synthesized package publishes PUBLIC
+  // (superseding ADR 0134's pre-launch `restricted`).
+  assert.deepEqual(pkg.publishConfig, { access: 'public' });
 });
 
-t('publishArgs: private (restricted) publish, dry-run unless live (task 2089 / ADR 0134)', () => {
+t('publishArgs: public publish, dry-run unless live (task 1003872 / ADR 0283)', () => {
   const tgz = 'dist/bongos-core-1.14.0.tgz';
-  // Default: dry-run, restricted (never public, never a real upload).
-  assert.deepEqual(publishArgs(tgz, false), ['publish', tgz, '--access', 'restricted', '--dry-run']);
-  // Live: still restricted (private) — the permanent publish is never public here.
-  assert.deepEqual(publishArgs(tgz, true), ['publish', tgz, '--access', 'restricted']);
-  // Belt-and-suspenders: `--access public` must never appear on the pre-launch path.
-  assert.ok(!publishArgs(tgz, true).includes('public'));
+  // Default: dry-run — building must never be a real upload, whatever the access.
+  assert.deepEqual(publishArgs(tgz, false), ['publish', tgz, '--access', 'public', '--dry-run']);
+  assert.deepEqual(publishArgs(tgz, true), ['publish', tgz, '--access', 'public']);
+  // The posture is stated at the call site AND in publishConfig, so neither one
+  // drifting alone can silently take the package back to private.
+  assert.ok(!publishArgs(tgz, true).includes('restricted'));
+});
+
+// THE PUBLISH LANE IS THE PATH THAT ACTUALLY RUNS (task 1003872). package-core's
+// own `--publish` is the manual owner path; CI publishes the tarball itself, with
+// its own `--access` flag. Flipping only package-core.js would have left the real
+// releases restricted — the same shape as task 1003870, where the workflow did not
+// arm the gate its own header comment claimed.
+t('the publish workflow publishes PUBLIC, matching publishArgs', () => {
+  const yml = readFileSync(new URL('../.github/workflows/publish.yml', import.meta.url), 'utf8');
+  const m = yml.match(/npm publish "\$TGZ" --access (\w+)/);
+  assert.ok(m, 'publish.yml must publish the packaged tarball with an explicit --access');
+  assert.equal(m[1], 'public', 'the lane that actually releases must publish public, not restricted');
+  assert.ok(
+    !/--access restricted/.test(yml),
+    'no restricted publish may survive anywhere in the lane',
+  );
 });
 
 t('buildPackageJson: omits `overrides` when the source has none', () => {