@bongos/core 1.19.82 → 1.19.84

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.82",
-  "core_contract": "1.19.82",
-  "source_commit": "9ca69eb29ee6b3ee602e17cbf1d1ef1ebc9df5f9",
+  "core_version": "1.19.84",
+  "core_contract": "1.19.84",
+  "source_commit": "39493e5006e0adc42f628e8fcc7a96ff0a10a024",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T23:14:31.232Z",
+  "built_at": "2026-08-12T23:32:24.005Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 295,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1227,
+    "functional_verbatim": 1234,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1543,
-  "tree_sha256": "253f8de922c6d8cc2023e6a2d28b363fafa2cfdec666f96afc3a0e5d879a918f",
+  "file_count": 1550,
+  "tree_sha256": "5b888a43d2616ba06ba176e5611635624d1e8f8d6bf60225393639f236b5fba9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -707,7 +707,7 @@
     {
       "path": "docs/adr/0055-server-mediated-branch-publish.md",
       "mode": "0000644",
-      "sha256": "a574107524d7b0c85130df49b2b165b94dc1d1b0efe1493b7952e49c053c8a53"
+      "sha256": "6f51c67939eacaf510774894625d0a09e6883e4c8e1d8fdea2cf35f8d9f58ea4"
     },
     {
       "path": "docs/adr/0056-prod-deploy-script-mirror-and-healthcheck-retry.md",
@@ -1354,6 +1354,16 @@
       "mode": "0000644",
       "sha256": "a86af6a923ed70bb8ea0846266f232f31a5fc9709d286362bcd37104d683342b"
     },
+    {
+      "path": "docs/design/mocks/component-sheet.html",
+      "mode": "0000644",
+      "sha256": "c77dbf2152c6109b6ce925e2badf6dfaa74f74c2d0cb7eb76fa1101eec7b3310"
+    },
+    {
+      "path": "docs/design/mocks/projects-page-mock.html",
+      "mode": "0000644",
+      "sha256": "c70f4c19af84280ed69a59e02633b53830035cbe8eb31d1b836fff6d454117b4"
+    },
     {
       "path": "docs/design/modular-architecture/00-research-report.md",
       "mode": "0000644",
@@ -1387,7 +1397,7 @@
     {
       "path": "docs/design/projects-surfaces-redesign-direction.md",
       "mode": "0000644",
-      "sha256": "90babf214f3ef90e44943af2dcb129aa2b8cfb9326d1f8cfdd19768db3fd6715"
+      "sha256": "750f39818862c66964788bb0dbc7dba6725ed6ad861f09536195fb3509342abf"
     },
     {
       "path": "docs/design/vanilla-hall-ui-redesign-scope.md",
@@ -3412,7 +3422,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "1a7ef193f9f2829668f5dd612972e6cca43fd84dec1e13d2b1c20f7fd99766f9"
+      "sha256": "0534cf4522f5a644301946abf6a703852375fe269401902dfae10d7b9192c3d5"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -3744,20 +3754,30 @@
       "mode": "0000644",
       "sha256": "230e8a9df147495ee5113c1400c582e9e39e3286baab7e01ce7684e1b1c7860c"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_006_liveness.sql",
+      "mode": "0000644",
+      "sha256": "49dee0b12551089acc0d7f218f1cba00b1377ba581770146734b2c2f71d3bf7c"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
-      "sha256": "a3ce933fa55e3d6e09dd76d24d105df649eb99911e0c3e3d4cb5b603eb8dafa0"
+      "sha256": "5fcab8bc3d4987c93138642abd6d2bcb997691cd54811ca10633c186d27713b5"
     },
     {
       "path": "modules/provisioning/onboard-plan.js",
       "mode": "0000644",
-      "sha256": "19224b44f22a18db651cfefa87c90c250e911dc1b1d00b76ed7c9361b505c037"
+      "sha256": "fe0990abe9087922ca2e376fed805b9138c5b716a684531c173b903c633bdffa"
+    },
+    {
+      "path": "modules/provisioning/pollers/liveness-sweep.js",
+      "mode": "0000644",
+      "sha256": "f47e30b7d4bc1275f65e29a1d9f987c7f20e6baa0a6c441fb4ddbb56f11fe58f"
     },
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "48c047c48579a1cb5cc6b36c2148bcab5c1736a16c4c73c0741a8998bfe922cd"
+      "sha256": "0363fd616966ec413d3c16bea222622ae0f9cf59a456627946c7cbdb89b7885e"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -3767,7 +3787,12 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "a8e2fa66eb19d119e117b80ca49832bec240cb71d167719e2a86f0032823b506"
+      "sha256": "f3242a86d28b91fb089d58b1d6ce1735946bcac15d6fe3438d79e805bf4ba1bc"
+    },
+    {
+      "path": "modules/provisioning/tests/liveness.mjs",
+      "mode": "0000644",
+      "sha256": "84a169641163d82fdaddecabb2e432b21addaf863055f5af046b9f7aa7d9ac23"
     },
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
@@ -4057,12 +4082,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b41abda8346dddd1c07e48067f2d9d0127aaad506519710b08cea5373a993b98"
+      "sha256": "af4e543cec8805d479252218ee7fb173f5daa82683719b544a5809c265426638"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0ed0a2fa31ababaeef64de35d41cba12b4308fef35fe2d831a0532ac503581c8"
+      "sha256": "34009dd8769a83f36d6825e22ac90bae4370416e06e280746c78ba44afcd9624"
     },
     {
       "path": "public-docs/index.html",
@@ -4299,6 +4324,11 @@
       "mode": "0000644",
       "sha256": "69d603ee6e73411d11716ee567d844aa4b467ab31168c1f7a6c106b397084e10"
     },
+    {
+      "path": "public-landing/assets/cosmos.css",
+      "mode": "0000644",
+      "sha256": "571c051fbd678d17a35202785ee42092886b9ffb17222e7d8dc21d97f20bf1e5"
+    },
     {
       "path": "public-landing/buddha.png",
       "mode": "0000644",
@@ -4307,7 +4337,7 @@
     {
       "path": "public-landing/create.html",
       "mode": "0000644",
-      "sha256": "419539862b5453d613a5ed3758a7d8fa677d16e463895ae64e6268a8d59372ba"
+      "sha256": "5f8dda878cea216fad95f722c4d17e8d35629e7e6040cf547eafcae1fb86d001"
     },
     {
       "path": "public-landing/gate/README.md",
@@ -4332,7 +4362,7 @@
     {
       "path": "public-landing/gate/index.html",
       "mode": "0000644",
-      "sha256": "8a4414738c6e120a965076b74136105a77544568f35d7f93c5fc717bf21b2473"
+      "sha256": "7e9e68da92493b0a728de0a4ff4d1a036d888df6b47267e5a5ac628ac55fcd07"
     },
     {
       "path": "public-landing/gate/previews/cloud-bongos.jpg",
@@ -4347,7 +4377,7 @@
     {
       "path": "public-landing/gate/space.css",
       "mode": "0000644",
-      "sha256": "0a0c0a6e2d0a70e3e435e51f0a256a0579ae02e3579d7a2be9f576a7f5b35450"
+      "sha256": "e6ab371ee547125e6d28098ee367a9021bff4d2dde566448ef014c08a6ebed44"
     },
     {
       "path": "public-landing/gate/space.js",
@@ -4382,7 +4412,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "5cddb3577caebe5fa41e0782a5b79e9f7cefae79eff195a5379f20cdc92bfce9"
+      "sha256": "1bced570761a901c4dab1247f160ca9230e38762058c000e75c955783c11ed09"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5039,6 +5069,11 @@
       "mode": "0000644",
       "sha256": "7ad384495370312a57f7c1f0dab4770888c83afd08b89a8dc27aebae408abfd1"
     },
+    {
+      "path": "scripts/gds/publish-credential-check.js",
+      "mode": "0000644",
+      "sha256": "0d700716747617c43e3cf410ef9395cc2f28fff342feef400a8ae45209e893c1"
+    },
     {
       "path": "scripts/gds/publish-manifest.js",
       "mode": "0000644",
@@ -5687,7 +5722,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "793ab7f173efc8c4137e658cae4617f09a9c0df1e1783cd28396337eac6aa83b"
+      "sha256": "c6df7e76c73ea039b407602d8e05f082f1ecb7447fa629fd6a9d8fdaa38f3f51"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7232,7 +7267,7 @@
     {
       "path": "tests/publish_branch_route.mjs",
       "mode": "0000644",
-      "sha256": "e3f843387deb2d2a8f2668490bc740f7291d141b2de70c1556a84cb429bdc21d"
+      "sha256": "ea46629917c3236b9dfb7133af643a9fecc9a205323c345e16671b5093606fd6"
     },
     {
       "path": "tests/publish_manifest.mjs",

package/docs/adr/0055-server-mediated-branch-publish.md

@@ -38,6 +38,10 @@ A **fine-grained GitHub PAT** scoped to the single repo: `Contents: read/write`
 
 > **Update (2026-06-13, task 1028 — GitHub App):** the preferred server credential is now a **GitHub App**, not a standing PAT. The server holds only the App private key (`GITHUB_APP_ID` + `GITHUB_APP_INSTALLATION_ID` + `GITHUB_APP_PRIVATE_KEY`) and mints a short-lived (~1h), repo-scoped **installation token** per push window — so there's no standing push secret at rest. `github-push.js resolveToken()` prefers the App and falls back to the PAT (`GITHUB_PUSH_TOKEN`) during cutover; `isConfigured()` is true if **either** is set, so the route's inert-safe `503` is unchanged. The App JWT is RS256-signed with `node:crypto` (no new dependency). Same single-repo scopes (Contents r/w + PR r/w + Actions read) and the same can't-touch-`main` guarantee. **LIVE on prod as of 2026-06-13 (task 1043 cutover, blocker 31 resolved):** the App (App ID 4047551, installation 140135657, `repository_selection=selected`) is installed and its key is set in `/etc/example/web-source.env`; verified that the server mints + uses an installation token (`publish-status` → 200, and a broken key fails loud as `503`/error rather than falling back). The old `GITHUB_PUSH_TOKEN` was **removed** — there is now **no standing push secret at rest**, only the App private key.
 
+> **Update (2026-08-12, task 1002733 — verify `Actions: read`, and verify WHICH credential is live):** the 2026-06-13 note above says the PAT was removed and the App is live. **On cloudbongos.com that is no longer true.** Checked on the host this session: <redacted> sets `GITHUB_PUSH_TOKEN` and **none** of `GITHUB_APP_ID` / `GITHUB_APP_INSTALLATION_ID` / `GITHUB_APP_PRIVATE_KEY`. So `appConfigured()` is false and `resolveToken()` falls through to the **PAT** — the App is not the running credential here. Whichever one an instance is actually on, **that** one needs `Actions: read`; don't assume from this ADR's history. If the live credential lacks it, `getPublishStatus`'s deploy probe cannot see workflow runs and reports a merged PR as still deploying **forever**, which stranded task 1002695 at `confirmed` across four reconciler sweeps on 2026-08-12. That failure is invisible from the outside: on a private repo GitHub returns 404 for both "no such workflow" and "not yours", so a single probe cannot tell a legitimately workflow-less instance (the ADR 0108 pin-bump shape) from a blind credential.
+>
+> Check it with `node scripts/gds/publish-credential-check.js` on the host — it lists the repo's workflows as a control call first, so `blind` and `readable_no_workflow` are distinguishable. Task 1002724 makes a blind probe non-fatal (the reconciler falls back to the git-history land proof), but a blind credential means the deploy gate is **not being enforced**, only bypassed.
+
 ## Consequences
 
 - A dev-box builder ships end-to-end: `/builder-reauth` → claim → edit → `/builder-stage` ([ADR 0046](<redacted>.md)) → `/builder-ship`, with the GDS doing the push. The box holds no GitHub credential, so the [ADR 0053](0053-scoped-dev-box-session.md) blast-radius argument still holds.