@bongos/core 1.20.62 → 1.20.64

package/docs/recipes/upgrading-the-core.md

@@ -90,6 +90,8 @@ The sections above are the *manual* `bongos upgrade`. The **subscription** runs
 
 A **major** is never automatic; prereleases are never auto-targeted.
 
+**Crossing a minor from /deploy** (task [1004405](https://cloudbongos.com/builders#/task/1004405)): set the project's update rule to **Fixes and new releases** (`minor`), or press **Allow new releases and move** on the refused move — either is the explicit "this crosses a minor version" choice. That only works once the box runs a core whose runner reads the rule (core 1.20.29 or later, task [1004445](https://cloudbongos.com/builders#/task/1004445)). A box on anything older runs the old runner, which bounds every move to `patch` whatever the rule says, so its **first** crossing is the manual `upgrade.js --to <version>` above; every later one goes through /deploy.
+
 **Where the channel comes from** ([ADR 0357](../adr/0357-the-update-rule-set-on-deploy-is-the-one-the-sweep-follows.md), task [1004468](https://cloudbongos.com/builders#/task/1004468)): the rule set on **/deploy** (`provisioning_instances.update_channel`) wins for any roster entry whose `slug` matches a project row. The roster's `channel` below is only the fallback, used when no row matches or the sweep can't read the database. The sweep reads the control plane's DB from `UPDATE_CHANNEL_DB` (a db name or connection string), else `DATABASE_URL` / `PGDATABASE`. On a control plane, set `UPDATE_CHANNEL_DB`, never `PGDATABASE`: the sweep's env reaches every upgrade it spawns, so a tenant entry with no database of its own would migrate against the control plane's. Every run prints each entry's channel and its source.
 
 **Enrolling an instance** — add it to `config/update-subscriptions.json` (instance-side) (ships empty). `env` carries per-instance vars merged into the upgrade child — set `PGDATABASE` so `migrate` hits the right DB (see the Gotchas):

package/modules/provisioning/render-standup.js

@@ -53,6 +53,13 @@ const SERVICE_RE = /^srv-[a-z0-9]{8,64}$/;
 
 // The reason a request cannot be queued, in the owner's words, or null. `body` is the
 // validated request body.
+//
+// The hall is never the app (ADR 0345 D1). A command that runs the Bongos core itself puts
+// a second, database-less copy of the project's hall on Render, where it never answers and
+// the deploy times out — measured live on project 43 (task 1004483). It cannot see through
+// the scaffold's own `npm start`, which still runs the hall; that is task 1004484.
+const HALL_COMMAND_RE = /platform-server\.js|node_modules[\\/]@bongos[\\/]core/i;
+const HALL_REFUSAL = 'That command starts the project’s Builders’ hall, which we already host — not your app. Give the command that starts your app.';
 function badRequest(body) {
   const b = body || {};
   if (!KEY_RE.test(String(b.key || ''))) return 'That doesn’t look like a Render API key. It starts with “rnd_” — create one under Account Settings → API Keys in Render.';
@@ -65,6 +72,7 @@ function badRequest(body) {
     if (!RUNTIMES.includes(b.runtime)) return 'Say what your app is built with — for example Node or Python, or Docker to use your repository’s Dockerfile.';
     if (b.runtime === 'docker' && (b.build_command || b.start_command)) return 'Docker builds and starts your app from your Dockerfile, so leave the commands out.';
     if (b.runtime !== 'docker' && !String(b.start_command || '').trim()) return 'Say how your app starts — the command Render should run, for example “npm start”.';
+    if (HALL_COMMAND_RE.test(String(b.start_command || '')) || HALL_COMMAND_RE.test(String(b.build_command || ''))) return HALL_REFUSAL;
   }
   if (b.web_plan != null && !WEB_PLANS.includes(b.web_plan)) return `“${b.web_plan}” is not a Render web plan.`;
   if (b.db_plan != null && !DB_PLANS.includes(b.db_plan)) return `“${b.db_plan}” is not a Render database plan.`;

package/modules/public-landing/public/projects.html

@@ -1696,6 +1696,7 @@ summary{min-height:24px;padding:3px 0;}
                     <span>Create the project now. You can choose where your app runs afterwards.</span></span>
                 </label>
               </fieldset>
+              <p class="renderWhy" id="renderLater" role="status" hidden>Your new repository has no app in it yet, so there is nothing for Render to run today. Once your builders have written the app, set it up on Render from your project’s page — it takes a minute, and asks for your Render key once. Nothing is created on Render now.</p>
               <div class="renderSetup" id="renderSetup" hidden>
                 <p class="renderWhy">Your Render key is used once, to create your app on your own Render account, and then thrown away — it is not kept, not even in this browser. Render bills you directly. A key can act on your whole Render account, so only paste it here. <a href="https://dashboard.render.com/u/settings#api-keys" target="_blank" rel="noopener noreferrer">Create a key in Render</a></p>
                 <div class="renderKeyRow">
@@ -5527,7 +5528,8 @@ summary{min-height:24px;padding:3px 0;}
     }
     function appRow() {
       if (appPlatformChoice() !== 'render') return 'Not chosen yet — you can decide later';
-      var ws = esc(state.renderOwnerName || state.renderOwnerId || '');
+      if (renderLater()) return 'Render — set up from your project’s page once your app has code. Nothing is created on Render now.';
+      var ws =esc(state.renderOwnerName || state.renderOwnerId || '');
       if (state.renderMode === 'adopt') return 'Render, workspace ' + ws + ' — link <code>' + esc(state.renderServiceName || state.renderServiceId || '') + '</code>, changing nothing on it';
       var plan = planLabel(RENDER_WEB_PLANS, state.renderPlan || 'starter');
       var db = state.renderDb ? ', with a database (' + planLabel(RENDER_DB_PLANS, state.renderDbPlan || 'basic_256mb') + ')' : ', no database';
@@ -5543,13 +5545,24 @@ summary{min-height:24px;padding:3px 0;}
        1004184). Here it reads and writes the draft (`state`), so every answer but the key
        survives a reload. The key is never on state, so a resumed draft asks for it again,
        and says why. */
+    /* A brand-new repository holds only the hall's scaffold — no app — so Render is set
+       up now only for an ADOPTED repo (task 1004483, owner call 2026-10-01). Set up on a
+       fresh one, Render ran the repo's `npm start`, which is the hall, and timed out.
+       Choosing Render for a fresh repo is still an answer: the step says when and where
+       it happens, and nothing is sent to Render at Create. */
+    function renderNow() { return appPlatformChoice() === 'render' && state.mode === 'adopt'; }
+    function renderLater() { return appPlatformChoice() === 'render' && state.mode !== 'adopt'; }
     var rc = renderConnect($, state, {
       save: saveDraft,
       repo: function () { return String(state.owner || '') + '/' + String(state.repo || ''); },
-      on: function () { return appPlatformChoice() === 'render'; },
+      on: renderNow,
       noKey: 'Check your Render key first — or choose “Decide later”.'
     });
-    function syncRenderSetup() { rc.sync(); }
+    function syncRenderSetup() {
+      var later = $('renderLater');
+      if (later) later.hidden = !renderLater();
+      rc.sync();
+    }
     function forgetRenderAnswers() { rc.forget(); }
     function validateRender() { return rc.validate(); }
     function renderRequestBody() { return rc.requestBody(); }
@@ -5557,7 +5570,13 @@ summary{min-height:24px;padding:3px 0;}
     // answer. The project exists either way; a refusal here is the APP's, and the done
     // panel says so in plain words.
     function sendRenderSetup(instanceId) {
-      if (appPlatformChoice() !== 'render' || !rc.hasKey() || !instanceId) return;
+      if (renderLater()) {
+        var later = $('doneRender');
+        later.hidden = false; later.className = 'hint';
+        later.textContent = 'Your app goes on Render once it has code: set it up from your project’s page when your builders have written it.';
+        return;
+      }
+      if (!renderNow() || !rc.hasKey() || !instanceId) return;
       var body = renderRequestBody();
       rc.drop();
       var note = $('doneRender');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.62",
+  "version": "1.20.64",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.62",
+      "version": "1.20.64",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.62",
+  "version": "1.20.64",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8497,5 +8497,21 @@
       "id": "1004307",
       "text": "The automatic update on cloudbongos.com will now always run the newest version of itself, instead of a copy stuck from August."
     }
+  ],
+  "1.20.63": [
+    {
+      "id": "1004405",
+      "text": "When the Upgrade button refuses a jump to a new release line, it now tells you exactly which setting on /deploy to change, instead of pointing at a setting that didn't exist."
+    }
+  ],
+  "1.20.64": [
+    {
+      "id": "1004483",
+      "text": "When you start a brand-new project and choose Render for your app, the wizard no longer tries to put anything on Render straight away: a new repository has no app in it yet, and Render was running the project's builders' hall"
+    },
+    {
+      "id": "1004390",
+      "text": "When someone adds a prerequisite to a job that was already waiting in the \"available work\" list, the job used to stay on that list — a builder would pick it up, and only then be told they couldn't start it yet. The listing was"
+    }
   ]
 }

package/scripts/gds/provision-core-upgrade.js

@@ -137,11 +137,26 @@ function targetFault(to, available, installed, channel, channelAllows) {
     return `could not read the core version installed at this instance — nothing was changed. An upgrade that cannot say where it is starting from cannot be bounded by the '${channel}' channel.`;
   }
   if (channelAllows && !channelAllows(installed, to, channel)) {
-    return `core ${to} is outside this project's '${channel}' update channel — nothing was changed. Change the channel first if this is deliberate.`;
+    return `core ${to} is outside this project's '${channel}' update channel — nothing was changed. ${channelNextStep(channel)}`;
   }
   return null;
 }
 
+// The step that gets a channel-refused move through, named by the control a person can
+// actually reach (task 1004405). The old line said "change the channel first" while no
+// channel could be changed; the update rule on /deploy (task 1004445) is that control now,
+// and its labels are the words used here. `minor` is the widest rule, so a move it refuses
+// (a major, a prerelease) has no rule to widen to and is named as the by-hand step it is.
+function channelNextStep(channel) {
+  if (channel === 'pinned') {
+    return 'Its update rule on /deploy is "Stay put"; change it to "Fixes only" or "Fixes and new releases", then move again.';
+  }
+  if (channel === 'minor') {
+    return 'No update rule moves a project across a major version or onto a prerelease; that move is made by hand with upgrade.js (docs/recipes/upgrading-the-core.md).';
+  }
+  return 'To take a new release line, set this project\'s update rule on /deploy to "Fixes and new releases" (or press "Allow new releases and move"), then move again.';
+}
+
 // The update channel that bounds a move for THIS instance (task 1004445): the row's own
 // `update_channel`, normalised by update-channel.js so anything unknown or absent (a row
 // read before migration provisioning_029) falls back to DEFAULT_CHANNEL. PURE. One helper

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.62'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.64'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/core_upgrade_runner.mjs

@@ -219,6 +219,19 @@ await t('a version that is not published yet is refused, and the message says th
   assert.match(f, /tag appears several minutes before/);
 });
 
+await t('the channel refusal names a step that EXISTS on /deploy, never "change the channel first" (task 1004405)', () => {
+  const patch = R.targetFault('1.20.1', ['1.19.1081', '1.20.1'], '1.19.1081', 'patch', () => false);
+  assert.ok(!/Change the channel first/.test(patch), 'the old wording named nothing a person could do');
+  assert.match(patch, /\/deploy/);
+  assert.match(patch, /Fixes and new releases/, 'patch → names the rule that admits a minor jump');
+  const pinned = R.targetFault('1.19.1082', ['1.19.1081', '1.19.1082'], '1.19.1081', 'pinned', () => false);
+  assert.match(pinned, /Stay put/);
+  assert.match(pinned, /Fixes only/);
+  const major = R.targetFault('2.0.0', ['1.19.1081', '2.0.0'], '1.19.1081', 'minor', () => false);
+  assert.match(major, /no update rule/i, 'minor is the widest rule, so pointing at a wider one would be a lie');
+  assert.match(major, /upgrading-the-core\.md/);
+});
+
 await t('a registry that could not be read is refused DIFFERENTLY from a version that does not exist', () => {
   const empty = R.targetFault('1.19.760', [], '1.19.758', 'patch', () => true);
   assert.match(empty, /could not read the published core versions/);

package/tests/dependency_writes_atomic.mjs

@@ -188,4 +188,40 @@ await test('routes/tasks.js: POST uses the atomic batch writer and both writers
   assert.match(mapper, /CYCLE[\s\S]*409/);
 });
 
+// ================= the writers never DEMOTE the target (task 1004390) =================
+//
+// The decision recorded in ADR 0015 ("A dependency added AFTER promotion"): an edge
+// written against a task that is already `ready` leaves the status alone, and the
+// CLAIMABLE FEED hides the row instead (core_264 / task 1004190). The branch that was
+// rejected is the cheap one — demote the target to `backlog` here, no migration needed —
+// so it is the one that will look like a tidy-up to a future reader. These tests make
+// re-adding it go red: the writers must issue no write against `tasks` at all, which is
+// what keeps a planner's edge from silently reversing a human's `POST /promote`.
+//
+// Narrow on purpose. `SELECT id FROM tasks` (the existence check) is legitimate and
+// stays; what is forbidden is a MUTATION of the row.
+const touchesTaskRows = (log) => log.filter((q) => /^(UPDATE|DELETE FROM|INSERT INTO) tasks\b/i.test(q.sql));
+
+await test('addTaskDependencies writes edges only — it never updates the task it blocks', async () => {
+  const p = fakePool({ existing: [1, 2] });
+  await addTaskDependencies(1, [2], { pool: p });
+  assert.deepEqual(touchesTaskRows(p.log), [],
+    'a dep edge must not demote its target — ADR 0015, the rejected branch');
+  assert.ok(!has(p.log, /'backlog'/), 'and nothing here names the backlog status');
+});
+
+await test('setTaskDependencies (the full-set replace) never updates the task either', async () => {
+  const p = fakePool({ existing: [1, 2] });
+  await setTaskDependencies(1, [2], { pool: p });
+  assert.deepEqual(touchesTaskRows(p.log), []);
+  // The one DELETE it does run is scoped to the edge table, not the task row.
+  assert.ok(has(p.log, /^DELETE FROM dependencies/));
+});
+
+await test('addDependency (the generic edge) never updates the from-node', async () => {
+  const p = fakePool();
+  await addDependency('task', 1, 'task', 2, { pool: p });
+  assert.deepEqual(touchesTaskRows(p.log), []);
+});
+
 summary();

package/tests/projects_hub_app_step.mjs

@@ -99,7 +99,9 @@ function load({ draft = {}, answers = {} } = {}) {
     },
     querySelectorAll(sel) { assert.equal(sel, '#appOpts input[name=appPlatform]'); return inputs; },
   };
-  const state = Object.assign({ appPlatform: 'later', owner: 'example-owner', repo: 'spike' }, draft);
+  // mode 'adopt' by default: since task 1004483 the Render flow runs at creation only for an
+  // adopted repo — a fresh one has no app yet. The fresh-repo cases set mode themselves.
+  const state = Object.assign({ appPlatform: 'later', owner: 'example-owner', repo: 'spike', mode: 'adopt' }, draft);
   const fetch = async (url, init) => {
     const body = init && init.body ? JSON.parse(init.body) : null;
     calls.push({ url, method: init && init.method, body });
@@ -417,6 +419,37 @@ test('after Create the key is sent once, to the new project, and then dropped',
   assert.equal(w.calls.filter((c) => c.url.endsWith('/render')).length, 1, 'a second send has nothing to send');
 });
 
+// task 1004483 — live on project 43: a fresh repo holds only the hall's scaffold, so Render
+// ran the hall and timed out. A fresh repo records the choice and creates nothing on Render.
+test('a brand-new repo choosing Render asks for no key, says when it happens, and sends nothing at Create', async () => {
+  const w = load({ answers: ANSWERS, draft: { appPlatform: 'render', mode: 'greenfield' } });
+  w.syncRenderSetup();
+  assert.equal(w.$('renderLater').hidden, false, 'the note shows');
+  assert.equal(w.$('renderSetup').hidden, true, 'no key, workspace or plan questions');
+  assert.equal(w.validateRender(), true, 'Next is not blocked on a key nobody needs yet');
+  assert.match(w.appRow(), /^Render — set up from your project’s page once your app has code\. Nothing is created on Render now\.$/);
+  w.sendRenderSetup(42);
+  await flush();
+  assert.equal(w.calls.filter((c) => c.url.endsWith('/render')).length, 0, 'nothing is sent to Render');
+  assert.equal(w.$('doneRender').hidden, false);
+  assert.match(w.$('doneRender').textContent, /once it has code: set it up from your project’s page/);
+  assert.equal(w.watches.length, 0, 'there is no app progress to watch');
+});
+
+test('switching the same draft to an adopted repo brings the full Render flow back', () => {
+  const w = load({ draft: { appPlatform: 'render', mode: 'greenfield' } });
+  w.syncRenderSetup();
+  assert.equal(w.$('renderLater').hidden, false);
+  w.state.mode = 'adopt';
+  w.syncRenderSetup();
+  assert.equal(w.$('renderLater').hidden, true);
+  assert.equal(w.$('renderSetup').hidden, false);
+  assert.equal(w.validateRender(), false, 'an adopted repo needs the key checked');
+  w.state.appPlatform = 'later';
+  w.syncRenderSetup();
+  assert.equal(w.$('renderLater').hidden, true, 'Decide later shows neither');
+});
+
 test('a refused setup request says the project is still being created', async () => {
   const w = load({ answers: { ...ANSWERS, '/api/bongos/provisioning/instances/42/render': { status: 409, message: 'This project has no GitHub repository linked.' } }, draft: { appPlatform: 'render' } });
   w.typeKey(KEY);

package/tests/provisioning_render_route.mjs

@@ -136,6 +136,9 @@ for (const [name, body, re] of [
   ['an unknown runtime', { ...GREEN, runtime: 'cobol' }, /built with/],
   ['a native runtime with no start command', { ...GREEN, start_command: '  ' }, /how your app starts/],
   ['docker with commands', { ...GREEN, runtime: 'docker' }, /leave the commands out/],
+  // task 1004483 — the hall is never the app; on Render it has no database and times out
+  ['a start command that runs the hall', { ...GREEN, start_command: 'node node_modules/@bongos/core/src/platform-server.js' }, /starts the project’s Builders’ hall/],
+  ['the hall by its file alone', { ...GREEN, start_command: 'node platform-server.js' }, /starts the project’s Builders’ hall/],
   ['adopt saying how to build', { key: KEY, owner_id: 'tea-abcdefgh1234', mode: 'adopt', service_id: 'srv-abcdefgh1234', runtime: 'node' }, /exactly as it is/],
 ]) {
   await ta(`${name} → 400, nothing kept`, async () => {