@bongos/core 1.19.739 → 1.19.741

package/docs/module-api-changelog.md

@@ -1952,5 +1952,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.737 with no explicit bump. run 34797297122. (task 1002620)
   1.19.739 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.738 with no explicit bump. run 34838475604. (task 1002620)
+  1.19.740 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.739 with no explicit bump. run 34839732962. (task 1002620)
+  1.19.741 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.740 with no explicit bump. run 34977074381. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/public-landing/public/projects.html

@@ -985,12 +985,19 @@ summary{min-height:24px;padding:3px 0;}
                  the reason is stated here, on the path every founder actually takes —
                  not only on the Home step's re-connect branch (task 1003232). -->
             <p class="finePrint" id="wizScopeNote">Signing in asks GitHub for repository access. GitHub words this as access to <em>all</em> your repositories — that is the only permission it offers that can write to a private repo. We use it to create (or read) the one repo your project lives in and push its starting files. Nothing else is touched.</p>
-            <!-- Trust link → the AGPL license text (task 1002705): the old private-repo URL
-                 404ed, and no public code artifact exists until the ADR 0099 mirror flips
-                 (~2026-11; npm scopes are private too) — the license is the one live,
-                 instance-neutral artifact behind the claim today. -->
+            <!-- Trust links (task 1003502, superseding task 1002705's license-only fallback).
+                 TWO links, because the sentence makes two claims: "open source" → the CODE,
+                 "(AGPL-3.0)" → the licence it is under. The code half was impossible until
+                 2026-09-13 — the old private-repo URL 404ed, both npm scopes were private,
+                 and the ADR 0099 mirror is dormant until ~2026-11, which left the licence
+                 text as the only live artifact. Task 1003872 / ADR 0283 published
+                 @bongos/core publicly, so the claim now resolves to the platform itself
+                 (npm renders a README + a browsable Code tab; verified by a tokenless
+                 `npm pack` from a clean HOME, the ADR 0283 standard). Not @cloudbongos/cli:
+                 that is the 32-file generated client, a slice of the thing being claimed. -->
             <p class="finePrint">Free while we find our feet. Your project’s repo and server are yours —
-              <span data-brand-product-inline>Cloud Bongos</span> is <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">open source (AGPL-3.0)</a>
+              <span data-brand-product-inline>Cloud Bongos</span> is <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">open source</a>
+              (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>)
               and capture-resistant by design.</p>
             <div class="alert" id="wizGateAlert" role="alert"></div>
           </section>
@@ -1016,7 +1023,8 @@ summary{min-height:24px;padding:3px 0;}
               </div>
             </form>
             <p class="finePrint">Free while we find our feet. Your project’s repo and server are yours —
-              <span data-brand-product-inline>Cloud Bongos</span> is <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">open source (AGPL-3.0)</a>
+              <span data-brand-product-inline>Cloud Bongos</span> is <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">open source</a>
+              (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>)
               and capture-resistant by design.</p>
           </section>
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.739",
+  "version": "1.19.741",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.739",
+      "version": "1.19.741",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.739",
+  "version": "1.19.741",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.739'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.741'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/onboard.mjs

@@ -213,17 +213,24 @@ test('the wizard done panel is plan-driven, manifest-driven, and owner-honest (t
   assert.match(src, /id="c-adopt"/, 'the private path (adopt your own private repo) is named');
 });
 
-test('the wizard gate trust link points at a live artifact, not the dead private-repo URL (task 1002705)', () => {
+test('the wizard gate trust link points at browsable code, not just the license (tasks 1002705, 1003502)', () => {
   // Gap 1 of the project-creation audit: the gate linked a nonexistent private repo
-  // (404 even authenticated — ADR 0167 names it). No public code artifact exists yet
-  // (the ADR 0099 mirror is dormant until ~2026-11, and both npm scopes 404 anonymously
-  // — verified 2026-08-12), so the one live, instance-neutral artifact behind
-  // "open source" is the license itself.
+  // (404 even authenticated — ADR 0167 names it). Task 1002705 fell back to the license
+  // text because nothing else was live: the ADR 0099 mirror is dormant until ~2026-11,
+  // and both npm scopes 404ed anonymously (verified 2026-08-12).
+  //
+  // THAT PREMISE DIED 2026-09-13 (task 1003872 / ADR 0283): @bongos/core publishes
+  // PUBLIC, and a tokenless `npm pack` from a clean HOME fetches the platform. So the
+  // sentence now splits its two claims across two links — "open source" at the code,
+  // "(AGPL-3.0)" at the license — and BOTH are asserted here. Do not collapse them:
+  // dropping the npm link silently returns the gate to claiming open source while
+  // showing only a license, which is the defect task 1003502 was filed about.
   const { readFileSync } = require('node:fs');
   const path = require('node:path');
   const src = readFileSync(path.join(import.meta.dirname, '..', 'modules/public-landing/public/projects.html'), 'utf8');
   assert.doesNotMatch(src, /Claude-OTB/, 'the dead repo link is gone');
-  assert.match(src, /https:\/\/www\.gnu\.org\/licenses\/agpl-3\.0/, 'the trust link resolves (the AGPL-3.0 license text)');
+  assert.match(src, /https:\/\/www\.npmjs\.com\/package\/@bongos\/core/, 'the trust link reaches browsable code (the public @bongos/core package)');
+  assert.match(src, /https:\/\/www\.gnu\.org\/licenses\/agpl-3\.0/, 'and the license it is under is still one click away');
 });
 
 test('oauthAppInstructions pins the apex callback + homepage and points at ACCOUNT Developer settings', () => {