@bongos/core 1.19.738 → 1.19.740

package/docs/module-api-changelog.md

@@ -1950,5 +1950,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.736 with no explicit bump. run 34795026282. (task 1002620)
   1.19.738 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.737 with no explicit bump. run 34797297122. (task 1002620)
+  1.19.739 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.738 with no explicit bump. run 34838475604. (task 1002620)
+  1.19.740 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.739 with no explicit bump. run 34839732962. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/private-npm-distribution.md

@@ -14,7 +14,7 @@
 |---|---|---|
 | `@bongos/core` | the platform an instance installs + the `bongos` CLI (`bin`) | `bongos package-core` (`scripts/gds/package-core.js`) — synthesizes the package.json + a pruned lockfile, redacts, and packs a `.tgz` |
 
-`@bongos/core` carries `publishConfig: { access: "restricted" }`, so **publishing it is private by default** — no public leak if a flag is forgotten.
+`@bongos/core` carries `publishConfig: { access: "public" }`, and `publishArgs` passes `--access public` as well — both, so neither drifting alone can silently take the package back to restricted ([ADR 0283](../adr/0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md)). It read `restricted` until 2026-09-13; what protects the artifact is the no-leak gate on the build, not who may fetch it.
 
 The generated typed client (`node scripts/gds/gen-api-client.js` → `clients/bongos-client/`) is deliberately **not** in this table: it is not published, carries no `publishConfig`, and is consumed by vendoring. See its own README.
 
@@ -33,15 +33,15 @@ These involve payment and permanent, account-level actions. They are **not** don
 Always preview with a dry-run first (no upload, no login needed):
 
 ```sh
-# Core — build the tarball and DRY-RUN the private publish:
+# Core — build the tarball and DRY-RUN the publish:
 node scripts/gds/package-core.js --publish
 ```
 
-Look for `restricted access` and the `@bongos/core@<version>` line. When it looks right, publish for real (this is **permanent** — npm can't delete a name after 72h):
+Look for `public access` and the `@bongos/core@<version>` line. When it looks right, publish for real (this is **permanent and public** — npm can't delete a name after 72h, and the version is never reusable):
 
 ```sh
 npm login                                         # once per machine (+ 2FA)
-node scripts/gds/package-core.js --publish --live # actually publishes, still private
+node scripts/gds/package-core.js --publish --live # actually publishes, PUBLIC
 ```
 
 For the client (note the `./` — without it, npm reads the path as a git package spec, not a folder):
@@ -101,13 +101,13 @@ A tokenless registry `npm ci` 404s cleanly (`E404 … @bongos/core … could not
 
 > **Proven end-to-end (2026-07-08, task 2118 / blocker 71).** A real `bongos init --registry-core` scaffold, with a valid read-only token in `NPM_TOKEN`, resolved `@bongos/core@1.17.0` straight from `registry.npmjs.org` and generated a reproducible `package-lock.json`. Both legs are confirmed: the registry pull works with a token and fails closed (404) without one. Provisioning still defaults to the vendored tarball until an owner explicitly sets `PROVISION_CORE_FROM_REGISTRY=1` on a live runner.
 
-## Going public at launch
+## Going public — DONE 2026-09-13
 
-Pick either — both keep the daily `bongos` command working:
+`@bongos/core` is public ([ADR 0283](../adr/0283-the-core-publishes-publicly-because-access-was-never-the-thing-protecting-it.md), [task 1003872](https://cloudbongos.com/builders#/task/1003872)). `publishConfig.access` is `"public"` and the registry-side status was flipped with the one-time owner step:
 
-- **Flip the same scoped packages public** (simplest):
-  ```sh
-  npm access public @bongos/core
-  ```
-  (Or change `publishConfig.access` to `"public"` and republish.) Public installs need no token; the paid seats can be dropped.
+```sh
+npm access set status=public @bongos/core
+```
+
+That registry flip is separate from `--access public` on a publish, which governs only what *that* publish declares and is historically a no-op when re-publishing an already-private package. Verify the flip by a tokenless install from a clean `HOME`, not by the flag's presence. Public installs need no token; the paid private-package seats can be dropped.
 - **Also publish the unscoped vanity name** for `npm install -g cloudbongos` — that is [task 2025](https://example.com/builders#/task/2025) (rename in `package-core.js`/`upgrade.js` + docs), done at launch.

package/modules/public-landing/public/projects.html

@@ -985,12 +985,19 @@ summary{min-height:24px;padding:3px 0;}
                  the reason is stated here, on the path every founder actually takes —
                  not only on the Home step's re-connect branch (task 1003232). -->
             <p class="finePrint" id="wizScopeNote">Signing in asks GitHub for repository access. GitHub words this as access to <em>all</em> your repositories — that is the only permission it offers that can write to a private repo. We use it to create (or read) the one repo your project lives in and push its starting files. Nothing else is touched.</p>
-            <!-- Trust link → the AGPL license text (task 1002705): the old private-repo URL
-                 404ed, and no public code artifact exists until the ADR 0099 mirror flips
-                 (~2026-11; npm scopes are private too) — the license is the one live,
-                 instance-neutral artifact behind the claim today. -->
+            <!-- Trust links (task 1003502, superseding task 1002705's license-only fallback).
+                 TWO links, because the sentence makes two claims: "open source" → the CODE,
+                 "(AGPL-3.0)" → the licence it is under. The code half was impossible until
+                 2026-09-13 — the old private-repo URL 404ed, both npm scopes were private,
+                 and the ADR 0099 mirror is dormant until ~2026-11, which left the licence
+                 text as the only live artifact. Task 1003872 / ADR 0283 published
+                 @bongos/core publicly, so the claim now resolves to the platform itself
+                 (npm renders a README + a browsable Code tab; verified by a tokenless
+                 `npm pack` from a clean HOME, the ADR 0283 standard). Not @cloudbongos/cli:
+                 that is the 32-file generated client, a slice of the thing being claimed. -->
             <p class="finePrint">Free while we find our feet. Your project’s repo and server are yours —
-              <span data-brand-product-inline>Cloud Bongos</span> is <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">open source (AGPL-3.0)</a>
+              <span data-brand-product-inline>Cloud Bongos</span> is <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">open source</a>
+              (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>)
               and capture-resistant by design.</p>
             <div class="alert" id="wizGateAlert" role="alert"></div>
           </section>
@@ -1016,7 +1023,8 @@ summary{min-height:24px;padding:3px 0;}
               </div>
             </form>
             <p class="finePrint">Free while we find our feet. Your project’s repo and server are yours —
-              <span data-brand-product-inline>Cloud Bongos</span> is <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">open source (AGPL-3.0)</a>
+              <span data-brand-product-inline>Cloud Bongos</span> is <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">open source</a>
+              (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>)
               and capture-resistant by design.</p>
           </section>
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.738",
+  "version": "1.19.740",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.738",
+      "version": "1.19.740",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.738",
+  "version": "1.19.740",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/package-core.js

@@ -580,7 +580,8 @@ function publishArgs(tgzPath, live) {
 
 // Publish (or dry-run) the built .tgz to npm. Auth is npm's own concern — this
 // never holds a token; it shells out to `npm publish` and the owner's `npm login`
-// (+ the cloudbongos org on a paid plan, for a PRIVATE scoped publish) provides it.
+// provides it. The package is PUBLIC (task 1003872, ADR 0283), so no paid org plan
+// is involved — a public scoped publish needs none.
 // The child's stdout is routed to OUR stderr so main()'s machine-readable pin on
 // stdout stays clean for CI capture.
 function publishTarball({ tgzPath, live }) {
@@ -589,16 +590,16 @@ function publishTarball({ tgzPath, live }) {
   console.error(`[package-core] ${live ? 'PUBLISH (permanent)' : 'publish DRY-RUN'} → ${NPM_BIN} ${args.join(' ')}`);
   if (!live) {
     console.error('  Dry-run: nothing is uploaded. To publish for real: re-run with --publish --live.');
-    console.error('  That is PERMANENT and requires `npm login` + the cloudbongos npm org on a paid plan');
-    console.error('  (private scoped publish needs one). Going public later: `npm access public @bongos/core`.');
+    console.error('  That is PERMANENT and PUBLIC (ADR 0283) — anyone can fetch it, and a version is never');
+    console.error('  reusable once taken. It requires `npm login`; no paid org plan (the package is public).');
   }
   const r = spawnSync(NPM_BIN, args, { cwd: REPO_ROOT, stdio: ['inherit', process.stderr, 'inherit'] });
   if (r.error || r.status !== 0) {
     console.error(`[package-core] npm publish ${live ? '' : '--dry-run '}FAILED (${r.error ? r.error.message : `exit ${r.status}`}).`);
-    if (live) console.error('  Common causes: not logged in (`npm login`), the org isn’t on a paid plan (private scoped publish requires one), or 2FA.');
+    if (live) console.error('  Common causes: not logged in (`npm login`), no publish rights on the @bongos scope, that version already taken, or 2FA.');
     process.exit(r.status || 1);
   }
-  console.error(`[package-core] npm publish ${live ? 'succeeded — @bongos/core is live (private).' : 'dry-run OK — the tarball is publishable.'}`);
+  console.error(`[package-core] npm publish ${live ? 'succeeded — @bongos/core is live and PUBLIC on the registry.' : 'dry-run OK — the tarball is publishable.'}`);
 }
 
 // The neutral FLOOR — customer-zero identity tokens a portable core must never carry (task 1002220
@@ -1048,7 +1049,7 @@ module.exports = {
   isAgentDoc, CORE_AGENT_DOC_STUB,
   // task 1882 (ADR 0108 §2) — the real installable npm package
   CORE_DEP_NAMES, buildPackageJson, resolveLockDep, lockfileClosure, prunePackageLock,
-  // task 2089 (ADR 0134) — private-by-default npm publish
+  // task 2089 (ADR 0134) — the npm publish argv; PUBLIC since task 1003872 / ADR 0283
   publishArgs,
   // task 1002218 (audit H3) — build-time self-verify (reproduce pin + optional bare-install boot)
   selfVerify, reproducePinFromTree,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.738'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.740'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/onboard.mjs

@@ -213,17 +213,24 @@ test('the wizard done panel is plan-driven, manifest-driven, and owner-honest (t
   assert.match(src, /id="c-adopt"/, 'the private path (adopt your own private repo) is named');
 });
 
-test('the wizard gate trust link points at a live artifact, not the dead private-repo URL (task 1002705)', () => {
+test('the wizard gate trust link points at browsable code, not just the license (tasks 1002705, 1003502)', () => {
   // Gap 1 of the project-creation audit: the gate linked a nonexistent private repo
-  // (404 even authenticated — ADR 0167 names it). No public code artifact exists yet
-  // (the ADR 0099 mirror is dormant until ~2026-11, and both npm scopes 404 anonymously
-  // — verified 2026-08-12), so the one live, instance-neutral artifact behind
-  // "open source" is the license itself.
+  // (404 even authenticated — ADR 0167 names it). Task 1002705 fell back to the license
+  // text because nothing else was live: the ADR 0099 mirror is dormant until ~2026-11,
+  // and both npm scopes 404ed anonymously (verified 2026-08-12).
+  //
+  // THAT PREMISE DIED 2026-09-13 (task 1003872 / ADR 0283): @bongos/core publishes
+  // PUBLIC, and a tokenless `npm pack` from a clean HOME fetches the platform. So the
+  // sentence now splits its two claims across two links — "open source" at the code,
+  // "(AGPL-3.0)" at the license — and BOTH are asserted here. Do not collapse them:
+  // dropping the npm link silently returns the gate to claiming open source while
+  // showing only a license, which is the defect task 1003502 was filed about.
   const { readFileSync } = require('node:fs');
   const path = require('node:path');
   const src = readFileSync(path.join(import.meta.dirname, '..', 'modules/public-landing/public/projects.html'), 'utf8');
   assert.doesNotMatch(src, /Claude-OTB/, 'the dead repo link is gone');
-  assert.match(src, /https:\/\/www\.gnu\.org\/licenses\/agpl-3\.0/, 'the trust link resolves (the AGPL-3.0 license text)');
+  assert.match(src, /https:\/\/www\.npmjs\.com\/package\/@bongos\/core/, 'the trust link reaches browsable code (the public @bongos/core package)');
+  assert.match(src, /https:\/\/www\.gnu\.org\/licenses\/agpl-3\.0/, 'and the license it is under is still one click away');
 });
 
 test('oauthAppInstructions pins the apex callback + homepage and points at ACCOUNT Developer settings', () => {