@bongos/core 1.19.736 → 1.19.738

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.736",
-  "core_contract": "1.19.736",
-  "source_commit": "917ef53331537c93796fb9db9a8b77be72cffe22",
+  "core_version": "1.19.738",
+  "core_contract": "1.19.738",
+  "source_commit": "37a35be93e9879af0144594f30a8a894a84502f5",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T17:30:35.415Z",
+  "built_at": "2026-09-14T01:52:45.616Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 479,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2108,
+    "functional_verbatim": 2107,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2611,
-  "tree_sha256": "4cd2b02aa80c6f20919a54413b4983dd572af10e199bf5401e6e75ee8914b543",
+  "file_count": 2610,
+  "tree_sha256": "476bbdb5c1700b8ecf374a05e95a28bc6c61df721e5eb815c65439e08126feab",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2492,7 +2492,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8dc183ec4dc010d5897f8cca67dd0f55bb6abe5620e358388e9ed07a2f6521a8"
+      "sha256": "63fe92dfdaaacde0ba4dfb7882c97c6b875cd90d9b5f3dac0dacc404dbb1531f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2752,7 +2752,7 @@
     {
       "path": "docs/recipes/upgrading-the-core.md",
       "mode": "0000644",
-      "sha256": "36e3c53a8bbe0b987e19333f12cac4dc0951822686759623e3273843e313188e"
+      "sha256": "3691b017562bde760fbe3ff29a5efb80d886dd770f1187dc4673459871cec513"
     },
     {
       "path": "docs/recipes/windows-builders.md",
@@ -7537,12 +7537,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "014dc18dcf764c17d7927fe5475436f4d6e2acf18e7baa6f16b7852306dc89e0"
+      "sha256": "35ace7cf502387465f75cea83b1159bb82349d019555503f51769a264fd19c3e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "96f124d7dee1ff76d006c102798790ab7b59b27c0fbacdb36c545d658c185f39"
+      "sha256": "4fbaebd587863651e105d72ed373cef166d16eebd5f86a5d51395d98c33c5f60"
     },
     {
       "path": "public-docs/index.html",
@@ -8122,7 +8122,7 @@
     {
       "path": "scripts/gds/go-live.js",
       "mode": "0000644",
-      "sha256": "95c5109be4ab748c5ee59f22489ba5e3de45bafccf1c543d8cf174fc89d75dab"
+      "sha256": "f246947d973eec84ea174736bc87bf52b4716c939fc86bff4037b330f6790f9a"
     },
     {
       "path": "scripts/gds/goal-names.js",
@@ -8157,7 +8157,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "e81ab71bcd7d2f06b5aaf462dd099776c966f9840a109846a9753f12482b5281"
+      "sha256": "3879084ce7246d6fdcf3a053006e86e7d533016b6dbb9b5aa160d65a3e9336f5"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -8299,11 +8299,6 @@
       "mode": "0000644",
       "sha256": "d34cbccec1fa3053f960c1ac0950ce7e6b4b05f9d32a23304c4c3abc41c22ef7"
     },
-    {
-      "path": "scripts/gds/npmrc.js",
-      "mode": "0000644",
-      "sha256": "1beffeed111e8528cfa0a629d5ef81c766023de5c6820a81659a390070868228"
-    },
     {
       "path": "scripts/gds/oauth-secret.js",
       "mode": "0000644",
@@ -8362,17 +8357,22 @@
     {
       "path": "scripts/gds/provision-config.js",
       "mode": "0000644",
-      "sha256": "359674dd4ba6c7c4dd446882ec88f7d9feffd474300e17736d3129c2526082c1"
+      "sha256": "48d13ecda786629148713e0bd89f0d020ee47de107fa5a2327d44989783907ac"
     },
     {
       "path": "scripts/gds/provision-net.js",
       "mode": "0000644",
       "sha256": "502b1aeb571d463aea02ef4db3e848d23fdd8c865e7bfc37f66679c09cc203a9"
     },
+    {
+      "path": "scripts/gds/provision-repo-auth.js",
+      "mode": "0000644",
+      "sha256": "b08032667c9f06495c750e4dd8d41fdc2f5aa587093cf7b4de8e7a46390f0724"
+    },
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "3612ebe8f54da7498a6c4998e0d1d1c4596a80d54f70b5543b4a46dfca2ffbcf"
+      "sha256": "c5822f3b29f90998c831639df2b0925033f17758cc329609de507f5e6e1ad7c8"
     },
     {
       "path": "scripts/gds/provision-units.js",
@@ -8382,7 +8382,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "007c5cfa3b42567df0016038fc7ec5c7dbdab60ec6ec8ecd9d06386933e5641d"
+      "sha256": "614aa63d02f3ae97f39e492cb0948a92b40364e25f4780d87546b64c01e5c69c"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -8852,7 +8852,7 @@
     {
       "path": "scripts/gds/start.js",
       "mode": "0000644",
-      "sha256": "1bfa9d27bc91836f636f57466876d40c56e13bdb1038451e8298c8a32cb674d6"
+      "sha256": "7e4b7cd97e9a414cf55e1118c902b4ab17239d3810fe26e5b90aa18d6a948432"
     },
     {
       "path": "scripts/gds/status.js",
@@ -8897,12 +8897,12 @@
     {
       "path": "scripts/gds/update-channel.js",
       "mode": "0000644",
-      "sha256": "db54fba6065c8b662f574aa9443e686df4e5a152865342999b1f20d50ece01ed"
+      "sha256": "1aeeb6171244e1d42ee7189a3aa2ae5d83fd175bfe1ce89300d6ca7511819f0b"
     },
     {
       "path": "scripts/gds/upgrade.js",
       "mode": "0000644",
-      "sha256": "4f30ee3036846f449f6fc8143da32b3767376352743d373c39ace2f50f66e913"
+      "sha256": "7a82fb0cf919e14700ceba718e28da1324df2eab669a847348271c85b2f7bd66"
     },
     {
       "path": "scripts/gds/validate-design.js",
@@ -9342,7 +9342,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ad6748bac62f397b729ead21e7f591bc8e03fe771fff22855eb3813b066663da"
+      "sha256": "4c5bdcc7f30c8ae47bdb1ecb596b692bd6405a227fc895fa5bfcd33cd8f92340"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10432,7 +10432,7 @@
     {
       "path": "tests/executed_closure.mjs",
       "mode": "0000644",
-      "sha256": "8c0ed9407dd3f19dab03f45fd2778fae0d2a5595bcd0daefc0e3e5a63137aa04"
+      "sha256": "1e1a899e8838c7c84bdad9ea9d8533aca9173ed1e72f15e13c3616493e11900f"
     },
     {
       "path": "tests/explore_visible_states.mjs",
@@ -10562,7 +10562,7 @@
     {
       "path": "tests/go_live.mjs",
       "mode": "0000644",
-      "sha256": "2fc62d14a1c7e4fbd63fe4a18a4d1be85dfc481bc12a913cdd0d3812984bd79f"
+      "sha256": "fb937d66f8efa9fdcfb58715785a0c9d94e52034d04175aec78310c70bd53a7f"
     },
     {
       "path": "tests/goal_abuse_matrix.mjs",
@@ -11282,7 +11282,7 @@
     {
       "path": "tests/init.mjs",
       "mode": "0000644",
-      "sha256": "3026220335d63e157a1732d03ee6e66f0509bf965cb8676a651cbb3e1780be34"
+      "sha256": "945aaac204e9e60772d3e7b361c97c099d236e6be6b4b794cce36ecb391d8a1a"
     },
     {
       "path": "tests/instance_config.mjs",
@@ -11674,11 +11674,6 @@
       "mode": "0000644",
       "sha256": "c57c0211709ab041ee895bbb4ade9f4b146b43147570bf282e6d6a808560db76"
     },
-    {
-      "path": "tests/npmrc.mjs",
-      "mode": "0000644",
-      "sha256": "1aaa68ee1a4c4a58563cef86aac44cfa0e046ad7376d3a2108bf6dd455580942"
-    },
     {
       "path": "tests/oauth_secret.mjs",
       "mode": "0000644",
@@ -11977,7 +11972,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "0e177a4817094985e4aeec0c74883502762304d2174c1e13e77a87404b739088"
+      "sha256": "25fbd2adccf79e921c642f8f57b082f5f19fa01cd981cd5b813dc1070511aadb"
     },
     {
       "path": "tests/provision_restart.mjs",
@@ -12697,7 +12692,7 @@
     {
       "path": "tests/start_env_guard.mjs",
       "mode": "0000644",
-      "sha256": "9b0a7d7aeb761cb6fb0c5e1ae650e0848af12e92887ebd630814b35b434c1f41"
+      "sha256": "dd7171dbc59e024de99a063763219237814cf4c943fb3d873cc324f3bfde7f25"
     },
     {
       "path": "tests/start_rebase_warning.mjs",
@@ -12917,7 +12912,7 @@
     {
       "path": "tests/upgrade.mjs",
       "mode": "0000644",
-      "sha256": "492b9dc7efdd6f63b81f1662d5fdc9a7541b7f8ccc6c0ec77a456ad3f574ee74"
+      "sha256": "def73ab0f532c04df167d77917981eaf7e0dc7e1d2a7e7c85f3f962d7d65ce2a"
     },
     {
       "path": "tests/upgrade_persist_pin.mjs",

package/docs/module-api-changelog.md

@@ -1946,5 +1946,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.734 with no explicit bump. run 34768136326. (task 1002620)
   1.19.736 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.735 with no explicit bump. run 34771773838. (task 1002620)
+  1.19.737 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.736 with no explicit bump. run 34795026282. (task 1002620)
+  1.19.738 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.737 with no explicit bump. run 34797297122. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/upgrading-the-core.md

@@ -108,7 +108,7 @@ node .claude/scheduled-tasks/core-update-subscription/subscribe.js            #
 node .claude/scheduled-tasks/core-update-subscription/subscribe.js --apply    # upgrade
 ```
 
-Each subscribed instance: read its installed core → ask the registry (`npm view`, needs `NPM_TOKEN`) → resolve the newest version its channel permits → if newer, `bongos upgrade --to <v> --registry` with **auto-rollback ON**. It prints one line per instance plus a tally; a non-zero exit means an upgrade failed (already auto-reverted).
+Each subscribed instance: read its installed core → ask the registry (`npm view`, no credential needed — the package is public) → resolve the newest version its channel permits → if newer, `bongos upgrade --to <v> --registry` with **auto-rollback ON**. It prints one line per instance plus a tally; a non-zero exit means an upgrade failed (already auto-reverted).
 
 **Triple-gated, so nothing moves by accident:** the `core-update-subscription` routine is `requiresAutonomy: true` + **default OFF** in [`config/scheduled-routines.json`](../../config/scheduled-routines.json), the roster ships empty, and every upgrade is health-gated. Arm it by enabling the routine's timer on the control plane once autonomy is on.
 
@@ -116,7 +116,8 @@ Each subscribed instance: read its installed core → ask the registry (`npm vie
 
 ## Gotchas
 
-- **`--registry` no longer needs a hand-exported `NPM_TOKEN`** (task 1002754). The instance `.npmrc` reads `_authToken=<redacted>, and npm gives that per-project key precedence — so with the env var unset it expanded EMPTY and **masked a perfectly valid literal token in `~/.npmrc`** (npm went anonymous; the private core 404'd; the error blamed a "missing" credential the box actually held). `bongos upgrade --registry` now resolves the credential itself: env `NPM_TOKEN` wins, else the **user-level `~/.npmrc`'s literal `//registry.npmjs.org/:_authToken=…`** is injected into the install's environment (forward install and rollback reinstall both). A pin bump on a box whose `~/.npmrc` authenticates therefore succeeds with **no exported env var**. Resolver: `resolveNpmToken()` in [`scripts/gds/npmrc.js`](../../scripts/gds/npmrc.js).
+- **`--registry` needs no credential at all** (task 1003878). `@bongos/core` is **public** on npm (task 1003872), so `bongos upgrade --registry` resolves it from the default registry like any other dependency — no token, no login, and no instance `.npmrc`. An install failure on this path is therefore a *real* failure (network, registry outage, or a version that was never published), never a missing credential.
+  *History, so the symptom is recognisable on an old instance:* the core used to publish private, and the instance `.npmrc` read `_authToken=<redacted> npm gives that per-project key precedence, so with the env var unset it expanded EMPTY and **masked a perfectly valid literal token in `~/.npmrc`** — npm went anonymous, the private core 404'd, and the error blamed a credential the box actually held. Task 1002754 worked around it by resolving the token in-process; task 1003878 deleted the whole mechanism along with the `.npmrc` that caused it. An instance still carrying a committed `.npmrc` from a pre-1003878 scaffold can safely delete it.
 - **A green `publish` run is not evidence of a publish.** The publish-on-merge lane succeeds on its no-op paths too (cascade terminator, armed-gate). Read the run's **job summary**, which now states the verdict explicitly: `PUBLISHED @bongos/core@<v>` vs `NO-OP — nothing was published this run`.
 - **`PGDATABASE` is load-bearing on a co-tenant droplet.** `migrate.sh` defaults `PGDATABASE` to `example` — **production**. Always set `PGDATABASE=<instance-db>` explicitly, or you migrate the wrong database.
 - **The health check polls the restart** (fixed in task [#1984](https://example.com/builders#/task/1984)). The service binds its port ~1s after `systemctl restart`, so `--health-url` now polls up to ~30s for a 2xx before reporting a warning — an immediate `fetch failed` no longer means a failed upgrade. (Pre-1984 cores fetched once and spuriously reported `fetch failed`; there, confirm with `is-active` + a manual `curl`.)

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.736",
+  "version": "1.19.738",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.736",
+      "version": "1.19.738",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.736",
+  "version": "1.19.738",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/go-live.js

@@ -84,7 +84,7 @@ function isSafeToken(v) {
 // unit name that the script would then try to `systemctl stop`. Absent, the stop and
 // the restart are simply skipped: there is no `reset --hard` to race.
 const REQUIRED_FIELDS = ['instanceDir', 'service', 'healthUrl', 'versionUrl'];
-const OPTIONAL_FIELDS = ['ssh', 'local', 'deployTimer', 'deployService', 'npmEnvFile', 'runAs', 'backupDb', 'backupDir', 'env', 'registryPackage', 'pinMode'];
+const OPTIONAL_FIELDS = ['ssh', 'local', 'deployTimer', 'deployService', 'runAs', 'backupDb', 'backupDir', 'env', 'registryPackage', 'pinMode'];
 
 // How the bump is made durable — the other half of co-tenant mode (task 1003521).
 //
@@ -153,7 +153,6 @@ const CONFIG_TEMPLATE = `{
       "versionUrl": "http://127.0.0.1:3002/version",    // box-side truth read back after
       "deployTimer": "my-deploy.timer",                 // optional: pull-deploy timer (its reset --hard is the hazard)
       "deployService": "my-deploy.service",             // optional: forced tick proves the pin stuck
-      "npmEnvFile": "/etc/my/npm.env",                  // optional: root-only NPM_TOKEN for a PRIVATE package
       "runAs": "me",                                    // optional: unprivileged owner of the instance
       "backupDb": "mydb",                               // optional: pg_dump before the bump
       "backupDir": "~/backups",
@@ -247,40 +246,19 @@ function remote(target, script, { run = spawnSync, timeoutMs = 900000 } = {}) {
 // `sudo -u <user> -H env K=V … <cmd>` — the shape every runbook entry uses. Returns
 // a string safe to embed because every component was allowlist-validated.
 //
-// A privileged child needs npm auth, and there is NO WAY to hand it a secret through
-// sudo without logging it (task 1003218, corrected).
-//
-//   `env NPM_TOKEN="$NPM_TOKEN" …`     → sudo logs it in COMMAND=
-//   `sudo --preserve-env=NPM_TOKEN …`  → sudo logs it in ENV=
-//
-// The first was the original bug; the second was my "fix", which only MOVED the value
-// to a different field of the same log line. Both put a live credential in a
-// persistent journal. What matters is that sudo logs its whole invocation, so the
-// secret must never be part of it.
-//
-// So the child DERIVES the token itself, from a file it can already read. Only the
-// `sed` appears in argv; the value never does. This is the shape docs/recipes/
-// core-release-pipeline.md already documents as the safe one. The guard matters as
-// much as the derivation: an EMPTY token silently sends npm to the public registry,
-// which 404s the private package, which auto-rolls-back "cleanly" having taught you
-// nothing — so an empty read aborts loudly instead of half-running.
-//
-// (The nightly lane never takes this path: it runs under systemd as the owner with an
-// EnvironmentFile, no sudo, and leaks nothing. This is the manual/agent path only.)
-const NPM_AUTH_PREAMBLE = [
-  'export NPM_TOKEN="${NPM_TOKEN:-$(sed -n \'s/.*_authToken=//p\' "$HOME/.npmrc" 2>/dev/null | head -1)}"',
-  '[ -n "$NPM_TOKEN" ] || { echo "go-live: EMPTY NPM_TOKEN — npm would 404 the private core and roll back; aborting" >&2; exit 12; }',
-].join('; ');
-
 // `sudo -u <user> -H env K=V … <cmd>` — the shape every runbook entry uses. Returns
 // a string safe to embed because every component was allowlist-validated.
 //
-// `needsNpm` wraps the command so it derives its own npm auth (see above) instead of
-// having a secret handed across the privilege boundary. Only NON-secret configuration
-// (PGDATABASE, HOME) travels in the plain `env K=V` list — seeing those in a log is
-// useful rather than harmful.
-function asOwner(target, cmd, { needsNpm = false } = {}) {
-  const inner = needsNpm ? `sh -c ${shq(`${NPM_AUTH_PREAMBLE}; ${cmd}`)}` : cmd;
+// Only NON-secret configuration (PGDATABASE, HOME) travels in the plain `env K=V` list —
+// seeing those in a log is useful rather than harmful.
+//
+// This used to take a `needsNpm` option wrapping the command in a preamble that DERIVED an
+// npm credential on the far side, because sudo logs its whole invocation and there was no way
+// to hand a privileged child a secret without journalling it (task 1003218). @bongos/core is
+// public (task 1003872), so the deploy path needs no npm credential at all and the whole
+// hazard is gone rather than mitigated (task 1003878).
+function asOwner(target, cmd) {
+  const inner = cmd;
   const envPairs = Object.entries(target.env || {}).map(([k, v]) => `${k}=${v}`);
   if (!target.runAs) {
     const joined = envPairs.join(' ');
@@ -622,23 +600,21 @@ function renderReport(r) {
 // Phases
 // ---------------------------------------------------------------------------
 
-// Registry proof + optional content proof, in ONE round-trip. The registry is
-// consulted ON THE BOX because a PRIVATE package 404s without the root-only
-// NPM_TOKEN, and because the box's answer is the one that matters.
+// Registry proof + optional content proof, in ONE round-trip. The registry is still
+// consulted ON THE BOX — not because auth lives there (the package is public now), but
+// because the box's answer is the one that matters: its network, its resolver, its cache.
 function probeRemote(target, targetVersion, marker, opts = {}) {
   const pkg = target.registryPackage || '@bongos/core';
-  const src = target.npmEnvFile ? `set -a; . ${target.npmEnvFile}; set +a` : 'true';
   const script = `
 set -uo pipefail
-${src}
 echo "##REGISTRY##"
-${asOwner(target, `npm view ${pkg}@${targetVersion} version`, { needsNpm: true })} 2>&1 | tail -1
+${asOwner(target, `npm view ${pkg}@${targetVersion} version`)} 2>&1 | tail -1
 echo "##TREE##"
 ( cd ${target.instanceDir} && ${target.runAs ? `sudo -u ${target.runAs} -H ` : ''}git status --porcelain | head -20 )
 echo "##INSTALLED##"
 ${asOwner(target, `node -e "console.log(require('${target.instanceDir}/node_modules/${pkg}/package.json').version)"`)} 2>&1 | tail -1
 ${marker ? `echo "##MARKER##"
-${asOwner(target, `sh -c ${shq(markerProbe(pkg, targetVersion, marker))}`, { needsNpm: true })}` : ''}
+${asOwner(target, `sh -c ${shq(markerProbe(pkg, targetVersion, marker))}`)}` : ''}
 echo "##END##"
 `;
   const res = remote(target, script, opts);
@@ -709,7 +685,6 @@ function applyGoLive(target, targetName, targetVersion, from, opts = {}) {
   const pkg = target.registryPackage || '@bongos/core';
   const pinMode = pinModeOf(target);
   const steps = [];
-  const src = target.npmEnvFile ? `set -a; . ${target.npmEnvFile}; set +a` : 'true';
 
   // Phase A — stop the pull-deploy timer, then back up. The timer's `reset --hard`
   // is the hazard: it would revert an uncommitted pin mid-flight. A co-tenant has no
@@ -738,8 +713,7 @@ echo "##END##"
   const upgrade = upgradeCommand(target, targetVersion);
   const phaseB = remote(target, `
 set -uo pipefail
-${src}
-${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade}"`, { needsNpm: true })}
+${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade}"`)}
 `, opts);
   const rolledBack = /rolled back/i.test(phaseB.stdout + phaseB.stderr);
   steps.push({
@@ -995,7 +969,7 @@ if (require.main === module) {
 module.exports = {
   loadConfig, selectTarget, validateTarget, planGoLive, artistGateEntries, readArtistGate, ARTIST_GATE_PATH, ARTIST_GATE_LEVELS,
   parseMarker, parseMarkerHits,
-  renderPlan, renderReport, failureExcerpt, asOwner, isSafeToken, NPM_AUTH_PREAMBLE, refreshMain, isLocalTarget, gitRefExists, SUDO_PREAMBLE,
+  renderPlan, renderReport, failureExcerpt, asOwner, isSafeToken, refreshMain, isLocalTarget, gitRefExists, SUDO_PREAMBLE,
   applyGoLive, upgradeCommand, pinStep, pinModeOf,
   CONFIG_TEMPLATE, HALTS, SEMVER_RE, PIN_MODES, DEFAULT_PIN_MODE,
 };

package/scripts/gds/init.js

@@ -59,13 +59,13 @@
 //   bongos init --vendor-core <tgz>   greenfield only: vendor the @bongos/core .tgz + pin
 //                                       package.json to file:vendor/… + generate package-lock.json,
 //                                       so the scaffold is `npm ci`-installable (ADR 0108 gap 1/4).
-//                                       Without it the scaffold pins the caret range (which now
-//                                       resolves from the PRIVATE registry — see --registry-core).
-//   bongos init --registry-core       greenfield only: keep the caret pin + write an env-fed
-//                                       .npmrc (`_authToken=${NPM_TOKEN}`) so `npm ci` pulls the
-//                                       PRIVATE @bongos/core from the npm registry (ADR 0134).
-//                                       With NPM_TOKEN set it also generates package-lock.json;
-//                                       without a token it 404s (the expected tokenless outcome).
+//                                       Without it the scaffold pins the caret range, which
+//                                       resolves from the public npm registry (--registry-core).
+//   bongos init --registry-core       greenfield only: keep the caret pin and generate
+//                                       package-lock.json from the registry. @bongos/core is
+//                                       PUBLIC (task 1003872), so this needs no token, no login
+//                                       and no .npmrc — it resolves from the default registry
+//                                       like any other dependency.
 //                                       Mutually exclusive with --vendor-core (registry vs tarball).
 
 const fs = require('node:fs');
@@ -78,7 +78,6 @@ const { materializeClaude } = require('./claude-materialize'); // ADR 0108 §3 (
 const { detectStack, formatStackSummary } = require('./adopt-detect'); // ADR 0121 §Decision 4 (task 2043): inspect an existing repo before layering
 const { resolveBacklogTasks, DEFAULT_MAX: BACKLOG_MAX } = require('./adopt-import'); // ADR 0121 §Decision 3 (task 2044): import an existing backlog
 const { preflightAdopt, formatPreflight } = require('./adopt-preflight'); // ADR 0121 §Decision 5 (task 2045): the accept-gated conflict pre-flight
-const { writeNpmrc, hasNpmToken } = require('./npmrc'); // ADR 0134 (task 2090): the registry-install path's env-fed .npmrc
 
 const KNOWN_MODULES = ['game', 'art-pipeline', 'discord', 'dev-box'];
 
@@ -946,7 +945,7 @@ async function main(argv) {
   const adopt = hasFlag('--adopt', args); // brownfield: LAYER onto an existing repo (ADR 0121)
   const accept = hasFlag('--accept', args) || hasFlag('--yes', args) || hasFlag('-y', args); // adopt pre-flight accept-gate (§Decision 5)
   const vendorCore = arg('--vendor-core', args); // greenfield: vendor + file:-pin a core .tgz, then generate the lockfile (ADR 0108 gap 1/4, task 2053)
-  const registryCore = hasFlag('--registry-core', args); // greenfield: caret pin + env-fed .npmrc → `npm ci` pulls the PRIVATE core from the registry (ADR 0134, task 2090)
+  const registryCore = hasFlag('--registry-core', args); // greenfield: keep the caret pin and generate the lockfile from the public registry (task 1003878)
 
   if (adopt && force) {
     console.error('init: --force is a greenfield-only overwrite; --adopt never overwrites, so --force is ignored.');
@@ -1030,30 +1029,23 @@ async function main(argv) {
     }
   }
 
-  // Registry-install path (ADR 0134, task 2090): keep the caret pin writeConfigs wrote
-  // and add an env-fed .npmrc so `npm ci` pulls the PRIVATE @bongos/core from the
-  // registry. With NPM_TOKEN present we also generate package-lock.json (a reproducible
-  // `npm ci` later); without a token we still write the caret pin + .npmrc so the
-  // scaffold is registry-shaped, and say plainly that the private package 404s until a
-  // token is provided — the expected tokenless outcome the ADR calls to verify.
+  // Registry-install path: keep the caret pin writeConfigs wrote and generate
+  // package-lock.json from the registry, so a later `npm ci` is reproducible.
+  //
+  // This used to write an env-fed npm auth file and skip the lockfile when no credential was
+  // present, because @bongos/core published PRIVATE. It is public now (task 1003872), so it
+  // resolves from the default registry like any other dependency: no auth file, no credential,
+  // and no tokenless-404 branch to explain (task 1003878).
   if (registryCore) {
     if (dryRun) {
-      console.log(`\n[dry-run] would write .npmrc (env-fed @bongos auth) and ${hasNpmToken()
-        ? 'run `npm install` to generate package-lock.json from the registry'
-        : 'SKIP lockfile generation (no NPM_TOKEN — the private core 404s until one is provided)'}`);
+      console.log('\n[dry-run] would run `npm install` to generate package-lock.json from the registry');
     } else {
-      console.log('\nWiring the registry-install path (ADR 0134):');
-      writeNpmrc(dir, { log: console.log });
-      if (hasNpmToken()) {
-        const inst = upgrade.npmInstall(dir);
-        if (!inst.ok) {
-          console.error(`  ! npm install failed (${inst.reason || 'exit ' + inst.code}) — confirm NPM_TOKEN reaches the private @bongos org; package-lock.json not generated.`);
-        } else {
-          console.log('  ✓ npm install → package-lock.json generated (pulled @bongos/core from the registry)');
-        }
+      console.log('\nWiring the registry-install path:');
+      const inst = upgrade.npmInstall(dir);
+      if (!inst.ok) {
+        console.error(`  ! npm install failed (${inst.reason || 'exit ' + inst.code}) — package-lock.json not generated. @bongos/core is public, so this is a real failure (network, registry outage, or an unpublished version), not a missing credential.`);
       } else {
-        console.log('  • no NPM_TOKEN in the environment — wrote the caret pin + .npmrc but skipped lockfile generation.');
-        console.log('    Provide a read-only automation token (paid `bongos` org) as NPM_TOKEN before `npm ci`; without it the private package 404s cleanly.');
+        console.log('  ✓ npm install → package-lock.json generated (pulled @bongos/core from the registry)');
       }
     }
   }

package/scripts/gds/provision-config.js

@@ -19,12 +19,6 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 // plain require (its require.main guard means importing it runs no CLI).
 const oauthSecret = require('./oauth-secret');
 
-// The registry-install gates + env-fed .npmrc (ADR 0134, task 2090). Lets the
-// standalone scaffold OPT IN to pulling the PRIVATE @bongos/core from the npm
-// registry (PROVISION_CORE_FROM_REGISTRY=1) instead of vendoring a tarball, with a
-// fail-soft fallback to the vendored path when no NPM_TOKEN is present.
-const { registryCoreRequested, hasNpmToken } = require('./npmrc');
-
 // The HTTP User-Agent the manifest conversion stamps its GitHub call with (GitHub
 // requires a UA). Overridable so a fork can identify itself; not secret.
 const MANIFEST_UA = process.env.PROVISION_GITHUB_UA || 'cloudbongos-provisioner';
@@ -195,10 +189,8 @@ module.exports = {
   REPO_ROOT,
   coreVersionSafe,
   hasFlag,
-  hasNpmToken,
   loadDeps,
   numEnv,
   oauthSecret,
   provisionerBotEmail,
-  registryCoreRequested,
 };

package/scripts/gds/provision-repo-auth.js

@@ -0,0 +1,106 @@
+// scripts/gds/provision-repo-auth.js — the repo-identity + owner-credential leaf: parse a
+// `target_ref` into { owner, name }, build an instance's SSH deploy remote, find the
+// provisioning row that owns a checkout, and read that owner's stored GitHub token
+// (task 1003081).
+//
+// WHY THIS FILE EXISTS AT ALL. scripts/gds/upgrade.js is inside the merge resolver's
+// EXECUTED CLOSURE (modules/lifecycle/executed-closure.js; 2026-08-29 security audit ref
+// B1) — the set of files the server may run out of a CLONED BUILDER BRANCH. That closure
+// is a STATIC walk of string-literal requires, and it does not care whether a require is
+// lazy or inside a function: upgrade.js reaching these helpers through `./provision`
+// dragged provision.js plus provision-config/-repo/-units/-net.js into the closure with
+// it — five more files a branch could edit into the live server's process, three of them
+// carrying computed requires (provision-config 7, provision-repo 1, provision-units 1)
+// that tests/executed_closure.mjs has no account of. Carving the helpers into this LEAF
+// instead grows the closure by exactly ONE small file, whose computed-require count is
+// pinned in that test.
+//
+// THE RULE THAT KEEPS IT THAT WAY. Top level requires node builtins ONLY. Every
+// non-builtin require is lazy AND inside a function body, so nothing on the generator
+// path ever resolves it. Never require provision-config.js (or any other provision file)
+// from here — REPO_ROOT is recomputed below precisely so we don't have to.
+//
+// provision-repo.js requires this module and re-exports parseTargetRef,
+// instanceRepoRemote and resolveOwnerGithubToken unchanged, so provision.js,
+// provision-units.js, modules/provisioning/credential-preflight.js and their tests see
+// exactly the surface they saw before.
+
+'use strict';
+
+const path = require('node:path');
+
+// The same value provision-config.js exports as REPO_ROOT, recomputed here rather than
+// imported: that module carries seven computed requires, and importing it would put all
+// of them inside the executed closure (see the header).
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+
+// Parse an 'owner/repo' (or a github SSH/HTTPS URL) target_ref → { owner, name }.
+// Null when unparseable, so the scaffold can fail with actionable guidance.
+function parseTargetRef(ref) {
+  const m = String(ref || '').trim()
+    .replace(/^git@[^:]+:/, '')
+    .replace(/^https?:\/\/[^/]+\//, '')
+    .match(/^([A-Za-z0-9][A-Za-z0-9_.-]*)\/([A-Za-z0-9][A-Za-z0-9_.-]*?)(?:\.git)?$/);
+  return m ? { owner: m[1], name: m[2] } : null;
+}
+
+// The git remote for an instance's OWN repo. Reuses the SAME SSH deploy alias the
+// control-plane checkout uses (git@<alias>:<owner>/<repo>.git) — NO secret in the
+// command (SSH-key auth, nothing to leak into journald), consistent with how the
+// platform repo is wired. Standing up a new instance repo therefore needs only that
+// the control plane's deploy key has WRITE access to that repo (ADR 0125). Alias is
+// overridable via PROVISION_GIT_SSH_ALIAS.
+function instanceRepoRemote(repo, { sshAlias = process.env.PROVISION_GIT_SSH_ALIAS || 'github-deploy' } = {}) {
+  return `git@${sshAlias}:${repo.owner}/${repo.name}.git`;
+}
+
+// The instance owner's stored `repo`-scoped OAuth token (ADR 0155), or null (none
+// stored, org-owned repo, secret-box off). Shared by the scaffold push, the
+// private-repo deploy-key wiring, the teardown revoke, and upgrade.js's pin push.
+// `deps.getGithubToken` is injectable for tests; production resolves it lazily against
+// the core db slice with the runner's pool.
+async function resolveOwnerGithubToken(inst, deps, { tag = '[repo-auth]' } = {}) {
+  if (!inst.owner_builder_id) return null;
+  try {
+    const fetchTok = deps.getGithubToken
+      || ((bid) => require(path.join(REPO_ROOT, 'src/bongos/db')).getGithubToken({ builderId: bid, p: deps.db })); // eslint-disable-line global-require
+    const r = await fetchTok(inst.owner_builder_id);
+    return r && r.token ? r.token : null;
+  } catch (e) {
+    (deps.log || (() => {}))(`  ${tag} owner OAuth token lookup failed (${e && e.message})`);
+    return null;
+  }
+}
+
+// The provisioning row that owns a checkout — where `owner_builder_id` (whose token) and
+// `target_ref` (which repo) come from. A control-plane caller hands it over as
+// `deps.instance`; a CLI run on the control plane (`--instance /srv/bongos/<slug>`) finds
+// it by the checkout's basename, which standaloneRoot makes the slug. An instance's own
+// database has no provisioning table and answers null — that is the origin path, not an
+// error, so every failure here is swallowed. The default lookup requires the core pool
+// in-process (a CLI run exits right after; a programmatic caller passes `deps.db` or
+// `deps.getInstanceBySlug`).
+//
+// It lives HERE rather than in its only caller, upgrade.js: both of its default requires
+// are computed, and upgrade.js is in the executed closure with a pinned count of its own
+// (see the header). Keeping them on this side leaves upgrade.js string-literal-only.
+async function lookupInstanceRow(instanceDir, deps = {}) {
+  if (deps.instance) return deps.instance;
+  const slug = path.basename(instanceDir);
+  try {
+    const bySlug = deps.getInstanceBySlug || (async (s) => {
+      const provisioning = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
+      const db = deps.db || require(path.join(REPO_ROOT, 'src/bongos/pool')).pool; // eslint-disable-line global-require
+      return provisioning.getInstanceBySlug(db, s);
+    });
+    const row = await bySlug(slug);
+    return row && row.owner_builder_id && row.target_ref ? row : null;
+  } catch { return null; }
+}
+
+module.exports = {
+  instanceRepoRemote,
+  lookupInstanceRow,
+  parseTargetRef,
+  resolveOwnerGithubToken,
+};