@bongos/core 1.19.834 → 1.19.835

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.834",
-  "core_contract": "1.19.834",
-  "source_commit": "c7f5d1e6cbf225b7ce9e59bf6f3154125ab3f15b",
+  "core_version": "1.19.835",
+  "core_contract": "1.19.835",
+  "source_commit": "31b17fb901dd65b7c6893f797e935c3b503a0de9",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T16:08:57.677Z",
+  "built_at": "2026-09-17T16:17:34.798Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 493,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2767,
-  "tree_sha256": "2981d7c12dcad3c4b86f0b609213d11eed3a70b0e9aa62518c1adc9535ee79fb",
+  "tree_sha256": "a2ec29793c06b863434f540138312423bddbe46023b7584468bbbdb7d5dfd2b2",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2562,7 +2562,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ccb66f38c502ddcefa3b6f3ba78a2e52e9e997c82ad5453fdd1408c1997b8aaa"
+      "sha256": "6cd1402c15f4a97fe2e7da159ad42f283992d01058781df987f5948c25ff9df4"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7852,12 +7852,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b91cd05ca37aecf647568e064603860f0bb149fb79cd1147c3700aa4adf495c5"
+      "sha256": "72ff1b680bbebe422781c8e96ff9da2627b98581a871e0f826907525a0eecf04"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5111d54c082eb876389b62997fb898a8bdb195fa4e91091992a8f092a13e4b35"
+      "sha256": "95c3f6f48a670b840fbf7b1f05f97b5fa93fa06ed08b6322d766b19e46beeef5"
     },
     {
       "path": "public-docs/index.html",
@@ -8772,12 +8772,12 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "c5822f3b29f90998c831639df2b0925033f17758cc329609de507f5e6e1ad7c8"
+      "sha256": "c8d4ce3004cafbd1d70ee72845700c95c85da41ced29fe059af333869a75cc03"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
       "mode": "0000644",
-      "sha256": "9220387c9c6dd53caf8c78103108e7937e2ececd570e2a4d708134a94237ef98"
+      "sha256": "df4187852cf0f75a12571607af95782d16f1655aa4314152078cb9ee9b3d0f7c"
     },
     {
       "path": "scripts/gds/provision-units.js",
@@ -8787,7 +8787,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "d5a8fdc3b79685826c52c9092a6b512c556f0f992c4fc799f5a8e60012f296ab"
+      "sha256": "4f60207affe476f637b2b2c13c38ab785940deef9bf8b5a8fa43b5d6448a408a"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9777,7 +9777,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "cc7c4888b81e294f2ea2a0439e1ca80b6a6cc64a3a68e0c71889aed74efc887c"
+      "sha256": "a5a74874643eb65e4e9727c492b8990e42dd5b28d13c40e5a523abcbc1aa320d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12592,7 +12592,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "1c580b0f1ebd7eca67e7a603c5e10fe2a987e75f60de514dfaf9ac8aff826a12"
+      "sha256": "56be00457be12f34e12658e032285865a6e3a2997df629e4d8dec3ec78c52b31"
     },
     {
       "path": "tests/provision_disconnect.mjs",

package/docs/module-api-changelog.md

@@ -2142,5 +2142,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.832 with no explicit bump. run 35243115057. (task 1002620)
   1.19.834 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.833 with no explicit bump. run 35244719662. (task 1002620)
+  1.19.835 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.834 with no explicit bump. run 35245617627. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.834",
+  "version": "1.19.835",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.834",
+      "version": "1.19.835",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.834",
+  "version": "1.19.835",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-repo.js

@@ -512,6 +512,8 @@ async function scaffoldStandaloneRepo(inst, deps) {
     throw new Error(`standalone instance ${inst.slug}: target_ref "${inst.target_ref || '(unset)'}" is not an owner/repo — set it (e.g. <owner>/${inst.slug}) so the scaffold knows which repo to clone + push.`);
   }
   if (alreadyScaffolded(root, mode)) {
+    const resumed = deps.apply ? await resumeUnpushedScaffold(inst, deps, { root, repo, mode }) : null;
+    if (resumed) return resumed;
     log(`  [scaffold] ${root} already scaffolded (mode=${mode}) — skipping`);
     return { already: true };
   }
@@ -541,13 +543,8 @@ async function scaffoldStandaloneRepo(inst, deps) {
   // command or makeExec's env (makeExec surfaces both), and is removed in a `finally` so a
   // failed git op can't leave it on disk. No token (org-owned repo, or secret-box off) →
   // fall back to the SSH `origin` remote.
-  const ownerToken = await resolveOwnerGithubToken(inst, deps, { tag: '[scaffold]' });
-  // The credential-store file + the credential-LESS URL git resolves against it. The URL
-  // carries only the `x-access-token` username (no secret), so it is safe in a logged argv.
-  const credFile = ownerToken ? path.join(os.tmpdir(), `bongos-gitcred-${inst.slug}-${process.pid}`) : null;
-  const httpsUrl = `https://x-access-token@github.com/${repo.owner}/${repo.name}.git`;
-  const credOpt = credFile ? `-c credential.helper='store --file=${credFile}' ` : '';
-  if (credFile) writeFile(credFile, `https://x-access-token:${ownerToken}@github.com\n`, { mode: 0o600 });
+  const cred = await scaffoldCredential(inst, repo, deps, writeFile);
+  const { credFile, httpsUrl, credOpt } = cred;
 
   try {
     // 1. Materialize the working tree.
@@ -680,13 +677,7 @@ async function scaffoldStandaloneRepo(inst, deps) {
     // destroying their work. Adopt's commit is a descendant of the tip it cloned, so an
     // ordinary push fast-forwards; if the remote moved underneath us the rejection is the
     // correct outcome and a re-run picks up the new tip.
-    if (credFile) {
-      exec(`git -C ${root} ${credOpt}push ${httpsUrl} HEAD:main`);
-      log(`  [scaffold] ${mode === 'adopt' ? 'pushed the adopt layer' : 'pushed'} to ${repo.owner}/${repo.name}@main via the owner's GitHub token (task 1002317)`);
-    } else {
-      exec(`git -C ${root} push -u origin main`);
-      log(`  [scaffold] pushed ${mode === 'adopt' ? 'the adopt layer' : 'initial scaffold'} to ${repo.owner}/${repo.name}@main (SSH origin)`);
-    }
+    pushScaffold({ exec, log, root, repo, mode, cred });
     return { ok: true, scaffolded: true, mode };
   } finally {
     // Always remove the credential file — a failed clone/push must not leave it on disk.
@@ -694,6 +685,54 @@ async function scaffoldStandaloneRepo(inst, deps) {
   }
 }
 
+// The owner-token credential the scaffold's git network ops ride (rationale at the call site in
+// scaffoldStandaloneRepo). The URL carries only the `x-access-token` username, so it is safe in a
+// logged argv. credFile null → no token → SSH origin fallback; the caller `rm -f`s it in a finally.
+async function scaffoldCredential(inst, repo, deps, writeFile) {
+  const ownerToken = await resolveOwnerGithubToken(inst, deps, { tag: '[scaffold]' });
+  const credFile = ownerToken ? path.join(os.tmpdir(), `bongos-gitcred-${inst.slug}-${process.pid}`) : null;
+  const httpsUrl = `https://x-access-token@github.com/${repo.owner}/${repo.name}.git`;
+  const credOpt = credFile ? `-c credential.helper='store --file=${credFile}' ` : '';
+  if (credFile) writeFile(credFile, `https://x-access-token:${ownerToken}@github.com\n`, { mode: 0o600 });
+  return { credFile, httpsUrl, credOpt };
+}
+
+function pushScaffold({ exec, log, root, repo, mode, cred }) {
+  if (cred.credFile) {
+    exec(`git -C ${root} ${cred.credOpt}push ${cred.httpsUrl} HEAD:main`);
+    log(`  [scaffold] ${mode === 'adopt' ? 'pushed the adopt layer' : 'pushed'} to ${repo.owner}/${repo.name}@main via the owner's GitHub token (task 1002317)`);
+  } else {
+    exec(`git -C ${root} push -u origin main`);
+    log(`  [scaffold] pushed ${mode === 'adopt' ? 'the adopt layer' : 'initial scaffold'} to ${repo.owner}/${repo.name}@main (SSH origin)`);
+  }
+}
+
+// alreadyScaffolded is a LOCAL marker, and a scaffold whose push failed leaves it behind: the
+// re-run skipped the never-done push, then wedged at step 2's `git pull --ff-only` against the
+// still-empty remote (task 1002718, F12). Only a remote that ANSWERS with no main re-pushes — an
+// unreachable one keeps the old skip, as it can't tell "never pushed" from "offline". Returns
+// null when there is nothing to resume.
+async function resumeUnpushedScaffold(inst, deps, { root, repo, mode }) {
+  const exec = deps.controlExec || deps.exec;
+  const writeFile = deps.controlWriteFile || deps.writeFile;
+  let cred = null;
+  let probe = { softFailed: true };
+  try {
+    // This runs on every re-provision of a LIVE instance, so a probe that cannot even start
+    // (token lookup, credential write) must keep the skip — never fail a healthy instance.
+    try {
+      cred = await scaffoldCredential(inst, repo, deps, writeFile);
+      probe = exec(`git -C ${root} ${cred.credOpt}ls-remote --heads ${cred.credFile ? cred.httpsUrl : 'origin'} main`, { allowFail: true });
+    } catch { deps.log(`  [scaffold] could not probe ${repo.owner}/${repo.name} for main — keeping the skip`); }
+    if (probe.softFailed || String(probe.stdout || '').trim()) return null;
+    deps.log(`  [scaffold] ${root} is scaffolded but ${repo.owner}/${repo.name} has no main — re-pushing the scaffold that never landed`);
+    pushScaffold({ exec, log: deps.log, root, repo, mode, cred });
+    return { ok: true, resumed: true, mode };
+  } finally {
+    if (cred && cred.credFile) exec(`rm -f ${cred.credFile}`, { allowFail: true });
+  }
+}
+
 // ── private-repo deploy key (ADR 0176, task 1002735; walk finding N4) ────────────
 
 function deployKeyTitle(inst) { return `cloudbongos-deploy-${inst.slug}`; }

package/scripts/gds/provision-teardown.js

@@ -43,7 +43,7 @@ async function teardownInstance(inst, deps) {
     // Left for an operator (data is precious), naming ONLY what this row created —
     // teardown now takes 'requested'/'error'. `port` + `domain` stay held: ADR 0181.
     if (inst.db_name) log(`  (left for the operator: dropdb ${dbName(inst)}, prune ${CONFIG.backupDir}/${dbName(inst)}-*.sql.gz)`);
-  } else if (apply && deps.doApi && inst.droplet_id) {
+  } else if (apply && inst.droplet_id && deps.doApi) {
     await deps.doApi.deleteDroplet(inst.droplet_id);
   }
   parkAddress(inst, { controlExec, log, apply });

package/scripts/gds/provision.js

@@ -1393,12 +1393,14 @@ async function main() {
   if (CONFIG.remoteHost && !CONFIG.remoteCwd) { console.error('PROVISION_REMOTE_HOST is set but PROVISION_REMOTE_CHECKOUT is not — name the co-hosting box\'s checkout dir (the old hardcoded default was removed, task 1002756).'); process.exit(2); }
   const exec = makeExec({ apply, remoteHost: CONFIG.remoteHost, remoteCwd: CONFIG.remoteCwd, sshOpts: CONFIG.sshOpts });
   const controlExec = makeExec({ apply });
+  let doApiClient = null;
   const deps = {
     db: pool, provisioning, apply, privileged: CONFIG.privileged, log: console.log,
     exec, controlExec,
     writeFile: makeWriteFile({ apply, privileged: CONFIG.privileged, exec, remoteHost: CONFIG.remoteHost }),
     controlWriteFile: makeWriteFile({ apply, privileged: CONFIG.privileged, exec: controlExec }),
-    doApi: DoApi ? new DoApi({ dryRun: !apply, token: CONFIG.doToken, log: (m) => console.log('    ' + m) }) : null,
+    // Built on first READ (task 1002718 F6): an --apply tick whose intents never call DO needs no DO_API_TOKEN.
+    get doApi() { return DoApi ? (doApiClient = doApiClient || new DoApi({ dryRun: !apply, token: CONFIG.doToken, log: (m) => console.log('    ' + m) })) : null; },
     // Cross-site identity (ADR 0141 §4). Null on a non-hub control plane → federation
     // dormant; shouldFederate() then skips and the instance owns its auth (as today).
     platformIdentity, hubKeys,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.834'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.835'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provision.mjs

@@ -566,15 +566,79 @@ await ta('scaffoldStandaloneRepo: idempotent — a repo that already carries pac
     mkdirSync(join(tmp, 'demo'), { recursive: true });
     writeFileSync(join(tmp, 'demo', 'package.json'), '{}\n');   // sign of a completed scaffold
     const { deps, cmds } = recorder({ apply: true });
+    deps.exec = (cmd) => { cmds.push(cmd); return { ok: true, stdout: /ls-remote/.test(cmd) ? 'abc123\trefs/heads/main\n' : '' }; };
     const res = await P.scaffoldStandaloneRepo({ slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo' }, deps);
     assert.equal(res.already, true);
-    assert.equal(cmds.length, 0, 'no init/build/push when already scaffolded');
+    assert.deepEqual(cmds.filter((c) => !/ls-remote/.test(c)), [], 'no init/build/push when already scaffolded AND the remote carries main');
   } finally {
     P.CONFIG.standaloneBase = origBase;
     rmSync(tmp, { recursive: true, force: true });
   }
 });
 
+// F12 (task 1002718): package.json is a LOCAL marker, so a scaffold whose push failed left it
+// behind — the re-run skipped the never-done push and wedged at step 2's `git pull --ff-only`
+// on the empty remote. The runner now asks the remote before skipping.
+async function rerunScaffold({ apply = true, lsRemote, token = null, credWriteThrows = false }) {
+  const tmp = mkdtempSync(join(tmpdir(), 'scaffold-resume-'));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = tmp;
+  try {
+    mkdirSync(join(tmp, 'demo'), { recursive: true });
+    writeFileSync(join(tmp, 'demo', 'package.json'), '{}\n');
+    const { deps, cmds } = recorder({ apply });
+    const writes = [];
+    deps.exec = (cmd) => { cmds.push(cmd); return /ls-remote/.test(cmd) ? lsRemote : { ok: true, stdout: '' }; };
+    deps.writeFile = (p, body, opts) => {
+      if (credWriteThrows && /bongos-gitcred/.test(p)) throw new Error('EACCES: tmp not writable');
+      writes.push({ p, body, opts }); return { ok: true };
+    };
+    if (token) deps.getGithubToken = async () => ({ token, scope: 'repo' });
+    const res = await P.scaffoldStandaloneRepo({ slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo', owner_builder_id: 7 }, deps);
+    return { res, cmds, writes };
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+await ta('scaffoldStandaloneRepo: a scaffold whose push never landed RE-PUSHES on re-run (remote has no main) — F12, task 1002718', async () => {
+  const { res, cmds } = await rerunScaffold({ lsRemote: { ok: true, stdout: '' } });
+  const joined = cmds.join('\n');
+  assert.equal(res.resumed, true);
+  assert.match(joined, /ls-remote --heads [^\n]*origin main/, 'asks the remote whether main exists');
+  assert.match(joined, /git -C [^\n]* push -u origin main/, 're-pushes the scaffold commit');
+  assert.ok(!/init\.js|package-core|commit -m|--force/.test(joined), 'does NOT re-scaffold, re-commit or force — only the owed push');
+});
+
+await ta('scaffoldStandaloneRepo: the resume push rides the owner token and removes its credential file (F12)', async () => {
+  const { cmds, writes } = await rerunScaffold({ lsRemote: { ok: true, stdout: '' }, token: 'gho_RESUME_SECRET' });
+  const joined = cmds.join('\n');
+  assert.ok(!joined.includes('gho_RESUME_SECRET'), 'token never appears in a command string');
+  assert.match(joined, /credential\.helper='store --file=[^']*bongos-gitcred-demo[^']*' ls-remote --heads https:\/\/x-access-token@github\.com\/example-owner\/demo\.git main/);
+  assert.match(joined, /credential\.helper='store --file=[^']*bongos-gitcred-demo[^']*' push https:\/\/x-access-token@github\.com\/example-owner\/demo\.git HEAD:main/);
+  assert.equal(writes.find((w) => /bongos-gitcred-demo/.test(w.p)).opts.mode, 0o600);
+  assert.match(cmds[cmds.length - 1], /rm -f [^\n]*bongos-gitcred-demo/, 'credential file removed last');
+});
+
+await ta('scaffoldStandaloneRepo: an UNREACHABLE remote keeps the old skip — only a confirmed-empty remote re-pushes (F12)', async () => {
+  const { res, cmds } = await rerunScaffold({ lsRemote: { ok: true, stdout: '', softFailed: true } });
+  assert.equal(res.already, true);
+  assert.ok(!cmds.some((c) => /push/.test(c)), cmds.join(' | '));
+});
+
+await ta('scaffoldStandaloneRepo: a probe that cannot start (credential write throws) keeps the skip — a live instance is never failed by it (F12)', async () => {
+  const { res, cmds } = await rerunScaffold({ lsRemote: { ok: true, stdout: '' }, token: 'gho_X', credWriteThrows: true });
+  assert.equal(res.already, true);
+  assert.ok(!cmds.some((c) => /push|ls-remote/.test(c)), cmds.join(' | '));
+});
+
+await ta('scaffoldStandaloneRepo: dry-run of an already-scaffolded repo probes nothing (F12)', async () => {
+  const { res, cmds } = await rerunScaffold({ apply: false, lsRemote: { ok: true, stdout: '' } });
+  assert.equal(res.already, true);
+  assert.deepEqual(cmds, []);
+});
+
 // ── ADR 0134 (task 2090): registry core-install path + fail-soft to vendored ──
 // Runs the scaffold against a FRESH standaloneBase (no package.json → it proceeds) with
 // an injected env, and asserts which core-resolution shape it chose from the commands.
@@ -1499,6 +1563,30 @@ await ta('teardownInstance(dedicated): no systemd steps at all, so no reset-fail
   assert.ok(!cmds.some((c) => /reset-failed|daemon-reload|disable --now/.test(c)), cmds.join(' | '));
 });
 
+// F6 (task 1002718): main() builds deps.doApi on first READ, so a caller must only read it
+// on a path that really calls DigitalOcean — a throwing getter proves the others never do.
+function doApiTripwire(deps) {
+  Object.defineProperty(deps, 'doApi', { get() { throw new Error('read deps.doApi on a path that makes no DO call'); } });
+  return deps;
+}
+
+await ta('teardownInstance(dedicated, no droplet_id) under --apply never reads deps.doApi (F6)', async () => {
+  const { deps } = recorder({ apply: true });
+  await P.teardownInstance({ ...coTenant, hosting_shape: 'dedicated', droplet_id: null }, doApiTripwire(deps));
+});
+
+await ta('provisionInstance(co-tenant) under --apply never reads deps.doApi (F6)', async () => {
+  const { deps } = recorder({ apply: true });
+  const r = await P.provisionInstance(coTenant, doApiTripwire(deps));
+  assert.ok(!/deps\.doApi/.test(String(r && r.error)), String(r && r.error));
+});
+
+t('main() constructs the DO client lazily — no DO_API_TOKEN needed until a DO call (F6)', () => {
+  const src = readFileSync(new URL('../scripts/gds/provision.js', import.meta.url), 'utf8');
+  assert.match(src, /get doApi\(\)/, 'deps.doApi is a getter');
+  assert.ok(!/doApi:\s*DoApi \? new DoApi/.test(src), 'no eager construction at deps build');
+});
+
 await ta('teardownInstance(default): NO sudo (bare, unchanged)', async () => {
   const { deps, cmds } = recorder();
   await P.teardownInstance(coTenant, deps);