@bongos/core 1.19.738 → 1.19.739

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.738",
-  "core_contract": "1.19.738",
-  "source_commit": "37a35be93e9879af0144594f30a8a894a84502f5",
+  "core_version": "1.19.739",
+  "core_contract": "1.19.739",
+  "source_commit": "007654ffe674e9720a1e9227b87dc010b35178d9",
   "source_ref": "HEAD",
-  "built_at": "2026-09-14T01:52:45.616Z",
+  "built_at": "2026-09-14T11:30:11.483Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 479,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2610,
-  "tree_sha256": "476bbdb5c1700b8ecf374a05e95a28bc6c61df721e5eb815c65439e08126feab",
+  "tree_sha256": "387827a54efbdc59d0986629636d11366a72c83e8518a3f621bfffe13e020b61",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2492,7 +2492,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "63fe92dfdaaacde0ba4dfb7882c97c6b875cd90d9b5f3dac0dacc404dbb1531f"
+      "sha256": "e1e65fc287020112074f69a451cba3e80b6c6e04ab746404c7a0db44f95f1c46"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2702,7 +2702,7 @@
     {
       "path": "docs/recipes/private-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "33e4f7f3083b8ac5d10f117d4d93e78b9d8b7b4d082087051b69698cb67b03b1"
+      "sha256": "6d488eff1dd8201debb991ba854c59b5404235b1a433403dbedecaf0638128e4"
     },
     {
       "path": "docs/recipes/redteam-patrol.md",
@@ -7537,12 +7537,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "35ace7cf502387465f75cea83b1159bb82349d019555503f51769a264fd19c3e"
+      "sha256": "f49b1b8e922b2717a695ddb091d8cb8e4f574634f2d6b57cb888a7a4dc7d38b0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4fbaebd587863651e105d72ed373cef166d16eebd5f86a5d51395d98c33c5f60"
+      "sha256": "7f2a45d17d4d9dadcf80e5da376e648e607de28b3b8150fea3120e1dd4a3fee4"
     },
     {
       "path": "public-docs/index.html",
@@ -8327,7 +8327,7 @@
     {
       "path": "scripts/gds/package-core.js",
       "mode": "0000644",
-      "sha256": "89ec2a080f397e1af5c0dede40a7eb22a2e3343d219da4b4a4ba903337bcc420"
+      "sha256": "d9a6748c0dadbff9954809df1c83345979e1356559312723e107f19949edfd7b"
     },
     {
       "path": "scripts/gds/paste-token.js",
@@ -9342,7 +9342,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4c5bdcc7f30c8ae47bdb1ecb596b692bd6405a227fc895fa5bfcd33cd8f92340"
+      "sha256": "778ccc0ac1fe12d16e101aad85011d19d8fab03f00fa42fce71a26ec9b600fe2"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/module-api-changelog.md

@@ -1950,5 +1950,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.736 with no explicit bump. run 34795026282. (task 1002620)
   1.19.738 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.737 with no explicit bump. run 34797297122. (task 1002620)
+  1.19.739 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.738 with no explicit bump. run 34838475604. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/private-npm-distribution.md

@@ -14,7 +14,7 @@
 |---|---|---|
 | `@bongos/core` | the platform an instance installs + the `bongos` CLI (`bin`) | `bongos package-core` (`scripts/gds/package-core.js`) — synthesizes the package.json + a pruned lockfile, redacts, and packs a `.tgz` |
 
-`@bongos/core` carries `publishConfig: { access: "restricted" }`, so **publishing it is private by default** — no public leak if a flag is forgotten.
+`@bongos/core` carries `publishConfig: { access: "public" }`, and `publishArgs` passes `--access public` as well — both, so neither drifting alone can silently take the package back to restricted ([ADR 0283](../adr/0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md)). It read `restricted` until 2026-09-13; what protects the artifact is the no-leak gate on the build, not who may fetch it.
 
 The generated typed client (`node scripts/gds/gen-api-client.js` → `clients/bongos-client/`) is deliberately **not** in this table: it is not published, carries no `publishConfig`, and is consumed by vendoring. See its own README.
 
@@ -33,15 +33,15 @@ These involve payment and permanent, account-level actions. They are **not** don
 Always preview with a dry-run first (no upload, no login needed):
 
 ```sh
-# Core — build the tarball and DRY-RUN the private publish:
+# Core — build the tarball and DRY-RUN the publish:
 node scripts/gds/package-core.js --publish
 ```
 
-Look for `restricted access` and the `@bongos/core@<version>` line. When it looks right, publish for real (this is **permanent** — npm can't delete a name after 72h):
+Look for `public access` and the `@bongos/core@<version>` line. When it looks right, publish for real (this is **permanent and public** — npm can't delete a name after 72h, and the version is never reusable):
 
 ```sh
 npm login                                         # once per machine (+ 2FA)
-node scripts/gds/package-core.js --publish --live # actually publishes, still private
+node scripts/gds/package-core.js --publish --live # actually publishes, PUBLIC
 ```
 
 For the client (note the `./` — without it, npm reads the path as a git package spec, not a folder):
@@ -101,13 +101,13 @@ A tokenless registry `npm ci` 404s cleanly (`E404 … @bongos/core … could not
 
 > **Proven end-to-end (2026-07-08, task 2118 / blocker 71).** A real `bongos init --registry-core` scaffold, with a valid read-only token in `NPM_TOKEN`, resolved `@bongos/core@1.17.0` straight from `registry.npmjs.org` and generated a reproducible `package-lock.json`. Both legs are confirmed: the registry pull works with a token and fails closed (404) without one. Provisioning still defaults to the vendored tarball until an owner explicitly sets `PROVISION_CORE_FROM_REGISTRY=1` on a live runner.
 
-## Going public at launch
+## Going public — DONE 2026-09-13
 
-Pick either — both keep the daily `bongos` command working:
+`@bongos/core` is public ([ADR 0283](../adr/0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md), [task 1003872](https://cloudbongos.com/builders#/task/1003872)). `publishConfig.access` is `"public"` and the registry-side status was flipped with the one-time owner step:
 
-- **Flip the same scoped packages public** (simplest):
-  ```sh
-  npm access public @bongos/core
-  ```
-  (Or change `publishConfig.access` to `"public"` and republish.) Public installs need no token; the paid seats can be dropped.
+```sh
+npm access set status=public @bongos/core
+```
+
+That registry flip is separate from `--access public` on a publish, which governs only what *that* publish declares and is historically a no-op when re-publishing an already-private package. Verify the flip by a tokenless install from a clean `HOME`, not by the flag's presence. Public installs need no token; the paid private-package seats can be dropped.
 - **Also publish the unscoped vanity name** for `npm install -g cloudbongos` — that is [task 2025](https://example.com/builders#/task/2025) (rename in `package-core.js`/`upgrade.js` + docs), done at launch.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.738",
+  "version": "1.19.739",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.738",
+      "version": "1.19.739",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.738",
+  "version": "1.19.739",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/package-core.js

@@ -580,7 +580,8 @@ function publishArgs(tgzPath, live) {
 
 // Publish (or dry-run) the built .tgz to npm. Auth is npm's own concern — this
 // never holds a token; it shells out to `npm publish` and the owner's `npm login`
-// (+ the cloudbongos org on a paid plan, for a PRIVATE scoped publish) provides it.
+// provides it. The package is PUBLIC (task 1003872, ADR 0283), so no paid org plan
+// is involved — a public scoped publish needs none.
 // The child's stdout is routed to OUR stderr so main()'s machine-readable pin on
 // stdout stays clean for CI capture.
 function publishTarball({ tgzPath, live }) {
@@ -589,16 +590,16 @@ function publishTarball({ tgzPath, live }) {
   console.error(`[package-core] ${live ? 'PUBLISH (permanent)' : 'publish DRY-RUN'} → ${NPM_BIN} ${args.join(' ')}`);
   if (!live) {
     console.error('  Dry-run: nothing is uploaded. To publish for real: re-run with --publish --live.');
-    console.error('  That is PERMANENT and requires `npm login` + the cloudbongos npm org on a paid plan');
-    console.error('  (private scoped publish needs one). Going public later: `npm access public @bongos/core`.');
+    console.error('  That is PERMANENT and PUBLIC (ADR 0283) — anyone can fetch it, and a version is never');
+    console.error('  reusable once taken. It requires `npm login`; no paid org plan (the package is public).');
   }
   const r = spawnSync(NPM_BIN, args, { cwd: REPO_ROOT, stdio: ['inherit', process.stderr, 'inherit'] });
   if (r.error || r.status !== 0) {
     console.error(`[package-core] npm publish ${live ? '' : '--dry-run '}FAILED (${r.error ? r.error.message : `exit ${r.status}`}).`);
-    if (live) console.error('  Common causes: not logged in (`npm login`), the org isn’t on a paid plan (private scoped publish requires one), or 2FA.');
+    if (live) console.error('  Common causes: not logged in (`npm login`), no publish rights on the @bongos scope, that version already taken, or 2FA.');
     process.exit(r.status || 1);
   }
-  console.error(`[package-core] npm publish ${live ? 'succeeded — @bongos/core is live (private).' : 'dry-run OK — the tarball is publishable.'}`);
+  console.error(`[package-core] npm publish ${live ? 'succeeded — @bongos/core is live and PUBLIC on the registry.' : 'dry-run OK — the tarball is publishable.'}`);
 }
 
 // The neutral FLOOR — customer-zero identity tokens a portable core must never carry (task 1002220
@@ -1048,7 +1049,7 @@ module.exports = {
   isAgentDoc, CORE_AGENT_DOC_STUB,
   // task 1882 (ADR 0108 §2) — the real installable npm package
   CORE_DEP_NAMES, buildPackageJson, resolveLockDep, lockfileClosure, prunePackageLock,
-  // task 2089 (ADR 0134) — private-by-default npm publish
+  // task 2089 (ADR 0134) — the npm publish argv; PUBLIC since task 1003872 / ADR 0283
   publishArgs,
   // task 1002218 (audit H3) — build-time self-verify (reproduce pin + optional bare-install boot)
   selfVerify, reproducePinFromTree,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.738'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.739'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');