@bongos/core 1.19.926 → 1.19.927

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.926",
-  "core_contract": "1.19.926",
-  "source_commit": "e29c4e2c4c22fc015eaaa56174f643b557051564",
+  "core_version": "1.19.927",
+  "core_contract": "1.19.927",
+  "source_commit": "8a6b09d4e2f48071fe35cfa4147ffdb779753896",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T23:12:12.395Z",
+  "built_at": "2026-09-20T23:34:18.483Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 511,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2851,
-  "tree_sha256": "7760b472bbc2c5cd345c6c4becda6c92d06d09c727c967667d7794740b51b8d6",
+  "tree_sha256": "2c2b24754d790a0405bb73c8c5381d97a364f5c4a544b31d471df58b3458cf49",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2677,7 +2677,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b656ffb12e3d62e7042fbde0a6dc547d9b8b480ce2acacc21da0795443b117ac"
+      "sha256": "3bc7467a01b53a0d28388f5df4f6028fc71a764e8155280e754ff2b17edd5e4e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6412,12 +6412,12 @@
     {
       "path": "modules/provisioning/control-plane-guard.js",
       "mode": "0000644",
-      "sha256": "b70ad687c7699a3023e8be973b67ceeb7ff67afb38ff47665c7089614901c200"
+      "sha256": "e1d060477287884f878748da4c2b7cfe164c782538728ffc7efc473c8b6a4997"
     },
     {
       "path": "modules/provisioning/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "bd0109f1e270c868cc1c1d27d1c3b51ccb48c8b3d54c8274ffedbf2a4bbce051"
+      "sha256": "291a3765197f9429c70dd240fe5cdfa72a245ad3698c822032e71bb88999d533"
     },
     {
       "path": "modules/provisioning/credential-preflight.js",
@@ -7922,12 +7922,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3ec884fff4704eceb947c709b0143b4428c435f8a7cad753d4c758028cf13bfd"
+      "sha256": "52b5b2136a302b5f6f0d855f3b6b9b55db2412a60766c05f857a313e52cd451e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2e4530f1e38ef785e735ae6fc924451aab9d22beecdf2bb99af943cdfb470453"
+      "sha256": "33d35abf35aa8693f2b36cf95227a052986b760bd7de71eaee002c7d450f4eaa"
     },
     {
       "path": "public-docs/index.html",
@@ -9927,7 +9927,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "938fdfedf2e8b99ae44c637371144016754b82cb8b96e254e47f8766e945a3b5"
+      "sha256": "e0b786da5becfbcb6f79530193b0424db2c1164e26173f9218ff330d9aba079d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10837,7 +10837,7 @@
     {
       "path": "tests/core_upgrade_door.mjs",
       "mode": "0000644",
-      "sha256": "c0457b6d1b0b0b3ee4117544e9203c28306a99772e2b085f0611132cf3d358d9"
+      "sha256": "bb2a39d645141a15b7391580069bf05b6f812e40f20d10fd55dbc564eb8f00ec"
     },
     {
       "path": "tests/core_upgrade_runner.mjs",

package/docs/module-api-changelog.md

@@ -2326,5 +2326,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.924 with no explicit bump. run 35542154729. (task 1002620)
   1.19.926 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.925 with no explicit bump. run 35543911646. (task 1002620)
+  1.19.927 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.926 with no explicit bump. run 35545006099. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/control-plane-guard.js

@@ -30,10 +30,18 @@
 //                  the door task 1003159 builds.
 //   restart      — the liveness remedy (task 1003238). Restarting the platform is
 //                  recoverable and already owner-initiated elsewhere.
+//   core-upgrade-preflight
+//                — `upgrade.js --dry-run`. It RUNS NOTHING: it returns at pre-flight
+//                  before the pin moves, before npm, before any restart. Refusing it
+//                  here protected the box from nothing and removed the feature from
+//                  everyone, because the control plane is the ONLY instance that runs
+//                  the provisioning module — so its hall is the only one with an
+//                  Upgrade page at all. A preview that cannot run where the button
+//                  lives is not a preview (task 1004125).
 //
 // Adding to this list is a deliberate edit someone has to argue for. It is pinned
 // by name in tests/core_upgrade_door.mjs so it cannot grow as a side effect.
-const CONTROL_PLANE_ACTIONS = Object.freeze(['core-upgrade', 'restart']);
+const CONTROL_PLANE_ACTIONS = Object.freeze(['core-upgrade', 'core-upgrade-preflight', 'restart']);
 
 /**
  * May this intent action be aimed at an instance of this hosting shape? PURE.

package/modules/provisioning/core-upgrade.js

@@ -209,6 +209,17 @@ function makeCoreUpgradeHandler({ provisioning, pool, parseId, validateOrRespond
       });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/core-upgrade', err);
+      // A REFUSAL IS NOT AN OUTAGE. The control-plane guard throws an error carrying
+      // `code`, `status` and a `publicMessage` it wrote for exactly this moment — and
+      // this catch used to discard all three, so every guard refusal reached the owner
+      // as a 500 "internal error" while the real sentence sat in the journal. Nothing
+      // in the repo honoured `publicMessage`; it was assigned once and read never
+      // (task 1004125). Only an error that has already declared itself public is
+      // forwarded — anything else still gets the opaque 500, because an unexpected
+      // throw may carry anything.
+      if (err && err.publicMessage && err.code && err.status) {
+        return res.fail(err.code, { status: err.status, message: err.publicMessage });
+      }
       return res.fail('core_upgrade_failed', { status: 500, message: 'internal error' });
     }
   };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.926",
+  "version": "1.19.927",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.926",
+      "version": "1.19.927",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.926",
+  "version": "1.19.927",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.926'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.927'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/core_upgrade_door.mjs

@@ -93,10 +93,29 @@ await t('every action not explicitly allowed is refused on the self row', () =>
   }
 });
 
-await t('the allow-list is exactly the two acts that cannot destroy the box', () => {
+await t('the allow-list is exactly the acts that cannot destroy the box', () => {
   // Pinned by NAME so widening it is a deliberate edit someone has to argue for,
-  // not a side effect of adding an action to INTENT_ACTIONS.
-  assert.deepEqual([...G.CONTROL_PLANE_ACTIONS].sort(), ['core-upgrade', 'restart']);
+  // not a side effect of adding an action to INTENT_ACTIONS. It did its job: adding
+  // 'core-upgrade-preflight' to INTENT_ACTIONS in task 1004121 did NOT reach here, and
+  // this line is what forced the argument to be made (task 1004125). The argument: a
+  // dry run returns at pre-flight having moved no pin, run no npm and restarted
+  // nothing, and the control plane is the only instance whose hall HAS an Upgrade
+  // page — so refusing the preview there protected nothing and removed everything.
+  assert.deepEqual([...G.CONTROL_PLANE_ACTIONS].sort(),
+    ['core-upgrade', 'core-upgrade-preflight', 'restart']);
+});
+
+await t('the preview is permitted on the control plane — the one row that can use it', () => {
+  assert.equal(G.intentAllowedForShape('core-upgrade-preflight', 'control-plane'), true);
+});
+
+await t('and widening it did NOT let the destructive acts through', () => {
+  // The whole risk of arguing one action onto an allow-list is arguing four.
+  for (const a of P.INTENT_ACTIONS) {
+    if (['core-upgrade', 'core-upgrade-preflight', 'restart'].includes(a)) continue;
+    assert.equal(G.intentAllowedForShape(a, 'control-plane'), false,
+      `'${a}' must still be refused against the box the platform runs on`);
+  }
 });
 
 await t('an ordinary instance is untouched by the guard', () => {
@@ -489,7 +508,7 @@ const validatorHarness = () => {
     fail: (code, o) => { body = { code, ...(typeof o === 'object' ? o : { status: o }) }; status = (o && o.status) || o || 400; return res; },
     status: (c) => { status = c; return res; },
   };
-  return { calls, handler, res, read: () => ({ body, status }) };
+  return { calls, handler, res, provisioning, read: () => ({ body, status }) };
 };
 
 await t('the preview payload the page posts is ACCEPTED, not refused as an unknown field', async () => {
@@ -503,6 +522,38 @@ await t('the preview payload the page posts is ACCEPTED, not refused as an unkno
   assert.ok(queued, 'and it reaches the queue as a PREVIEW, not as a move');
 });
 
+await t('a guard refusal reaches the owner as ITS OWN sentence, not "internal error"', async () => {
+  // The guard writes `code`, `status: 409` and a publicMessage for exactly this moment.
+  // The catch discarded all three, so every control-plane refusal this route ever made
+  // was shown as a 500 "internal error" while the real sentence sat in the journal —
+  // which is how the preview refusal stayed invisible until it was pressed live.
+  // Elsewhere in this file we already assert that sentence is well-formed; nothing
+  // asserted it ARRIVED.
+  const h = validatorHarness();
+  const refusal = Object.assign(new Error('blocked'), {
+    code: 'control_plane_protected', status: 409,
+    publicMessage: 'That action cannot be aimed at the machine the platform itself runs on.',
+  });
+  h.provisioning.enqueueIntent = async () => { throw refusal; };
+  await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.926' } }, h.res);
+  const { body } = h.read();
+  assert.equal(body && body.code, 'control_plane_protected', 'the guard\'s own code, not core_upgrade_failed');
+  assert.equal(body && body.status, 409, 'a refusal is not a 500');
+  assert.match((body && body.message) || '', /cannot be aimed at the machine/);
+});
+
+await t('an UNEXPECTED throw is still opaque — this is not a blanket error passthrough', async () => {
+  // Forwarding every error would leak internals. Only an error that declared itself
+  // public (code + status + publicMessage) is forwarded.
+  const h = validatorHarness();
+  h.provisioning.enqueueIntent = async () => { throw new Error('connection terminated: relation "secrets" does not exist'); };
+  await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.926' } }, h.res);
+  const { body } = h.read();
+  assert.equal(body && body.code, 'core_upgrade_failed');
+  assert.equal(body && body.message, 'internal error');
+  assert.ok(!/secrets|relation/.test(JSON.stringify(body)), 'no internals reach the client');
+});
+
 await t('the move payload still validates, and still queues a move', async () => {
   const h = validatorHarness();
   await h.handler({ builder: { id: 42 }, params: { id: '7' }, body: { to: '1.19.925' } }, h.res);