@bongos/core 1.19.766 → 1.19.767

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.766",
-  "core_contract": "1.19.766",
-  "source_commit": "02a01e26d1d999916c8c67e1e02b06d0db40b694",
+  "core_version": "1.19.767",
+  "core_contract": "1.19.767",
+  "source_commit": "eb349d772c37baba9353ce3d7e4fb60ee0c50120",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T13:48:32.669Z",
+  "built_at": "2026-09-16T14:32:00.184Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2122,
+    "functional_verbatim": 2123,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2630,
-  "tree_sha256": "56708a327bb43ff2237f2ef0cdd0fac079947882699533e825262e7a16bcf724",
+  "file_count": 2631,
+  "tree_sha256": "a176823f439c4744fa68e223d9a6c892eae966f0584eca0fc53b785e65a80bf1",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2502,7 +2502,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "f59041018367ebd25642c8f94c6ab2ad429fc67b2e917e5706185186717b0403"
+      "sha256": "9369c319c356283bdce655d126e78f339c9a329ecefc02d17c2997c45e583475"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "10fb4078df266a5663d8079411fdf7698adb1aa8e20a19ca63ff722e1ecb8134"
+      "sha256": "758ba4125664158bbbbedce4610178b629d74da7b8defb902caa63750be147f2"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7577,12 +7577,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6e4cfa58c41e8fbe29dc94bbe4bd7a4eafedb88034b7d1ba3334d4a0764f5b56"
+      "sha256": "c20cc0b8296799714beb07358a69f4c0c520adcbe121dfe53899cf5ee5dca0b6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b61349c8315ac531b941ca35f84a7323b2192e0ab7507c4d76e1c592c2a9f2e7"
+      "sha256": "734c747e81d3c512988159903a57a4ce901b67c353ea77fe7e253f4814cab10a"
     },
     {
       "path": "public-docs/index.html",
@@ -7754,6 +7754,11 @@
       "mode": "0000644",
       "sha256": "4646bd6da8be2d2c40c1063bba47f5fdce0f2f63143e26fc16e36ea941adbc88"
     },
+    {
+      "path": "scripts/gds/backup-dropin-sweep.sh",
+      "mode": "0000644",
+      "sha256": "bfbac57a3e282e1b482a967733eb8f39a15d97ffc8c24b4348370e4a11acc160"
+    },
     {
       "path": "scripts/gds/backup.js",
       "mode": "0000644",
@@ -9397,7 +9402,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9c4c56d73c466a19a699f6c37e439d54d88211a363a869f9d87e3e840f493a2a"
+      "sha256": "9be4adbc202e2c681d8a2ebba85d6ce541cd8a75d10a8802e1042b43e75f50c0"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/file-map.md

@@ -187,6 +187,7 @@
 │       ├── seed-v3-tasks.js     ← V3 Planning Session #1: 80 net-new GDS-V3 tasks (V3.R01–V3.R89) + 10 idea_inbox promotions; idempotent on source_ref
 │       ├── backfill-cost.js     ← read art ledger → POST /api/gds/cost (idempotent)
 │       ├── smoke-write.sh       ← write-path smoke (create→claim→ship round-trip)
+│       ├── backup-dropin-sweep.sh ← (task 1003930) control-plane sweep: retires the temporary task-1003925 backup drop-in from each project whose pinned core carries the fix (1.19.750+), proving one backup succeeds without it first; survey by default, `--apply` to act; re-run after each pin moves
 │       ├── smoke-gds.js         ← public-surface + 401-check smoke test (asserts /api/pms/* now 404s — removed in V3.R01-followup #308)
 │       ├── box.js               ← (#598/ADR 0031) per-builder dev box lifecycle CLI: provision·park·wake·deprovision·sweep-idle·sweep-dormant·status (dry-run default, --apply to act; rank-gated)
 │       ├── smoke-box.sh         ← (#598) hermetic box-lifecycle smoke (no DB/DO/network): runs tests/boxes.mjs + tests/cf_tunnel.mjs (#771 named tunnel) + route-rank + module-load

package/docs/module-api-changelog.md

@@ -2006,5 +2006,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.764 with no explicit bump. run 35102327521. (task 1002620)
   1.19.766 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.765 with no explicit bump. run 35104246900. (task 1002620)
+  1.19.767 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.766 with no explicit bump. run 35109111074. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.766",
+  "version": "1.19.767",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.766",
+      "version": "1.19.767",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.766",
+  "version": "1.19.767",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/backup-dropin-sweep.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# scripts/gds/backup-dropin-sweep.sh — retire the TEMPORARY task-1003925 backup drop-ins
+# once a project's pinned core carries the fix (task 1003930, ADR 0285 follow-up).
+#
+# WHY. Before the nightly-backup fix (task 1003925, core 1.19.750) reached any
+# project, the 10 live project backup units on the control plane got a systemd
+# drop-in — /etc/systemd/system/<slug>-db-backup.service.d/task-1003925-min-bytes.conf
+# (the backup script's min-bytes override, `*_BACKUP_MIN_BYTES=4096`) — so their
+# small-but-valid dumps stopped being rejected.
+# That workaround lives outside every repo, nothing removes it, and while it stays it
+# hides whether the shipped fix actually works per project. Projects move to the fixed
+# core one pin at a time, so this is a SWEEP to re-run after each pin moves, not a
+# one-shot: each run retires only the drop-ins whose project can prove it no longer
+# needs one (a backup run succeeds without it), and names the rest.
+#
+# Run on the control plane as a sudoer:
+#   bash scripts/gds/backup-dropin-sweep.sh            # survey only — read-only, no sudo writes
+#   bash scripts/gds/backup-dropin-sweep.sh --apply    # retire the eligible drop-ins + clear ghosts
+#
+# --apply, per eligible project (pinned core >= FIX_VERSION and drop-in present):
+#   rm the drop-in, daemon-reload, `systemctl start <slug>-db-backup.service`, wait for it,
+#   and require exit 0 AND a new dump under /var/backups/gds — else the drop-in is put back
+#   and the project is reported, so a project is never left with no backup at all.
+# Then: `systemctl reset-failed` on any *-db-backup unit whose files are gone (a torn-down
+# project's ghost; teardown removes the files but not the failed state — task 1003940).
+set -uo pipefail
+
+FIX_VERSION="${FIX_VERSION:-1.19.750}"
+DROPIN=task-1003925-min-bytes.conf
+BACKUP_DIR=/var/backups/gds
+APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
+
+# The safety copies of retired drop-ins live in a root-owned, mode-0700, mktemp-named
+# dir for the length of one run — never a predictable /tmp/<slug> path a lower-privileged
+# local account could pre-stage a symlink at (CWE-377 / CWE-367 on a shared box). Created
+# only under --apply; removed on exit whatever happened.
+WORK=""
+if [ "$APPLY" = 1 ]; then
+  WORK=$(sudo -n mktemp -d /var/tmp/backup-dropin-sweep.XXXXXX) || { echo "cannot create a root-owned work dir"; exit 1; }
+  trap 'sudo -n rm -rf "$WORK"' EXIT
+fi
+
+# The project's pinned core version: the installed inner manifest under its own checkout.
+core_of() {
+  local slug=$1 pj
+  for pj in "/srv/cloudbongos/$slug/node_modules/@bongos/core/package.json" "/home/lars/$slug/node_modules/@bongos/core/package.json"; do
+    if sudo -n test -r "$pj"; then sudo -n node -e "console.log(require(process.argv[1]).version)" "$pj" 2>/dev/null && return; fi
+  done
+  echo "unknown"
+}
+# semver-ish: is $1 >= $2 ? (sort -V puts the smaller first)
+at_least() { [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -1)" = "$2" ]; }
+# The slug rides as a positional argument, never interpolated into the sh -c string.
+dump_count() { sudo -n sh -c 'ls "$1"-*.sql.gz 2>/dev/null | wc -l' _ "$BACKUP_DIR/$1"; }
+
+retired=(); kept=(); failed=()
+echo "== drop-ins vs pinned core (fix = $FIX_VERSION) =="
+for d in /etc/systemd/system/*-db-backup.service.d; do
+  [ -f "$d/$DROPIN" ] || continue
+  unit=$(basename "$d" .service.d); slug=${unit%-db-backup}
+  core=$(core_of "$slug")
+  if [ "$core" != "unknown" ] && at_least "$core" "$FIX_VERSION"; then verdict="ELIGIBLE"; else verdict="keeps drop-in"; fi
+  printf '  %-24s core=%-10s %s\n' "$slug" "$core" "$verdict"
+  if [ "$verdict" != "ELIGIBLE" ]; then kept+=("$slug ($core)"); continue; fi
+  [ "$APPLY" = 1 ] || { retired+=("$slug (would retire)"); continue; }
+  before=$(dump_count "$slug")
+  sudo -n cp "$d/$DROPIN" "$WORK/$slug.conf"
+  sudo -n rm -f "$d/$DROPIN"; sudo -n rmdir "$d" 2>/dev/null || true
+  sudo -n systemctl daemon-reload
+  # Type=oneshot (provision-units.js backupService): `start` blocks until the dump script exits.
+  sudo -n systemctl start "$unit.service"
+  after=$(dump_count "$slug")
+  if systemctl show -p Result --value "$unit.service" | grep -qx success && [ "$after" -gt "$before" ]; then
+    retired+=("$slug ($core; dumps $before→$after)")
+  else
+    sudo -n install -D -m 0644 "$WORK/$slug.conf" "$d/$DROPIN"; sudo -n systemctl daemon-reload
+    failed+=("$slug ($core; backup did not succeed without it — drop-in restored)")
+  fi
+done
+
+echo; echo "== failed *-db-backup units (ghosts of torn-down projects) =="
+ghosts=$(systemctl --failed --no-legend 2>/dev/null | awk '/db-backup/ {print $1 == "●" ? $2 : $1}')
+if [ -z "$ghosts" ]; then echo "  (none)"; else
+  for u in $ghosts; do
+    if [ -e "/etc/systemd/system/$u" ]; then echo "  $u: unit file still present — a real failure, not a ghost; left alone"; continue; fi
+    if [ "$APPLY" = 1 ]; then sudo -n systemctl reset-failed "$u" && echo "  $u: ghost cleared"; else echo "  $u: ghost (would reset-failed)"; fi
+  done
+fi
+
+echo; echo "== summary =="
+echo "  retired (${#retired[@]}): ${retired[*]:-none}"
+echo "  kept    (${#kept[@]}): ${kept[*]:-none}"
+echo "  failed  (${#failed[@]}): ${failed[*]:-none}"
+[ "$APPLY" = 1 ] || echo "  (survey only — re-run with --apply to act)"
+[ "${#failed[@]}" -eq 0 ]

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.766'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.767'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');