@bongos/core 1.19.737 → 1.19.739

package/scripts/gds/provision-repo.js

@@ -14,7 +14,7 @@ const crypto = require('node:crypto');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const { CONFIG, REPO_ROOT, coreVersionSafe, hasNpmToken, provisionerBotEmail, registryCoreRequested } = require('./provision-config.js');
+const { CONFIG, REPO_ROOT, coreVersionSafe, provisionerBotEmail } = require('./provision-config.js');
 // The repo-identity + owner-credential leaf (task 1003081). Carved OUT of this file so
 // upgrade.js can reach these three without pulling provision*.js into the merge
 // resolver's executed closure; re-exported below so every existing caller is unchanged.
@@ -602,18 +602,20 @@ async function scaffoldStandaloneRepo(inst, deps) {
       exec(`git -C ${root} checkout -B main`);
     }
 
-    // Core-install path (ADR 0134, task 2090). DEFAULT = vendor a tarball built from THIS
-    // control-plane checkout (offline, proven — task 2053). OPT-IN = pull the PRIVATE
-    // @bongos/core from the npm registry (PROVISION_CORE_FROM_REGISTRY=1). The registry
-    // path needs NPM_TOKEN at `npm ci` time; if the flag is set but no token is present we
-    // FAIL SOFT to the vendored path so a tokenless standup still works (never a broken
-    // instance). The env is injectable for tests; the runner falls back to process.env.
-    const env = deps.env || process.env;
-    const wantRegistry = registryCoreRequested(env);
-    const useRegistry = wantRegistry && hasNpmToken(env);
-    if (wantRegistry && !useRegistry) {
-      log('  [scaffold] PROVISION_CORE_FROM_REGISTRY set but no NPM_TOKEN in env — falling back to the vendored-tarball core (ADR 0134 fail-soft).');
-    }
+    // Core-install path: vendor a tarball built from THIS control-plane checkout
+    // (offline, proven — task 2053).
+    //
+    // This used to be a fork: an opt-in env var selected the registry, and a missing npm
+    // credential silently failed it soft back to vendored. Both halves were auth-era and both
+    // are gone (task 1003878) — @bongos/core is public, so nothing needs a credential, and an
+    // env var that silently changed which install path ran is the divergence behind task
+    // 1003520. tests/provision.mjs pins both retired names and proves they are inert.
+    //
+    // Vendored stays the default here for a reason that has nothing to do with auth and
+    // survives the package going public: THIS CHECKOUT IS ROUTINELY AHEAD OF THE REGISTRY.
+    // A control plane on an unreleased CORE_VERSION has no published version to install, so
+    // the registry path would 404 on exactly the commits an operator most wants to stand up.
+    // Whether the vendored path still earns its keep at all is gate 6's call (task 1003879).
 
     // materialize config/ + .claude/ + a pinned package.json + lockfile via `bongos init`.
     // --no-seed: the instance's own DB is seeded by migrate, not here (and on the adopt path
@@ -627,27 +629,21 @@ async function scaffoldStandaloneRepo(inst, deps) {
     // BLOCKING pre-flight finding still hard-stops — it cannot be waved through). init refuses
     // --adopt together with --force, so the two flag sets are mutually exclusive by design.
     //
-    // Two mutually exclusive core-resolution shapes, orthogonal to the mode:
-    //   registry (--registry-core): caret pin + env-fed .npmrc; `npm ci` pulls from the
-    //     registry. init generates the lockfile (NPM_TOKEN is present — we gated on it).
-    //   vendored (--vendor-core, default): a tarball built from this checkout, file:-pinned.
+    // Core resolution is vendored (--vendor-core): a tarball built from this checkout,
+    // file:-pinned. init still accepts --registry-core for an operator who explicitly wants
+    // a published version, and that flag no longer needs any credential.
     const modeFlags = mode === 'adopt' ? '--adopt --accept' : '--force';
     const spec = instanceInitSpec(inst, { ownerLogin });
     const specPath = path.join(os.tmpdir(), `bongos-init-${inst.slug}.json`);
     writeFile(specPath, JSON.stringify(spec, null, 2));
-    if (useRegistry) {
-      log(`  [scaffold] core install: registry — PRIVATE @bongos/core@${coreV} via env-fed NPM_TOKEN (ADR 0134)`);
-      exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed ${modeFlags} --registry-core`);
-    } else {
-      // Vendored tarball — resolveVendorableCoreTarball's three-rung ladder (shared
-      // with the re-provision pin refresh, task 1003050).
-      const { tgz, packDest } = resolveVendorableCoreTarball({
-        instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[scaffold] core install:',
-      });
-      exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed ${modeFlags} --vendor-core ${tgz}`);
-      // init --vendor-core COPIED the tarball into the child's vendor/ — the temp pack dir is spent.
-      if (packDest) exec(`rm -rf ${packDest}`);
-    }
+    // Vendored tarball — resolveVendorableCoreTarball's three-rung ladder (shared
+    // with the re-provision pin refresh, task 1003050).
+    const { tgz, packDest } = resolveVendorableCoreTarball({
+      instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[scaffold] core install:',
+    });
+    exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed ${modeFlags} --vendor-core ${tgz}`);
+    // init --vendor-core COPIED the tarball into the child's vendor/ — the temp pack dir is spent.
+    if (packDest) exec(`rm -rf ${packDest}`);
 
     // 4. commit + push to the instance's own main (keep node_modules out).
     //

package/scripts/gds/provision.js

@@ -360,11 +360,9 @@ async function provisionInstance(inst, deps) {
     // repo + install the pinned @bongos/core, so the migrate + service below run
     // from the INSTANCE root, not this control-plane checkout. cwd = standaloneRoot.
     // boxExec = the control plane (where scaffoldStandaloneRepo just created the dir).
-    // REGISTRY CORE (ADR 0134): when the scaffold pinned the registry core, the committed
-    // .npmrc reads `_authToken=${NPM_TOKEN}` — so `npm ci` resolves the PRIVATE package
-    // only if NPM_TOKEN is in this runner's env (makeExec inherits process.env). The
-    // scaffold already gated on the token, so it is present; the VENDORED default needs
-    // no token (the tarball is committed). A tokenless registry `npm ci` 404s cleanly.
+    // CORE RESOLUTION: the vendored default needs no network at all (the tarball is
+    // committed). A registry pin resolves from the public registry — @bongos/core is public
+    // (task 1003872), so `npm ci` needs no credential either way (task 1003878).
     const root = standaloneRoot(inst);
     log('  [code] standalone — pull instance repo + npm ci (pinned @bongos/core)');
     boxExec(standalonePullCmd(), { cwd: root });

package/scripts/gds/start.js

@@ -587,7 +587,7 @@ function instanceNotRunningCard({ origin, depsMissing } = {}) {
     out.push(`${surface.strong(`Don't run ${surface.code('bongos dev')} for this.`)} It stands up a separate local instance with its own empty database — it cannot show you this board, and it would hide the outage behind an empty one.`);
     if (depsMissing) {
       out.push('');
-      out.push(`(The ${surface.code('bongos')} CLI isn't installed here. It's optional — the website above is the same board. ${surface.code('@bongos/core')} is a ${surface.strong('private')} package, so installing it needs an ${surface.code('NPM_TOKEN')}; a 404 without one is expected, not a missing version.)`);
+      out.push(`(The ${surface.code('bongos')} CLI isn't installed here. It's optional — the website above is the same board. ${surface.code('@bongos/core')} is ${surface.strong('public')} on npm, so ${surface.code('npm install @bongos/core')} needs no token or login; a failure here is a real error, not the expected tokenless 404 it used to be.)`);
     }
     return out.join('\n');
   }

package/scripts/gds/update-channel.js

@@ -122,9 +122,9 @@ function resolveChannelTarget({ installed, channel, available } = {}) {
 
 // ---- registry: what versions of the core are published? ---------------------
 
-// List published versions of @bongos/core from the registry via `npm view … versions --json`
-// (ADR 0134 — the private scoped package resolves through the instance's env-fed .npmrc, so run this
-// with cwd inside an instance that has one + NPM_TOKEN in env). Fail-SOFT: any error returns
+// List published versions of @bongos/core from the registry via `npm view … versions --json`.
+// The package is public (task 1003872), so this needs no credential and no instance-local
+// `.npmrc` — any cwd resolves it. Fail-SOFT: any error returns
 // { ok:false } so the routine skips that instance rather than crashing the whole sweep. `run` +
 // `pkg` are injectable for tests.
 function listAvailableVersions({ cwd = process.cwd(), pkg = CORE_PKG, run = spawnSync, env = process.env } = {}) {

package/scripts/gds/upgrade.js

@@ -32,7 +32,6 @@ const path = require('node:path');
 const crypto = require('node:crypto');
 const { spawnSync } = require('node:child_process');
 const { arg, hasFlag } = require('./cli-lib');
-const { writeNpmrc, hasNpmToken, resolveNpmToken } = require('./npmrc'); // ADR 0134 (task 2090): the --registry channel's env-fed .npmrc; resolveNpmToken task 1002754
 
 const CORE_PKG = '@bongos/core';
 const ARTIFACT = 'bongos-core';
@@ -98,9 +97,9 @@ function writePin(instanceDir, vendorRel, fsImpl = fs) {
   return prev;
 }
 
-// Rewrite the consumer package.json to pin an EXACT registry version (ADR 0134, task
-// 2090): the registry sibling of writePin. `npm install` then resolves @bongos/core@version
-// from the registry (auth via the env-fed .npmrc). Returns the previous dep string.
+// Rewrite the consumer package.json to pin an EXACT registry version: the registry sibling
+// of writePin. `npm install` then resolves @bongos/core@version from the public registry —
+// no credential, since the package is public (task 1003872). Returns the previous dep string.
 function writeRegistryPin(instanceDir, version, fsImpl = fs) {
   const pkgPath = path.join(instanceDir, 'package.json');
   const pkg = readJson(pkgPath, fsImpl);
@@ -478,13 +477,13 @@ function reportModulePreflight(mods, targetVersion, { log = console.log, err = c
   return lines;
 }
 
-function npmInstall(instanceDir, run = spawnSync, extraEnv = null) {
+function npmInstall(instanceDir, run = spawnSync) {
   // `npm install` (NOT `npm ci`): the pin just changed, so the lockfile must be regenerated from the
   // new tarball; `npm ci` would refuse on the package.json↔lock divergence.
-  // extraEnv (task 1002754): the registry path injects a resolved NPM_TOKEN here so the
-  // instance `.npmrc`'s `${NPM_TOKEN}` expansion never shadows a valid user-level token.
+  // This used to take an extraEnv carrying a resolved npm credential, because the instance
+  // `.npmrc`'s env expansion could shadow a valid user-level one (task 1002754). The core is
+  // public and writes no `.npmrc`, so there is no credential to resolve (task 1003878).
   const opts = { cwd: instanceDir, stdio: 'inherit' };
-  if (extraEnv) opts.env = { ...process.env, ...extraEnv };
   const r = run('npm', ['install', '--no-audit', '--no-fund'], opts);
   return !r || r.error ? { ok: false, reason: r && r.error ? r.error.message : 'spawn failed' } : { ok: r.status === 0, code: r.status };
 }
@@ -983,11 +982,8 @@ async function rollback({ instanceDir, snapshot, fromVersion, toVersion, opts },
   try { restore(instanceDir, snapshot.prevPin, fsImpl); result.restoreOk = true; log(`  ✓ restored pin → ${snapshot.prevPin}`); }
   catch (e) { result.restoreOk = false; err(`  ! could not restore pin (${e.message}) — package.json may need manual repair`); }
 
-  // 2. reinstall the previous core. Same credential resolution as the forward path
-  //    (task 1002754): the previous pin may be a registry pin too, and a rollback
-  //    must never fail on the env-shadowing trap the forward install just avoided.
-  const rbCred = resolveNpmToken();
-  const inst = npmInstall(instanceDir, run, rbCred.source === 'user-npmrc' ? { NPM_TOKEN: rbCred.token } : null);
+  // 2. reinstall the previous core.
+  const inst = npmInstall(instanceDir, run);
   result.reinstallOk = !!inst.ok;
   if (inst.ok) log('  ✓ reinstalled previous core');
   else err(`  ! reinstall of previous core failed (${inst.reason || 'exit ' + inst.code}) — the instance may need manual repair`);
@@ -1094,24 +1090,16 @@ async function runUpgrade(opts, deps = {}) {
     return { ok: false, error: 'post-restart health check is mandatory for a bump that restarts the service, but no --health-url was given.\n  Pass --health-url <url> to confirm the new core serves after restart, or --no-health-check to explicitly skip the confirmation.' };
   }
 
-  // 2. bump the pin. Two mutually exclusive core sources (ADR 0134, task 2090):
-  //    REGISTRY (--registry): pin @bongos/core@<version> + ensure the env-fed .npmrc, so
-  //      the `npm install` below pulls the PRIVATE package from the registry (needs NPM_TOKEN).
+  // 2. bump the pin. Two mutually exclusive core sources:
+  //    REGISTRY (--registry): pin @bongos/core@<version> and let `npm install` pull it from
+  //      the public registry. No credential — the package is public (task 1003872), which
+  //      also retired the whole resolve-a-token-and-inject-it dance (task 1002754/1003878).
   //    VENDORED (default, --from <tgz>): copy the .tgz into vendor/ + rewrite the file: dep.
-  let installEnv = null;
   if (opts.registry) {
     if (opts.from) return { ok: false, error: '--registry and --from are mutually exclusive (registry pull vs vendored tarball) — pick one core source' };
-    // task 1002754 — resolve the credential HERE instead of demanding a hand-exported
-    // env var: env NPM_TOKEN wins, else the user-level ~/.npmrc's literal token is
-    // injected into the install's env so the instance `.npmrc`'s `${NPM_TOKEN}`
-    // expansion (which OUTRANKS the user-level key and expands EMPTY when unset)
-    // can never shadow a working credential again.
-    const cred = resolveNpmToken();
-    if (!cred.token) log('  ! no NPM_TOKEN in env and no literal token in ~/.npmrc — `npm install` will 404 on the PRIVATE @bongos/core until a read-only automation token is provided (ADR 0134).');
-    else if (cred.source === 'user-npmrc') { installEnv = { NPM_TOKEN: cred.token }; log('  ✓ registry credential: inherited from the user-level ~/.npmrc (no NPM_TOKEN export needed — task 1002754)'); }
     const prevPin = dryRun ? null : writeRegistryPin(instanceDir, targetVersion, fsImpl);
-    if (!dryRun) { writeNpmrc(instanceDir, { fsImpl, overwrite: false, log }); snapshot = { prevPin, prevVersion: fromVersion }; }
-    log(`  ${dryRun ? '[dry-run] would pin' : '✓ pinned'} ${CORE_PKG} → ${targetVersion} (registry)${dryRun ? ' + write an env-fed .npmrc' : ''}${prevPin ? `  (was ${prevPin})` : ''}`);
+    if (!dryRun) { snapshot = { prevPin, prevVersion: fromVersion }; }
+    log(`  ${dryRun ? '[dry-run] would pin' : '✓ pinned'} ${CORE_PKG} → ${targetVersion} (registry)${prevPin ? `  (was ${prevPin})` : ''}`);
   } else {
     let vendorRel = opts.pinPath || (opts.from ? null : vendorRelFor(targetVersion));
     if (opts.from) {
@@ -1130,7 +1118,7 @@ async function runUpgrade(opts, deps = {}) {
   if (dryRun) { log('  [dry-run] would: npm install → npm run migrate → materialize .claude → regen API docs+client → restart → verify'); return { ok: true, dryRun: true, fromVersion, toVersion: targetVersion }; }
 
   // 3. npm install.
-  const inst = npmInstall(instanceDir, run, installEnv);
+  const inst = npmInstall(instanceDir, run);
   if (!inst.ok) {
     const error = `npm install failed (${inst.reason || 'exit ' + inst.code})`;
     if (rollbackOnFailure && snapshot) {
@@ -1370,7 +1358,7 @@ async function main(argv = process.argv.slice(2)) {
       '',
       '  --to <version>       target core version — presence switches from pre-check to a real bump',
       '  --from <tgz>         source tarball to vendor into vendor/ (else it must already be there)',
-      '  --registry           pull @bongos/core@<--to> from the npm registry (env-fed .npmrc + NPM_TOKEN) instead of vendoring a tarball (ADR 0134); mutually exclusive with --from',
+      '  --registry           pull @bongos/core@<--to> from the public npm registry (no token needed) instead of vendoring a tarball; mutually exclusive with --from',
       '  --instance <dir>     consumer instance root (default: cwd)',
       '  --service <unit>     systemd unit to restart after applying',
       '  --restart-cmd <cmd>  explicit restart command (overrides --service)',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.737'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.739'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/go_live.mjs

@@ -442,26 +442,27 @@ test("'could not check' is a distinct halt from 'absent'", () => {
 // `env K=V` list that omits it drops it too. This cost a real failed go-live.
 // ---------------------------------------------------------------------------
 
-test('a privileged npm command DERIVES its token — no secret in argv at all', () => {
-  const cmd = G.asOwner({ runAs: 'lars', env: { PGDATABASE: 'cb' } }, 'npm install', { needsNpm: true });
-  // THE REGRESSION, TWICE (task 1003218). `env NPM_TOKEN="$NPM_TOKEN"` put the value in
-  // sudo's COMMAND= field. `--preserve-env=NPM_TOKEN` moved it to sudo's ENV= field —
-  // a different field of the SAME log line, which is not a fix. sudo logs its whole
-  // invocation, so the only safe answer is that the secret is never part of it.
-  assert.ok(!/NPM_TOKEN=npm_/.test(cmd), 'no token VALUE may appear');
-  assert.ok(!/--preserve-env/.test(cmd), '--preserve-env logs the value in ENV=');
-  assert.ok(!/env [^;]*NPM_TOKEN="\$NPM_TOKEN"/.test(cmd), 'no by-reference assignment in argv either');
-  // What SHOULD be there: the child deriving it, and refusing to run on an empty read.
-  assert.match(cmd, /_authToken/);
-  assert.match(cmd, /EMPTY NPM_TOKEN/);
+test('a privileged npm command carries NO credential machinery at all', () => {
+  const cmd = G.asOwner({ runAs: 'lars', env: { PGDATABASE: 'cb' } }, 'npm install');
+  // HISTORY, so nobody reintroduces it (task 1003218, twice). `env NPM_TOKEN="$NPM_TOKEN"`
+  // put the value in sudo's COMMAND= field; `--preserve-env=NPM_TOKEN` moved it to sudo's
+  // ENV= field — a different field of the SAME log line, which was never a fix. The third
+  // shape had the child DERIVE the token from a file so only a `sed` appeared in argv.
+  //
+  // All three are now moot rather than mitigated: @bongos/core is public (task 1003872), so
+  // the deploy path needs no npm credential and the hazard cannot recur (task 1003878). This
+  // asserts the ABSENCE, which is a stronger guarantee than any of the three mitigations.
+  assert.doesNotMatch(cmd, /NPM_TOKEN/, 'no token by value, by reference, or by derivation');
+  assert.doesNotMatch(cmd, /--preserve-env/, '--preserve-env would log the value in ENV=');
+  assert.doesNotMatch(cmd, /_authToken/, 'nothing reads a credential out of an .npmrc');
   // Non-secret config still travels plainly.
   assert.match(cmd, /PGDATABASE=cb/);
 });
 
-test('an empty token ABORTS rather than half-running', () => {
-  // An empty token sends npm to the PUBLIC registry, which 404s the private core, which
-  // auto-rolls-back "cleanly" — a failure that teaches you nothing. Fail loudly instead.
-  assert.match(G.NPM_AUTH_PREAMBLE, /exit 12/);
+test('the retired auth preamble is really gone from the module surface', () => {
+  // It was exported and embedded into every privileged command. A re-export would mean the
+  // mitigation came back, which now means a credential came back with it.
+  assert.equal(G.NPM_AUTH_PREAMBLE, undefined, 'NPM_AUTH_PREAMBLE must not be exported');
 });
 
 test('a command that does not need npm is left alone', () => {
@@ -470,10 +471,10 @@ test('a command that does not need npm is left alone', () => {
   assert.ok(!cmd.includes('NPM_TOKEN'));
 });
 
-test('with no privilege drop the command still derives its own auth', () => {
-  const cmd = G.asOwner({ env: { A: 'b' } }, 'npm x', { needsNpm: true });
+test('with no privilege drop the command is still credential-free', () => {
+  const cmd = G.asOwner({ env: { A: 'b' } }, 'npm x');
   assert.ok(!cmd.startsWith('sudo'));
-  assert.match(cmd, /_authToken/);
+  assert.doesNotMatch(cmd, /NPM_TOKEN|_authToken/);
 });
 
 test('the report surfaces the failing tool’s own words', () => {

package/tests/init.mjs

@@ -768,10 +768,10 @@ async function runSeedTests() {
   });
 }
 
-// ---- greenfield registry-install path (ADR 0134, task 2090) ----------------
+// ---- greenfield registry-install path ---------------------------------------
 // main() with --registry-core --dry-run only LOGS (no fs, no network), so we capture
-// console output and assert the plan. The real write+install path is proven by the
-// CLI scratch run in the session log; the pure gates live in tests/npmrc.mjs.
+// console output and assert the plan. The package is public (task 1003872), so this path
+// writes no `.npmrc` and needs no token; tests/npmrc.mjs went with the module (task 1003878).
 async function runRegistryCoreTests() {
   const at = async (name, fn) => {
     try { await fn(); passed++; console.log(`  ok  ${name}`); }
@@ -799,14 +799,19 @@ async function runRegistryCoreTests() {
     return { code, out: lines.join('\n') };
   };
 
-  await at('main --registry-core --dry-run: plans the env-fed .npmrc; does NOT vendor a tarball', async () => {
+  await at('main --registry-core --dry-run: plans a plain lockfile generation, no .npmrc, no token', async () => {
     const { dir, p } = specFile();
     try {
       const { code, out } = await capture(['--from', p, '--dir', join(dir, 'out'), '--no-seed', '--registry-core', '--dry-run']);
       assert.equal(code, 0);
-      assert.match(out, /would write \.npmrc \(env-fed @bongos auth\)/);
+      assert.match(out, /would run `npm install` to generate package-lock\.json/);
       assert.ok(!/vendor/i.test(out), 'no vendored-tarball step on the registry path');
-      assert.equal(existsSync(join(dir, 'out', '.npmrc')), false, 'dry-run writes nothing');
+      // The load-bearing half (task 1003878): a public package resolves from the default
+      // registry, so planning an `.npmrc` or mentioning a token would mean the retired
+      // auth path came back.
+      assert.doesNotMatch(out, /\.npmrc/, 'must not plan an .npmrc');
+      assert.doesNotMatch(out, /NPM_TOKEN/, 'must not mention a token');
+      assert.equal(existsSync(join(dir, 'out', '.npmrc')), false, 'writes no .npmrc at all');
     } finally { rmSync(dir, { recursive: true, force: true }); }
   });
 

package/tests/provision.mjs

@@ -599,18 +599,41 @@ async function scaffoldWithEnv(env) {
   }
 }
 
-await ta('scaffoldStandaloneRepo: PROVISION_CORE_FROM_REGISTRY=1 + NPM_TOKEN → registry path (init --registry-core, no tarball build)', async () => {
+// Provisioning used to FORK on two env vars: PROVISION_CORE_FROM_REGISTRY chose the registry
+// path, and a missing NPM_TOKEN silently failed it soft back to the vendored tarball. Both are
+// gone (task 1003878) — the package is public, so nothing needs a token, and an env var that
+// silently changed which install path ran is the divergence behind task 1003520.
+//
+// These two assert the ABSENCE of that fork, which is why they set the retired vars explicitly:
+// a test that merely stopped mentioning them would pass whether or not the fork came back.
+await ta('scaffoldStandaloneRepo: the retired PROVISION_CORE_FROM_REGISTRY env no longer diverts to the registry', async () => {
   const joined = await scaffoldWithEnv({ PROVISION_CORE_FROM_REGISTRY: '1', NPM_TOKEN: 'npm_readonly' });
-  assert.match(joined, /init\.js --from .* --dir .* --no-seed --force --registry-core/, 'materializes via --registry-core');
-  assert.ok(!/package-core\.js/.test(joined), 'does NOT build a core tarball on the registry path');
-  assert.ok(!/--vendor-core/.test(joined), 'does NOT vendor a tarball on the registry path');
-});
-
-await ta('scaffoldStandaloneRepo: registry requested but NO NPM_TOKEN → FAILS SOFT to the vendored tarball', async () => {
-  const joined = await scaffoldWithEnv({ PROVISION_CORE_FROM_REGISTRY: '1' });
-  assert.match(joined, /node scripts\/gds\/package-core\.js/, 'builds the core tarball (vendored fallback)');
+  assert.match(joined, /node scripts\/gds\/package-core\.js/, 'still vendors — the env var is inert');
   assert.match(joined, /init\.js --from .* --dir .* --no-seed --force --vendor-core /, 'file:-pins the vendored tarball');
-  assert.ok(!/--registry-core/.test(joined), 'does NOT take the registry path without a token');
+  assert.ok(!/--registry-core/.test(joined), 'the retired env var must not resurrect the registry path');
+});
+
+await ta('scaffoldStandaloneRepo: a token in env changes NOTHING about the install path', async () => {
+  // BOTH runs set the retired request flag and vary ONLY the token — that is precisely the
+  // old divergence (flag + token → registry; flag, no token → vendored fail-soft). Comparing
+  // two runs that DON'T set the flag would pass whether or not the fork existed, which an
+  // adversarial re-add of the fork proved while this test was written that way.
+  const withToken = await scaffoldWithEnv({ PROVISION_CORE_FROM_REGISTRY: '1', NPM_TOKEN: 'npm_readonly' });
+  const without = await scaffoldWithEnv({ PROVISION_CORE_FROM_REGISTRY: '1' });
+  // THE LOAD-BEARING ASSERTION. The old fail-soft made a tokenless standup take a DIFFERENT
+  // install path than a tokenized one — two modes diverging on an env var (task 1003520).
+  // One public path means the presence of a credential cannot change the outcome at all.
+  // Normalize the per-run random temp names (scratch dir, spec file, pack dir) — they differ
+  // between any two runs and say nothing about which install path was taken.
+  const norm = (t) => t
+    .replace(/scaffold-[A-Za-z0-9]+/g, 'SCRATCH')
+    .replace(/bongos-init-[^\s.]+/g, 'SPEC')
+    .replace(/core-pack-[^\s/]+/g, 'PACK');
+  assert.equal(
+    norm(withToken),
+    norm(without),
+    'the command sequence must be identical with and without a token',
+  );
 });
 
 await ta('scaffoldStandaloneRepo: default (no registry env) stays on the vendored tarball path', async () => {

package/tests/start_env_guard.mjs

@@ -107,10 +107,15 @@ t('a hosted origin leads with the board being a website that needs no install',
   assert.ok(/healthz/.test(card), 'offers the health probe instead of a bring-up');
 });
 
-t('a hosted origin explains the private-package 404 rather than implying a lost version', () => {
+t('a hosted origin says the core installs with no token, and never re-offers the retired NPM_TOKEN advice', () => {
   const card = instanceNotRunningCard({ origin: 'https://example-instance.cloudbongos.com', depsMissing: true });
-  assert.ok(/private/i.test(card) && /NPM_TOKEN/.test(card), 'names the real cause of a tokenless install failure');
-  assert.ok(/not a missing version/.test(card), 'kills the "go find a version that still exists" wild goose chase');
+  assert.ok(/public/i.test(card), 'names the package as public — it is (task 1003872)');
+  assert.ok(/no token|needs no token/i.test(card), 'tells the reader nothing needs authenticating');
+  // The load-bearing half: this card spent months telling people to go find an NPM_TOKEN for
+  // a package that is now public. Advising that again would send a newcomer hunting a
+  // credential that does not exist and cannot be issued to them.
+  assert.doesNotMatch(card, /NPM_TOKEN/, 'must not resurrect the token advice');
+  assert.doesNotMatch(card, /\bprivate\b/i, 'must not call the package private');
 });
 
 t('isLocalOrigin: loopback is local, everything else is remote', () => {

package/tests/upgrade.mjs

@@ -444,7 +444,7 @@ t('runUpgrade --registry + --from: refuses (mutually exclusive core sources)', a
   assert.match(res.error, /mutually exclusive/);
 });
 
-t('runUpgrade --registry (full): pins the exact version + writes the env-fed .npmrc, then install→migrate→verify', async () => {
+t('runUpgrade --registry (full): pins the exact version, writes NO .npmrc, then install→migrate→verify', async () => {
   const dir = scratchConsumer({ pinned: '1.16.0', installed: '1.16.0' });
   const calls = [];
   const res = await u.runUpgrade(
@@ -460,8 +460,11 @@ t('runUpgrade --registry (full): pins the exact version + writes the env-fed .np
   assert.equal(res.ok, true, 'registry upgrade succeeds');
   assert.equal(res.toVersion, '1.17.0');
   assert.equal(JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')).dependencies['@bongos/core'], '1.17.0', 'exact registry pin (no file:)');
-  const npmrc = readFileSync(join(dir, '.npmrc'), 'utf8');
-  assert.match(npmrc, /_authToken=\$\{NPM_TOKEN\}/, 'wrote the env-fed .npmrc');
+  // @bongos/core is public (task 1003872), so the registry path writes no `.npmrc` and
+  // resolves from the default registry. An `.npmrc` reappearing here would mean the retired
+  // auth plumbing came back — and it is the file whose `${NPM_TOKEN}` expansion used to
+  // SHADOW a working user-level credential (task 1002754), so its absence is load-bearing.
+  assert.equal(existsSync(join(dir, '.npmrc')), false, 'writes no .npmrc on the registry path');
   assert.ok(calls.some((c) => /^npm install/.test(c)), 'ran npm install (resolves from the registry)');
   assert.ok(!calls.some((c) => /vendor/.test(c)), 'did not vendor a tarball');
 });

package/scripts/gds/npmrc.js

@@ -1,124 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-//
-// scripts/gds/npmrc.js — env-fed `.npmrc` for installing the PRIVATE @bongos/* core
-// from the npm registry (ADR 0134, task 2090). The single place that knows the
-// registry host + scope + the `.npmrc` shape + the opt-in/token gates, shared by:
-//   • init.js       — the greenfield `--registry-core` scaffold
-//   • provision.js  — the standalone scaffold's registry path (opt-in, fail-soft)
-//   • upgrade.js     — the `--registry <version>` update channel
-//
-// WHY private + env-fed. `@bongos/core` publishes as a SCOPED, PRIVATE package (ADR
-// 0134): a private scoped package can only be installed with auth. Consumers
-// authenticate with an `.npmrc` whose token EXPANDS FROM THE ENVIRONMENT at install
-// time (`_authToken=${NPM_TOKEN}`) — so the committed file carries NO secret, and a
-// tokenless install 404s cleanly (the expected pre-launch outcome).
-//
-// The vendored-tarball path (task 2053) stays the DEFAULT/fallback until this registry
-// path is proven end-to-end on a real greenfield standup (ADR 0134 §Consequences).
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const REGISTRY_HOST = 'registry.npmjs.org';
-const CORE_SCOPE = '@bongos'; // the paid, canonical npm org (ADR 0134 scope correction, task 2092)
-const TOKEN_ENV = 'NPM_TOKEN';
-const REQUEST_ENV = 'PROVISION_CORE_FROM_REGISTRY';
-
-// The `.npmrc` a scaffolded instance commits. The token is the LITERAL `${NPM_TOKEN}`
-// (npm expands env vars in `.npmrc` values at read time), so the file is safe to
-// commit — it holds no secret. Scoping @bongos to the registry keeps every unrelated
-// install on the default public registry.
-function npmrcContent({ scope = CORE_SCOPE, host = REGISTRY_HOST, tokenEnv = TOKEN_ENV } = {}) {
-  return [
-    `; Cloud Bongos — env-fed auth for the PRIVATE ${scope}/* packages (ADR 0134, task 2090).`,
-    `; The token EXPANDS FROM THE ENVIRONMENT at install time; nothing secret is committed here.`,
-    `; \`npm ci\` needs ${tokenEnv} set (a read-only npm access token from the paid \`bongos\` org);`,
-    `; without it the private package 404s — that is the expected tokenless outcome.`,
-    `${scope}:registry=https://${host}/`,
-    `//${host}/:_authToken=\${${tokenEnv}}`,
-    '',
-  ].join('\n');
-}
-
-// Is a registry token present in the environment? The fail-soft gate: provisioning
-// falls back to the vendored tarball when this is false, so a tokenless standup still
-// works (never a broken instance).
-function hasNpmToken(env = process.env) {
-  return !!String(env[TOKEN_ENV] || '').trim();
-}
-
-// resolveNpmToken (task 1002754) — the install-time credential resolver that removes
-// the hand-exported-NPM_TOKEN step from deploys.
-//
-// THE TRAP. The committed instance `.npmrc` reads `_authToken=${NPM_TOKEN}`; npm gives
-// a per-project key precedence over the user-level one, so with NPM_TOKEN unset the
-// expansion is EMPTY and it MASKS a perfectly valid literal token in ~/.npmrc — npm
-// goes anonymous and the private core 404s. Every deploy then silently depended on the
-// operator remembering `export NPM_TOKEN=…` (the ADR-0162 shape: a human-gated step in
-// the ship path). npm's config syntax cannot express "env var, else fall through", so
-// the fix is to RESOLVE the credential here and feed it to the child install's env —
-// the committed file stays secret-free and unchanged.
-//
-// Order: env NPM_TOKEN wins (explicit operator intent), else the user-level ~/.npmrc's
-// literal `//<host>/:_authToken=<value>` (ignoring env-fed `${…}` values — those are
-// the trap, not a credential). Returns { token, source: 'env'|'user-npmrc'|null }.
-function resolveNpmToken({ env = process.env, homedir, fsImpl = fs, host = REGISTRY_HOST } = {}) {
-  const fromEnv = String(env[TOKEN_ENV] || '').trim();
-  if (fromEnv) return { token: fromEnv, source: 'env' };
-  const home = homedir || (env.HOME || env.USERPROFILE || '');
-  if (home) {
-    try {
-      const raw = fsImpl.readFileSync(path.join(home, '.npmrc'), 'utf8');
-      const re = new RegExp(`^\\s*//${host.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}/:_authToken\\s*=\\s*(.+?)\\s*$`, 'm');
-      const m = re.exec(raw);
-      const val = m && m[1].replace(/^["']|["']$/g, '');
-      if (val && !val.includes('${')) return { token: val, source: 'user-npmrc' };
-    } catch { /* no user npmrc, unreadable — fall through to null */ }
-  }
-  return { token: null, source: null };
-}
-
-// Has the operator opted the standalone scaffold into the registry path? OFF by
-// default — the vendored tarball stays the default until the registry path is proven
-// end-to-end (ADR 0134). '1'/'true'/'yes'/'on' (case-insensitive) → true.
-function registryCoreRequested(env = process.env) {
-  return /^(1|true|yes|on)$/i.test(String(env[REQUEST_ENV] || '').trim());
-}
-
-// Write the env-fed `.npmrc` into an instance dir. Default overwrites (a greenfield
-// scaffold owns the file); pass overwrite:false to leave a pre-existing `.npmrc`
-// untouched (an upgrade must not clobber a consumer's other registries). Returns the
-// path (or null when skipped). Dry-run writes nothing.
-function writeNpmrc(dir, { fsImpl = fs, dryRun = false, overwrite = true, log = () => {} } = {}) {
-  const p = path.join(dir, '.npmrc');
-  if (!overwrite && fsImpl.existsSync(p)) {
-    log(`  • .npmrc already present — left untouched (add \`${CORE_SCOPE}:registry\` + \`_authToken=\${${TOKEN_ENV}}\` if the private core doesn't resolve).`);
-    return null;
-  }
-  if (dryRun) {
-    log(`  [dry-run] would write ${p} (env-fed ${CORE_SCOPE} auth; token via $${TOKEN_ENV}, never committed)`);
-    return p;
-  }
-  fsImpl.writeFileSync(p, npmrcContent());
-  log(`  ✓ wrote .npmrc (env-fed ${CORE_SCOPE} auth; token via $${TOKEN_ENV}, never committed)`);
-  return p;
-}
-
-module.exports = {
-  REGISTRY_HOST, CORE_SCOPE, TOKEN_ENV, REQUEST_ENV,
-  npmrcContent, hasNpmToken, resolveNpmToken, registryCoreRequested, writeNpmrc,
-};
-
-// Tiny CLI: `node scripts/gds/npmrc.js [--print | --write <dir>]` — print the `.npmrc`
-// body or materialize it into <dir>. Handy for a manual registry-standup rehearsal.
-if (require.main === module) {
-  const args = process.argv.slice(2);
-  const writeIdx = args.indexOf('--write');
-  if (writeIdx !== -1 && args[writeIdx + 1]) {
-    const p = writeNpmrc(path.resolve(args[writeIdx + 1]), { log: console.log });
-    process.stdout.write(`${p}\n`);
-  } else {
-    process.stdout.write(npmrcContent());
-  }
-}