@bongos/core 1.19.737 → 1.19.739

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.737",
-  "core_contract": "1.19.737",
-  "source_commit": "1ceb8f6a2ad0321079098910ad8a721dffa67454",
+  "core_version": "1.19.739",
+  "core_contract": "1.19.739",
+  "source_commit": "007654ffe674e9720a1e9227b87dc010b35178d9",
   "source_ref": "HEAD",
-  "built_at": "2026-09-14T01:10:42.991Z",
+  "built_at": "2026-09-14T11:30:11.483Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 479,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2109,
+    "functional_verbatim": 2107,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2612,
-  "tree_sha256": "c34cdc2f87b36f12f71f276e47ce740238e94841fab60b4245613189e0c527d2",
+  "file_count": 2610,
+  "tree_sha256": "387827a54efbdc59d0986629636d11366a72c83e8518a3f621bfffe13e020b61",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2492,7 +2492,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d1b64255f150e8c8a1b88cffa7326633b7e5bc22e22744f7b1d9ee47410f9e13"
+      "sha256": "e1e65fc287020112074f69a451cba3e80b6c6e04ab746404c7a0db44f95f1c46"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2702,7 +2702,7 @@
     {
       "path": "docs/recipes/private-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "33e4f7f3083b8ac5d10f117d4d93e78b9d8b7b4d082087051b69698cb67b03b1"
+      "sha256": "6d488eff1dd8201debb991ba854c59b5404235b1a433403dbedecaf0638128e4"
     },
     {
       "path": "docs/recipes/redteam-patrol.md",
@@ -2752,7 +2752,7 @@
     {
       "path": "docs/recipes/upgrading-the-core.md",
       "mode": "0000644",
-      "sha256": "36e3c53a8bbe0b987e19333f12cac4dc0951822686759623e3273843e313188e"
+      "sha256": "3691b017562bde760fbe3ff29a5efb80d886dd770f1187dc4673459871cec513"
     },
     {
       "path": "docs/recipes/windows-builders.md",
@@ -7537,12 +7537,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "fc4587a7fbaaa14aad1e0296015adb626e89da62f4a90a95647f1bbb55a61f1e"
+      "sha256": "f49b1b8e922b2717a695ddb091d8cb8e4f574634f2d6b57cb888a7a4dc7d38b0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d7595c39c515821f76d0b5045c3a9cbb400f2c36a663046d19dfc7cab098cf69"
+      "sha256": "7f2a45d17d4d9dadcf80e5da376e648e607de28b3b8150fea3120e1dd4a3fee4"
     },
     {
       "path": "public-docs/index.html",
@@ -8122,7 +8122,7 @@
     {
       "path": "scripts/gds/go-live.js",
       "mode": "0000644",
-      "sha256": "95c5109be4ab748c5ee59f22489ba5e3de45bafccf1c543d8cf174fc89d75dab"
+      "sha256": "f246947d973eec84ea174736bc87bf52b4716c939fc86bff4037b330f6790f9a"
     },
     {
       "path": "scripts/gds/goal-names.js",
@@ -8157,7 +8157,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "e81ab71bcd7d2f06b5aaf462dd099776c966f9840a109846a9753f12482b5281"
+      "sha256": "3879084ce7246d6fdcf3a053006e86e7d533016b6dbb9b5aa160d65a3e9336f5"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -8299,11 +8299,6 @@
       "mode": "0000644",
       "sha256": "d34cbccec1fa3053f960c1ac0950ce7e6b4b05f9d32a23304c4c3abc41c22ef7"
     },
-    {
-      "path": "scripts/gds/npmrc.js",
-      "mode": "0000644",
-      "sha256": "1beffeed111e8528cfa0a629d5ef81c766023de5c6820a81659a390070868228"
-    },
     {
       "path": "scripts/gds/oauth-secret.js",
       "mode": "0000644",
@@ -8332,7 +8327,7 @@
     {
       "path": "scripts/gds/package-core.js",
       "mode": "0000644",
-      "sha256": "89ec2a080f397e1af5c0dede40a7eb22a2e3343d219da4b4a4ba903337bcc420"
+      "sha256": "d9a6748c0dadbff9954809df1c83345979e1356559312723e107f19949edfd7b"
     },
     {
       "path": "scripts/gds/paste-token.js",
@@ -8362,7 +8357,7 @@
     {
       "path": "scripts/gds/provision-config.js",
       "mode": "0000644",
-      "sha256": "359674dd4ba6c7c4dd446882ec88f7d9feffd474300e17736d3129c2526082c1"
+      "sha256": "48d13ecda786629148713e0bd89f0d020ee47de107fa5a2327d44989783907ac"
     },
     {
       "path": "scripts/gds/provision-net.js",
@@ -8377,7 +8372,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "77ca585d99f4058427f1abbe629d66ce5ec9f87b6c974aebc114d1c0e734d8e2"
+      "sha256": "c5822f3b29f90998c831639df2b0925033f17758cc329609de507f5e6e1ad7c8"
     },
     {
       "path": "scripts/gds/provision-units.js",
@@ -8387,7 +8382,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "007c5cfa3b42567df0016038fc7ec5c7dbdab60ec6ec8ecd9d06386933e5641d"
+      "sha256": "614aa63d02f3ae97f39e492cb0948a92b40364e25f4780d87546b64c01e5c69c"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -8857,7 +8852,7 @@
     {
       "path": "scripts/gds/start.js",
       "mode": "0000644",
-      "sha256": "1bfa9d27bc91836f636f57466876d40c56e13bdb1038451e8298c8a32cb674d6"
+      "sha256": "7e4b7cd97e9a414cf55e1118c902b4ab17239d3810fe26e5b90aa18d6a948432"
     },
     {
       "path": "scripts/gds/status.js",
@@ -8902,12 +8897,12 @@
     {
       "path": "scripts/gds/update-channel.js",
       "mode": "0000644",
-      "sha256": "db54fba6065c8b662f574aa9443e686df4e5a152865342999b1f20d50ece01ed"
+      "sha256": "1aeeb6171244e1d42ee7189a3aa2ae5d83fd175bfe1ce89300d6ca7511819f0b"
     },
     {
       "path": "scripts/gds/upgrade.js",
       "mode": "0000644",
-      "sha256": "64b2571770a5be9dc046f6c64adf45a09642c6961a6036c9405e1c933be6c3b7"
+      "sha256": "7a82fb0cf919e14700ceba718e28da1324df2eab669a847348271c85b2f7bd66"
     },
     {
       "path": "scripts/gds/validate-design.js",
@@ -9347,7 +9342,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9ad95d6241cc8f3dfda5d02445246c1f7fd62b75b5014a15a9254c15a620aef7"
+      "sha256": "778ccc0ac1fe12d16e101aad85011d19d8fab03f00fa42fce71a26ec9b600fe2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10567,7 +10562,7 @@
     {
       "path": "tests/go_live.mjs",
       "mode": "0000644",
-      "sha256": "2fc62d14a1c7e4fbd63fe4a18a4d1be85dfc481bc12a913cdd0d3812984bd79f"
+      "sha256": "fb937d66f8efa9fdcfb58715785a0c9d94e52034d04175aec78310c70bd53a7f"
     },
     {
       "path": "tests/goal_abuse_matrix.mjs",
@@ -11287,7 +11282,7 @@
     {
       "path": "tests/init.mjs",
       "mode": "0000644",
-      "sha256": "3026220335d63e157a1732d03ee6e66f0509bf965cb8676a651cbb3e1780be34"
+      "sha256": "945aaac204e9e60772d3e7b361c97c099d236e6be6b4b794cce36ecb391d8a1a"
     },
     {
       "path": "tests/instance_config.mjs",
@@ -11679,11 +11674,6 @@
       "mode": "0000644",
       "sha256": "c57c0211709ab041ee895bbb4ade9f4b146b43147570bf282e6d6a808560db76"
     },
-    {
-      "path": "tests/npmrc.mjs",
-      "mode": "0000644",
-      "sha256": "1aaa68ee1a4c4a58563cef86aac44cfa0e046ad7376d3a2108bf6dd455580942"
-    },
     {
       "path": "tests/oauth_secret.mjs",
       "mode": "0000644",
@@ -11982,7 +11972,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "0e177a4817094985e4aeec0c74883502762304d2174c1e13e77a87404b739088"
+      "sha256": "25fbd2adccf79e921c642f8f57b082f5f19fa01cd981cd5b813dc1070511aadb"
     },
     {
       "path": "tests/provision_restart.mjs",
@@ -12702,7 +12692,7 @@
     {
       "path": "tests/start_env_guard.mjs",
       "mode": "0000644",
-      "sha256": "9b0a7d7aeb761cb6fb0c5e1ae650e0848af12e92887ebd630814b35b434c1f41"
+      "sha256": "dd7171dbc59e024de99a063763219237814cf4c943fb3d873cc324f3bfde7f25"
     },
     {
       "path": "tests/start_rebase_warning.mjs",
@@ -12922,7 +12912,7 @@
     {
       "path": "tests/upgrade.mjs",
       "mode": "0000644",
-      "sha256": "010c9ac8b05e25c10b9d43c7efd02454facf0d5663df11df555ea913697e23e8"
+      "sha256": "def73ab0f532c04df167d77917981eaf7e0dc7e1d2a7e7c85f3f962d7d65ce2a"
     },
     {
       "path": "tests/upgrade_persist_pin.mjs",

package/docs/module-api-changelog.md

@@ -1948,5 +1948,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.735 with no explicit bump. run 34771773838. (task 1002620)
   1.19.737 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.736 with no explicit bump. run 34795026282. (task 1002620)
+  1.19.738 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.737 with no explicit bump. run 34797297122. (task 1002620)
+  1.19.739 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.738 with no explicit bump. run 34838475604. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/private-npm-distribution.md

@@ -14,7 +14,7 @@
 |---|---|---|
 | `@bongos/core` | the platform an instance installs + the `bongos` CLI (`bin`) | `bongos package-core` (`scripts/gds/package-core.js`) — synthesizes the package.json + a pruned lockfile, redacts, and packs a `.tgz` |
 
-`@bongos/core` carries `publishConfig: { access: "restricted" }`, so **publishing it is private by default** — no public leak if a flag is forgotten.
+`@bongos/core` carries `publishConfig: { access: "public" }`, and `publishArgs` passes `--access public` as well — both, so neither drifting alone can silently take the package back to restricted ([ADR 0283](../adr/0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md)). It read `restricted` until 2026-09-13; what protects the artifact is the no-leak gate on the build, not who may fetch it.
 
 The generated typed client (`node scripts/gds/gen-api-client.js` → `clients/bongos-client/`) is deliberately **not** in this table: it is not published, carries no `publishConfig`, and is consumed by vendoring. See its own README.
 
@@ -33,15 +33,15 @@ These involve payment and permanent, account-level actions. They are **not** don
 Always preview with a dry-run first (no upload, no login needed):
 
 ```sh
-# Core — build the tarball and DRY-RUN the private publish:
+# Core — build the tarball and DRY-RUN the publish:
 node scripts/gds/package-core.js --publish
 ```
 
-Look for `restricted access` and the `@bongos/core@<version>` line. When it looks right, publish for real (this is **permanent** — npm can't delete a name after 72h):
+Look for `public access` and the `@bongos/core@<version>` line. When it looks right, publish for real (this is **permanent and public** — npm can't delete a name after 72h, and the version is never reusable):
 
 ```sh
 npm login                                         # once per machine (+ 2FA)
-node scripts/gds/package-core.js --publish --live # actually publishes, still private
+node scripts/gds/package-core.js --publish --live # actually publishes, PUBLIC
 ```
 
 For the client (note the `./` — without it, npm reads the path as a git package spec, not a folder):
@@ -101,13 +101,13 @@ A tokenless registry `npm ci` 404s cleanly (`E404 … @bongos/core … could not
 
 > **Proven end-to-end (2026-07-08, task 2118 / blocker 71).** A real `bongos init --registry-core` scaffold, with a valid read-only token in `NPM_TOKEN`, resolved `@bongos/core@1.17.0` straight from `registry.npmjs.org` and generated a reproducible `package-lock.json`. Both legs are confirmed: the registry pull works with a token and fails closed (404) without one. Provisioning still defaults to the vendored tarball until an owner explicitly sets `PROVISION_CORE_FROM_REGISTRY=1` on a live runner.
 
-## Going public at launch
+## Going public — DONE 2026-09-13
 
-Pick either — both keep the daily `bongos` command working:
+`@bongos/core` is public ([ADR 0283](../adr/0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md), [task 1003872](https://cloudbongos.com/builders#/task/1003872)). `publishConfig.access` is `"public"` and the registry-side status was flipped with the one-time owner step:
 
-- **Flip the same scoped packages public** (simplest):
-  ```sh
-  npm access public @bongos/core
-  ```
-  (Or change `publishConfig.access` to `"public"` and republish.) Public installs need no token; the paid seats can be dropped.
+```sh
+npm access set status=public @bongos/core
+```
+
+That registry flip is separate from `--access public` on a publish, which governs only what *that* publish declares and is historically a no-op when re-publishing an already-private package. Verify the flip by a tokenless install from a clean `HOME`, not by the flag's presence. Public installs need no token; the paid private-package seats can be dropped.
 - **Also publish the unscoped vanity name** for `npm install -g cloudbongos` — that is [task 2025](https://example.com/builders#/task/2025) (rename in `package-core.js`/`upgrade.js` + docs), done at launch.

package/docs/recipes/upgrading-the-core.md

@@ -108,7 +108,7 @@ node .claude/scheduled-tasks/core-update-subscription/subscribe.js            #
 node .claude/scheduled-tasks/core-update-subscription/subscribe.js --apply    # upgrade
 ```
 
-Each subscribed instance: read its installed core → ask the registry (`npm view`, needs `NPM_TOKEN`) → resolve the newest version its channel permits → if newer, `bongos upgrade --to <v> --registry` with **auto-rollback ON**. It prints one line per instance plus a tally; a non-zero exit means an upgrade failed (already auto-reverted).
+Each subscribed instance: read its installed core → ask the registry (`npm view`, no credential needed — the package is public) → resolve the newest version its channel permits → if newer, `bongos upgrade --to <v> --registry` with **auto-rollback ON**. It prints one line per instance plus a tally; a non-zero exit means an upgrade failed (already auto-reverted).
 
 **Triple-gated, so nothing moves by accident:** the `core-update-subscription` routine is `requiresAutonomy: true` + **default OFF** in [`config/scheduled-routines.json`](../../config/scheduled-routines.json), the roster ships empty, and every upgrade is health-gated. Arm it by enabling the routine's timer on the control plane once autonomy is on.
 
@@ -116,7 +116,8 @@ Each subscribed instance: read its installed core → ask the registry (`npm vie
 
 ## Gotchas
 
-- **`--registry` no longer needs a hand-exported `NPM_TOKEN`** (task 1002754). The instance `.npmrc` reads `_authToken=<redacted>, and npm gives that per-project key precedence — so with the env var unset it expanded EMPTY and **masked a perfectly valid literal token in `~/.npmrc`** (npm went anonymous; the private core 404'd; the error blamed a "missing" credential the box actually held). `bongos upgrade --registry` now resolves the credential itself: env `NPM_TOKEN` wins, else the **user-level `~/.npmrc`'s literal `//registry.npmjs.org/:_authToken=…`** is injected into the install's environment (forward install and rollback reinstall both). A pin bump on a box whose `~/.npmrc` authenticates therefore succeeds with **no exported env var**. Resolver: `resolveNpmToken()` in [`scripts/gds/npmrc.js`](../../scripts/gds/npmrc.js).
+- **`--registry` needs no credential at all** (task 1003878). `@bongos/core` is **public** on npm (task 1003872), so `bongos upgrade --registry` resolves it from the default registry like any other dependency — no token, no login, and no instance `.npmrc`. An install failure on this path is therefore a *real* failure (network, registry outage, or a version that was never published), never a missing credential.
+  *History, so the symptom is recognisable on an old instance:* the core used to publish private, and the instance `.npmrc` read `_authToken=<redacted> npm gives that per-project key precedence, so with the env var unset it expanded EMPTY and **masked a perfectly valid literal token in `~/.npmrc`** — npm went anonymous, the private core 404'd, and the error blamed a credential the box actually held. Task 1002754 worked around it by resolving the token in-process; task 1003878 deleted the whole mechanism along with the `.npmrc` that caused it. An instance still carrying a committed `.npmrc` from a pre-1003878 scaffold can safely delete it.
 - **A green `publish` run is not evidence of a publish.** The publish-on-merge lane succeeds on its no-op paths too (cascade terminator, armed-gate). Read the run's **job summary**, which now states the verdict explicitly: `PUBLISHED @bongos/core@<v>` vs `NO-OP — nothing was published this run`.
 - **`PGDATABASE` is load-bearing on a co-tenant droplet.** `migrate.sh` defaults `PGDATABASE` to `example` — **production**. Always set `PGDATABASE=<instance-db>` explicitly, or you migrate the wrong database.
 - **The health check polls the restart** (fixed in task [#1984](https://example.com/builders#/task/1984)). The service binds its port ~1s after `systemctl restart`, so `--health-url` now polls up to ~30s for a 2xx before reporting a warning — an immediate `fetch failed` no longer means a failed upgrade. (Pre-1984 cores fetched once and spuriously reported `fetch failed`; there, confirm with `is-active` + a manual `curl`.)

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.737",
+  "version": "1.19.739",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.737",
+      "version": "1.19.739",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.737",
+  "version": "1.19.739",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/go-live.js

@@ -84,7 +84,7 @@ function isSafeToken(v) {
 // unit name that the script would then try to `systemctl stop`. Absent, the stop and
 // the restart are simply skipped: there is no `reset --hard` to race.
 const REQUIRED_FIELDS = ['instanceDir', 'service', 'healthUrl', 'versionUrl'];
-const OPTIONAL_FIELDS = ['ssh', 'local', 'deployTimer', 'deployService', 'npmEnvFile', 'runAs', 'backupDb', 'backupDir', 'env', 'registryPackage', 'pinMode'];
+const OPTIONAL_FIELDS = ['ssh', 'local', 'deployTimer', 'deployService', 'runAs', 'backupDb', 'backupDir', 'env', 'registryPackage', 'pinMode'];
 
 // How the bump is made durable — the other half of co-tenant mode (task 1003521).
 //
@@ -153,7 +153,6 @@ const CONFIG_TEMPLATE = `{
       "versionUrl": "http://127.0.0.1:3002/version",    // box-side truth read back after
       "deployTimer": "my-deploy.timer",                 // optional: pull-deploy timer (its reset --hard is the hazard)
       "deployService": "my-deploy.service",             // optional: forced tick proves the pin stuck
-      "npmEnvFile": "/etc/my/npm.env",                  // optional: root-only NPM_TOKEN for a PRIVATE package
       "runAs": "me",                                    // optional: unprivileged owner of the instance
       "backupDb": "mydb",                               // optional: pg_dump before the bump
       "backupDir": "~/backups",
@@ -247,40 +246,19 @@ function remote(target, script, { run = spawnSync, timeoutMs = 900000 } = {}) {
 // `sudo -u <user> -H env K=V … <cmd>` — the shape every runbook entry uses. Returns
 // a string safe to embed because every component was allowlist-validated.
 //
-// A privileged child needs npm auth, and there is NO WAY to hand it a secret through
-// sudo without logging it (task 1003218, corrected).
-//
-//   `env NPM_TOKEN="$NPM_TOKEN" …`     → sudo logs it in COMMAND=
-//   `sudo --preserve-env=NPM_TOKEN …`  → sudo logs it in ENV=
-//
-// The first was the original bug; the second was my "fix", which only MOVED the value
-// to a different field of the same log line. Both put a live credential in a
-// persistent journal. What matters is that sudo logs its whole invocation, so the
-// secret must never be part of it.
-//
-// So the child DERIVES the token itself, from a file it can already read. Only the
-// `sed` appears in argv; the value never does. This is the shape docs/recipes/
-// core-release-pipeline.md already documents as the safe one. The guard matters as
-// much as the derivation: an EMPTY token silently sends npm to the public registry,
-// which 404s the private package, which auto-rolls-back "cleanly" having taught you
-// nothing — so an empty read aborts loudly instead of half-running.
-//
-// (The nightly lane never takes this path: it runs under systemd as the owner with an
-// EnvironmentFile, no sudo, and leaks nothing. This is the manual/agent path only.)
-const NPM_AUTH_PREAMBLE = [
-  'export NPM_TOKEN="${NPM_TOKEN:-$(sed -n \'s/.*_authToken=//p\' "$HOME/.npmrc" 2>/dev/null | head -1)}"',
-  '[ -n "$NPM_TOKEN" ] || { echo "go-live: EMPTY NPM_TOKEN — npm would 404 the private core and roll back; aborting" >&2; exit 12; }',
-].join('; ');
-
 // `sudo -u <user> -H env K=V … <cmd>` — the shape every runbook entry uses. Returns
 // a string safe to embed because every component was allowlist-validated.
 //
-// `needsNpm` wraps the command so it derives its own npm auth (see above) instead of
-// having a secret handed across the privilege boundary. Only NON-secret configuration
-// (PGDATABASE, HOME) travels in the plain `env K=V` list — seeing those in a log is
-// useful rather than harmful.
-function asOwner(target, cmd, { needsNpm = false } = {}) {
-  const inner = needsNpm ? `sh -c ${shq(`${NPM_AUTH_PREAMBLE}; ${cmd}`)}` : cmd;
+// Only NON-secret configuration (PGDATABASE, HOME) travels in the plain `env K=V` list —
+// seeing those in a log is useful rather than harmful.
+//
+// This used to take a `needsNpm` option wrapping the command in a preamble that DERIVED an
+// npm credential on the far side, because sudo logs its whole invocation and there was no way
+// to hand a privileged child a secret without journalling it (task 1003218). @bongos/core is
+// public (task 1003872), so the deploy path needs no npm credential at all and the whole
+// hazard is gone rather than mitigated (task 1003878).
+function asOwner(target, cmd) {
+  const inner = cmd;
   const envPairs = Object.entries(target.env || {}).map(([k, v]) => `${k}=${v}`);
   if (!target.runAs) {
     const joined = envPairs.join(' ');
@@ -622,23 +600,21 @@ function renderReport(r) {
 // Phases
 // ---------------------------------------------------------------------------
 
-// Registry proof + optional content proof, in ONE round-trip. The registry is
-// consulted ON THE BOX because a PRIVATE package 404s without the root-only
-// NPM_TOKEN, and because the box's answer is the one that matters.
+// Registry proof + optional content proof, in ONE round-trip. The registry is still
+// consulted ON THE BOX — not because auth lives there (the package is public now), but
+// because the box's answer is the one that matters: its network, its resolver, its cache.
 function probeRemote(target, targetVersion, marker, opts = {}) {
   const pkg = target.registryPackage || '@bongos/core';
-  const src = target.npmEnvFile ? `set -a; . ${target.npmEnvFile}; set +a` : 'true';
   const script = `
 set -uo pipefail
-${src}
 echo "##REGISTRY##"
-${asOwner(target, `npm view ${pkg}@${targetVersion} version`, { needsNpm: true })} 2>&1 | tail -1
+${asOwner(target, `npm view ${pkg}@${targetVersion} version`)} 2>&1 | tail -1
 echo "##TREE##"
 ( cd ${target.instanceDir} && ${target.runAs ? `sudo -u ${target.runAs} -H ` : ''}git status --porcelain | head -20 )
 echo "##INSTALLED##"
 ${asOwner(target, `node -e "console.log(require('${target.instanceDir}/node_modules/${pkg}/package.json').version)"`)} 2>&1 | tail -1
 ${marker ? `echo "##MARKER##"
-${asOwner(target, `sh -c ${shq(markerProbe(pkg, targetVersion, marker))}`, { needsNpm: true })}` : ''}
+${asOwner(target, `sh -c ${shq(markerProbe(pkg, targetVersion, marker))}`)}` : ''}
 echo "##END##"
 `;
   const res = remote(target, script, opts);
@@ -709,7 +685,6 @@ function applyGoLive(target, targetName, targetVersion, from, opts = {}) {
   const pkg = target.registryPackage || '@bongos/core';
   const pinMode = pinModeOf(target);
   const steps = [];
-  const src = target.npmEnvFile ? `set -a; . ${target.npmEnvFile}; set +a` : 'true';
 
   // Phase A — stop the pull-deploy timer, then back up. The timer's `reset --hard`
   // is the hazard: it would revert an uncommitted pin mid-flight. A co-tenant has no
@@ -738,8 +713,7 @@ echo "##END##"
   const upgrade = upgradeCommand(target, targetVersion);
   const phaseB = remote(target, `
 set -uo pipefail
-${src}
-${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade}"`, { needsNpm: true })}
+${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade}"`)}
 `, opts);
   const rolledBack = /rolled back/i.test(phaseB.stdout + phaseB.stderr);
   steps.push({
@@ -995,7 +969,7 @@ if (require.main === module) {
 module.exports = {
   loadConfig, selectTarget, validateTarget, planGoLive, artistGateEntries, readArtistGate, ARTIST_GATE_PATH, ARTIST_GATE_LEVELS,
   parseMarker, parseMarkerHits,
-  renderPlan, renderReport, failureExcerpt, asOwner, isSafeToken, NPM_AUTH_PREAMBLE, refreshMain, isLocalTarget, gitRefExists, SUDO_PREAMBLE,
+  renderPlan, renderReport, failureExcerpt, asOwner, isSafeToken, refreshMain, isLocalTarget, gitRefExists, SUDO_PREAMBLE,
   applyGoLive, upgradeCommand, pinStep, pinModeOf,
   CONFIG_TEMPLATE, HALTS, SEMVER_RE, PIN_MODES, DEFAULT_PIN_MODE,
 };

package/scripts/gds/init.js

@@ -59,13 +59,13 @@
 //   bongos init --vendor-core <tgz>   greenfield only: vendor the @bongos/core .tgz + pin
 //                                       package.json to file:vendor/… + generate package-lock.json,
 //                                       so the scaffold is `npm ci`-installable (ADR 0108 gap 1/4).
-//                                       Without it the scaffold pins the caret range (which now
-//                                       resolves from the PRIVATE registry — see --registry-core).
-//   bongos init --registry-core       greenfield only: keep the caret pin + write an env-fed
-//                                       .npmrc (`_authToken=${NPM_TOKEN}`) so `npm ci` pulls the
-//                                       PRIVATE @bongos/core from the npm registry (ADR 0134).
-//                                       With NPM_TOKEN set it also generates package-lock.json;
-//                                       without a token it 404s (the expected tokenless outcome).
+//                                       Without it the scaffold pins the caret range, which
+//                                       resolves from the public npm registry (--registry-core).
+//   bongos init --registry-core       greenfield only: keep the caret pin and generate
+//                                       package-lock.json from the registry. @bongos/core is
+//                                       PUBLIC (task 1003872), so this needs no token, no login
+//                                       and no .npmrc — it resolves from the default registry
+//                                       like any other dependency.
 //                                       Mutually exclusive with --vendor-core (registry vs tarball).
 
 const fs = require('node:fs');
@@ -78,7 +78,6 @@ const { materializeClaude } = require('./claude-materialize'); // ADR 0108 §3 (
 const { detectStack, formatStackSummary } = require('./adopt-detect'); // ADR 0121 §Decision 4 (task 2043): inspect an existing repo before layering
 const { resolveBacklogTasks, DEFAULT_MAX: BACKLOG_MAX } = require('./adopt-import'); // ADR 0121 §Decision 3 (task 2044): import an existing backlog
 const { preflightAdopt, formatPreflight } = require('./adopt-preflight'); // ADR 0121 §Decision 5 (task 2045): the accept-gated conflict pre-flight
-const { writeNpmrc, hasNpmToken } = require('./npmrc'); // ADR 0134 (task 2090): the registry-install path's env-fed .npmrc
 
 const KNOWN_MODULES = ['game', 'art-pipeline', 'discord', 'dev-box'];
 
@@ -946,7 +945,7 @@ async function main(argv) {
   const adopt = hasFlag('--adopt', args); // brownfield: LAYER onto an existing repo (ADR 0121)
   const accept = hasFlag('--accept', args) || hasFlag('--yes', args) || hasFlag('-y', args); // adopt pre-flight accept-gate (§Decision 5)
   const vendorCore = arg('--vendor-core', args); // greenfield: vendor + file:-pin a core .tgz, then generate the lockfile (ADR 0108 gap 1/4, task 2053)
-  const registryCore = hasFlag('--registry-core', args); // greenfield: caret pin + env-fed .npmrc → `npm ci` pulls the PRIVATE core from the registry (ADR 0134, task 2090)
+  const registryCore = hasFlag('--registry-core', args); // greenfield: keep the caret pin and generate the lockfile from the public registry (task 1003878)
 
   if (adopt && force) {
     console.error('init: --force is a greenfield-only overwrite; --adopt never overwrites, so --force is ignored.');
@@ -1030,30 +1029,23 @@ async function main(argv) {
     }
   }
 
-  // Registry-install path (ADR 0134, task 2090): keep the caret pin writeConfigs wrote
-  // and add an env-fed .npmrc so `npm ci` pulls the PRIVATE @bongos/core from the
-  // registry. With NPM_TOKEN present we also generate package-lock.json (a reproducible
-  // `npm ci` later); without a token we still write the caret pin + .npmrc so the
-  // scaffold is registry-shaped, and say plainly that the private package 404s until a
-  // token is provided — the expected tokenless outcome the ADR calls to verify.
+  // Registry-install path: keep the caret pin writeConfigs wrote and generate
+  // package-lock.json from the registry, so a later `npm ci` is reproducible.
+  //
+  // This used to write an env-fed npm auth file and skip the lockfile when no credential was
+  // present, because @bongos/core published PRIVATE. It is public now (task 1003872), so it
+  // resolves from the default registry like any other dependency: no auth file, no credential,
+  // and no tokenless-404 branch to explain (task 1003878).
   if (registryCore) {
     if (dryRun) {
-      console.log(`\n[dry-run] would write .npmrc (env-fed @bongos auth) and ${hasNpmToken()
-        ? 'run `npm install` to generate package-lock.json from the registry'
-        : 'SKIP lockfile generation (no NPM_TOKEN — the private core 404s until one is provided)'}`);
+      console.log('\n[dry-run] would run `npm install` to generate package-lock.json from the registry');
     } else {
-      console.log('\nWiring the registry-install path (ADR 0134):');
-      writeNpmrc(dir, { log: console.log });
-      if (hasNpmToken()) {
-        const inst = upgrade.npmInstall(dir);
-        if (!inst.ok) {
-          console.error(`  ! npm install failed (${inst.reason || 'exit ' + inst.code}) — confirm NPM_TOKEN reaches the private @bongos org; package-lock.json not generated.`);
-        } else {
-          console.log('  ✓ npm install → package-lock.json generated (pulled @bongos/core from the registry)');
-        }
+      console.log('\nWiring the registry-install path:');
+      const inst = upgrade.npmInstall(dir);
+      if (!inst.ok) {
+        console.error(`  ! npm install failed (${inst.reason || 'exit ' + inst.code}) — package-lock.json not generated. @bongos/core is public, so this is a real failure (network, registry outage, or an unpublished version), not a missing credential.`);
       } else {
-        console.log('  • no NPM_TOKEN in the environment — wrote the caret pin + .npmrc but skipped lockfile generation.');
-        console.log('    Provide a read-only automation token (paid `bongos` org) as NPM_TOKEN before `npm ci`; without it the private package 404s cleanly.');
+        console.log('  ✓ npm install → package-lock.json generated (pulled @bongos/core from the registry)');
       }
     }
   }

package/scripts/gds/package-core.js

@@ -580,7 +580,8 @@ function publishArgs(tgzPath, live) {
 
 // Publish (or dry-run) the built .tgz to npm. Auth is npm's own concern — this
 // never holds a token; it shells out to `npm publish` and the owner's `npm login`
-// (+ the cloudbongos org on a paid plan, for a PRIVATE scoped publish) provides it.
+// provides it. The package is PUBLIC (task 1003872, ADR 0283), so no paid org plan
+// is involved — a public scoped publish needs none.
 // The child's stdout is routed to OUR stderr so main()'s machine-readable pin on
 // stdout stays clean for CI capture.
 function publishTarball({ tgzPath, live }) {
@@ -589,16 +590,16 @@ function publishTarball({ tgzPath, live }) {
   console.error(`[package-core] ${live ? 'PUBLISH (permanent)' : 'publish DRY-RUN'} → ${NPM_BIN} ${args.join(' ')}`);
   if (!live) {
     console.error('  Dry-run: nothing is uploaded. To publish for real: re-run with --publish --live.');
-    console.error('  That is PERMANENT and requires `npm login` + the cloudbongos npm org on a paid plan');
-    console.error('  (private scoped publish needs one). Going public later: `npm access public @bongos/core`.');
+    console.error('  That is PERMANENT and PUBLIC (ADR 0283) — anyone can fetch it, and a version is never');
+    console.error('  reusable once taken. It requires `npm login`; no paid org plan (the package is public).');
   }
   const r = spawnSync(NPM_BIN, args, { cwd: REPO_ROOT, stdio: ['inherit', process.stderr, 'inherit'] });
   if (r.error || r.status !== 0) {
     console.error(`[package-core] npm publish ${live ? '' : '--dry-run '}FAILED (${r.error ? r.error.message : `exit ${r.status}`}).`);
-    if (live) console.error('  Common causes: not logged in (`npm login`), the org isn’t on a paid plan (private scoped publish requires one), or 2FA.');
+    if (live) console.error('  Common causes: not logged in (`npm login`), no publish rights on the @bongos scope, that version already taken, or 2FA.');
     process.exit(r.status || 1);
   }
-  console.error(`[package-core] npm publish ${live ? 'succeeded — @bongos/core is live (private).' : 'dry-run OK — the tarball is publishable.'}`);
+  console.error(`[package-core] npm publish ${live ? 'succeeded — @bongos/core is live and PUBLIC on the registry.' : 'dry-run OK — the tarball is publishable.'}`);
 }
 
 // The neutral FLOOR — customer-zero identity tokens a portable core must never carry (task 1002220
@@ -1048,7 +1049,7 @@ module.exports = {
   isAgentDoc, CORE_AGENT_DOC_STUB,
   // task 1882 (ADR 0108 §2) — the real installable npm package
   CORE_DEP_NAMES, buildPackageJson, resolveLockDep, lockfileClosure, prunePackageLock,
-  // task 2089 (ADR 0134) — private-by-default npm publish
+  // task 2089 (ADR 0134) — the npm publish argv; PUBLIC since task 1003872 / ADR 0283
   publishArgs,
   // task 1002218 (audit H3) — build-time self-verify (reproduce pin + optional bare-install boot)
   selfVerify, reproducePinFromTree,

package/scripts/gds/provision-config.js

@@ -19,12 +19,6 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 // plain require (its require.main guard means importing it runs no CLI).
 const oauthSecret = require('./oauth-secret');
 
-// The registry-install gates + env-fed .npmrc (ADR 0134, task 2090). Lets the
-// standalone scaffold OPT IN to pulling the PRIVATE @bongos/core from the npm
-// registry (PROVISION_CORE_FROM_REGISTRY=1) instead of vendoring a tarball, with a
-// fail-soft fallback to the vendored path when no NPM_TOKEN is present.
-const { registryCoreRequested, hasNpmToken } = require('./npmrc');
-
 // The HTTP User-Agent the manifest conversion stamps its GitHub call with (GitHub
 // requires a UA). Overridable so a fork can identify itself; not secret.
 const MANIFEST_UA = process.env.PROVISION_GITHUB_UA || 'cloudbongos-provisioner';
@@ -195,10 +189,8 @@ module.exports = {
   REPO_ROOT,
   coreVersionSafe,
   hasFlag,
-  hasNpmToken,
   loadDeps,
   numEnv,
   oauthSecret,
   provisionerBotEmail,
-  registryCoreRequested,
 };