@bongos/core 1.20.76 → 1.20.78

package/docs/adr/0360-bongos-follows-every-candidate-every-other-project-follows-releases.md

@@ -0,0 +1,66 @@
+# ADR 0360 — Bongos follows every candidate; every other project follows releases
+
+- **Status:** Accepted
+- **Date:** 2026-09-26
+- **Task:** [task 1004297](https://cloudbongos.com/builders#/task/1004297) (goal 1000090 — BONGOS-V2), split out of [task 1002622](https://cloudbongos.com/builders#/task/1002622) §4.
+- **Deciders:** the owner, Lars. His decision, confirmed 2026-09-26: "Bongos takes every candidate automatically."
+- **Amends:** [ADR 0136](0136-update-channel-subscription-policy.md) (the update-channel subscription policy). It adds a second axis and a retry hold. The channels, the opt-in roster, autonomy-gating and auto-rollback are unchanged.
+
+## Context
+
+Other projects will soon receive only the versions the owner presses Release on (task 1004298). Bongos must not wait on that button: it is the project every change is built in, and running each version first is what gives Release its evidence.
+
+Today the machinery exists but is slow. The update sweep upgraded cloudbongos.com from 1.19.1030 to 1.19.1033 at 00:22 UTC on 2026-09-26, and nothing else moved it that day. Its timer on the control plane still fires daily, although task 1003674 declared a 15-minute cadence; installing that is [task 1003969](https://cloudbongos.com/builders#/task/1003969), an operator step on the host.
+
+The site served 1.19.1033 all afternoon while 1.19.1034–1.19.1039 were published. The deploy page listed that work as "published, not running here" and did not say that the sweep was the reason.
+
+## Decision
+
+### D1 — A per-instance FOLLOW beside the channel
+
+`config/update-subscriptions.json` entries carry `follow`:
+
+- **`released`**, the default for every project. It takes only versions at or below the registry's `latest` label, which is what the owner has released to other projects.
+- **`candidates`**, for the platform's own hall only. It takes every version as soon as it is published.
+
+The channel still bounds how far a jump may go (patch, minor, never a major). The follow bounds which versions exist to jump to. An unknown value reads as `released`, the follow that takes fewer versions, the same way an unknown channel reads as `patch`.
+
+### D2 — Released means the `latest` label, and an unreadable label moves nobody
+
+`readReleaseTags` reads `npm view @bongos/core dist-tags`. It is a separate read, because `listAvailableVersions`' output shape is relied on by the deploy door and by `bongos upgrade`. An instance that follows releases and whose label cannot be read is **skipped** and logged. It is never upgraded on a guess.
+
+Until task 1004298 publishes candidates under a label of their own, `latest` is the newest version and both follows pick the same target. The axis lands first so that the split changes nothing for Bongos.
+
+### D3 — Cadence is the lag
+
+The sweep's timer period is the delay between a merge and Bongos serving it; CI publishes within about two minutes. The declared cadence is 15 minutes, with a floor of about 5 minutes (ADR 0136, task 1003674). Nothing in the core can install a host timer, so the declaration and the recipe are the core's half. Task 1003969 installs it on the control plane.
+
+### D4 — A version that failed here is held for a day
+
+At a daily cadence a version that failed its health check was retried once a day. At 15 minutes the same version would be installed, fail, restart the service and roll back four times an hour until something newer was published. So when an upgrade fails and the version did not go in, the sweep records it for that instance in its own config home (`~/.config/<instance>/core-update-refused.json`, never inside an instance's tree, where it would wedge the lane).
+
+For a day the sweep skips that version and says so. Any newer version is taken at once, because it is the fix. The hold expires, so a transient failure is retried rather than refused forever.
+
+### D5 — The deploy page says whether it is happening
+
+The npm-release section of the platform hall's `/deploy` gains **Upgrades on this hall**, read from the `core_upgrades` ledger, newest first:
+
+- **Who moved it.** An Upgrade pressed on `/deploy`, the automatic update, or "on the server" when the ledger cannot tell a sweep from a shell.
+- **Rolled-back moves**, flagged with their reason. A rollback as the last move is a warning.
+- **A published version waiting more than 30 minutes**, twice the declared cadence. The page calls it "the automatic update may have stopped", which is what the afternoon of 2026-09-26 was.
+
+## Rejected
+
+- **A second, candidate-only runner.** One sweep over one roster, with the difference expressed as data on the entry, keeps one code path and one set of safety rules.
+- **CI pushing the upgrade to the box.** It would move the act across the trust boundary ADR 0293 D1 keeps on the control plane.
+- **Holding a failed version until a human clears it.** That trades an outage generator for a silently frozen lane. The day-long hold plus "a newer version is taken at once" covers the real case, where the fix is the next merge.
+
+## Consequences
+
+- **Owner or operator step before task 1004298 ships:** set the platform's roster entry to `"follow": "candidates"`. Otherwise, the day candidates stop carrying `latest`, the platform stops taking them.
+- **Operator step (task 1003969):** install the timer at `OnCalendar=*:0/15`. Until then the lane still runs once a day, and the deploy page will say so.
+- **The platform restarts on each new version**, roughly one every merge, with the existing health check and auto-rollback as the net.
+- **Proof:**
+  - `tests/update_channel.mjs`: follow normalisation, `versionsForFollow`, `readReleaseTags`, the roster field, and composition with the channel.
+  - `tests/update_subscription_engine.mjs`: `followTarget` over the real channel math, the fail-closed skip, the old-core fallback, and the hold (skip, expiry, a newer version still taken, the record kept outside the instance tree).
+  - `tests/npm_release_work.mjs` and `tests/npm_release_page.mjs`: the ledger reading, the rollback, the waiting alarm, and their rendering.

package/docs/adr/README.md

@@ -478,3 +478,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0357 | [**The update rule set on /deploy is the one the sweep follows** ([task 1004468](https://cloudbongos.com/builders#/task/1004468), goal 1000090 — BONGOS-V2, owner's ruling 2026-09-30). Amends [ADR 0136](0136-update-channel-subscription-policy.md)'s rejected DB-column alternative. **D1:** for a roster entry whose slug matches a `provisioning_instances` row, the unattended sweep uses that row's `update_channel` (set on /deploy, task 1004445). **D2:** the roster's `channel` is only the fallback — no matching row, or the database unreadable; enrollment and topology stay in the roster. **D3:** the sweep logs each entry's channel and its source, naming an overridden roster value. **D4:** read over psql from the sweep's own `DATABASE_URL`/`PGDATABASE`, never an entry's `env`. **D5:** nothing is copied; a row never changed is `patch`. Delivery to cloudbongos.com waits on the frozen sweep checkout (task 1004307). Rejected: roster stays in charge; stricter-of-the-two; copying roster values into rows.](0357-the-update-rule-set-on-deploy-is-the-one-the-sweep-follows.md) | distribution / updates |
 | 0358 | [**A hall wears a look, and its night takes a tint of it** ([task 1004421](https://cloudbongos.com/builders#/task/1004421), goal 1000121 — BV2.PS06; owner D2 + D8, 2026-09-30). Amends [ADR 0219](0219-a-look-is-a-branding-pack-the-style-library.md) (a look could not carry a dark ground) and DESIGN.md's pure-black rule, for halls only. **D1:** the night tint is a formula over the thirteen — the four dark grounds take 5–6% of the look's accent (src/night-tint.js), emitted after the sheet as both dark twins; no token added. **D2:** on by default, and only a chosen look turns it on — a hall with no look is unchanged. **D3:** the apex and hub stay pure black (ADR 0204). **D4:** a custom look is ONE accent for both modes, its lightness nudged until every pair the hall paints with it reads (lookAdjustAccent, client copy test-pinned). **D5:** look + night_tint join the provisioning settings vocabulary; the accent and logo address ride as companion env; the instance resolves the look from the style library. **D6:** a logo is PNG/JPEG/WebP ≤256 KB, magic-sniffed, never SVG, served content-addressed; it is the hall mark and the favicon. Rejected: per-look dark palettes, two custom accents, refusing an unreadable accent, sending the palette over env.](0358-a-hall-wears-a-look-and-its-night-takes-a-tint.md) | hall / branding / design world |
 | 0359 | [**Nobody sets a module's score by hand; a Metic+ person can ask for a re-check** ([task 1003796](https://cloudbongos.com/builders#/task/1003796) · goal 1000091, criterion `wa5-quality-assessed`). Amends [ADR 0343](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) D6 and [ADR 0347](0347-every-store-module-ships-a-how-to.md) D5 on the owner's ruling: there is no score override. A score only ever comes from its signals. Instead `POST /store/modules/:key/versions/:version/reassess { reason }`, gated by the new `module.assessment.rerun` atom (metic floor, granted to metic + archon by `government_021`), queues the same assessment a publish runs. A reason is required and nothing else is accepted. The delist (task 1003797) is unchanged.](0359-nobody-sets-a-module-score-by-hand-metic-can-ask-for-a-re-check.md) | module store / assessment / permissions |
+| 0360 | [**Bongos follows every candidate; every other project follows releases** ([task 1004297](https://cloudbongos.com/builders#/task/1004297), goal 1000090 — the owner's 2026-09-26 decision that the Bongos hall takes every candidate automatically). Amends ADR 0136. **D1:** a per-instance `follow` beside the channel — `released` (default: at or below the registry's `latest` label) or `candidates` (every version, the platform hall only). **D2:** released is the `latest` dist-tag, read separately; an unreadable label skips the instance, never a guess. **D3:** the timer period is the lag — 15 min declared, installed by task 1003969. **D4:** a version that failed here is held for a day per instance (recorded in the sweep's config home), while any newer version is taken at once — no restart loop at a 15-minute cadence. **D5:** the deploy page's "Upgrades on this hall" — the core_upgrades ledger, rollbacks flagged, and a published version waiting past 30 min said to be the automation stopping. Rejected: a second runner, CI pushing to the box, a hold only a human clears.](0360-bongos-follows-every-candidate-every-other-project-follows-releases.md) | update channel / deploy / core update |

package/docs/api/openapi.json

@@ -4018,6 +4018,58 @@
         ]
       }
     },
+    "/copy-desk/artists/{id}/pages": {
+      "get": {
+        "operationId": "get_copy_desk_artists_id_pages",
+        "tags": [
+          "copy-desk"
+        ],
+        "summary": "GET /copy-desk/artists/:id/pages",
+        "description": "any signed-in builder may read any artist's approved pages, as the profile's other Activity tabs are; a stranger gets the sign-in line.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/copy-desk/routes/copy-desk-artist.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetCopyDeskArtistsIdPagesResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/copy-desk/flags": {
       "post": {
         "operationId": "post_copy_desk_flags",
@@ -23560,6 +23612,21 @@
           "count"
         ]
       },
+      "GetCopyDeskArtistsIdPagesResponse": {
+        "type": "object",
+        "properties": {
+          "rows": {},
+          "total": {},
+          "inventory_known": {},
+          "page": {}
+        },
+        "required": [
+          "rows",
+          "total",
+          "inventory_known",
+          "page"
+        ]
+      },
       "GetCoreUpdateResponse": {
         "type": "object",
         "properties": {
@@ -31226,9 +31293,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 488,
-  "x-schema-count": 518,
+  "x-endpoint-count": 489,
+  "x-schema-count": 519,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 346,
+  "x-response-schemas": 347,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 488 endpoints across 89 route files.
+> **Generated from the live route files** — the route file is authoritative. 489 endpoints across 90 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -180,11 +180,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/connections/requests` | `any-builder` | — | MY pending requests, both directions (own data). |
 | GET | `/api/bongos/connections/suggestions` | `any-builder` | — | "builders you may know" (R21, task 1002297; ADR 0202 D5). |
 
-## `copy-desk` (19)
+## `copy-desk` (20)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/copy-desk/approvals` | `any-builder` | — | GET /copy-desk/approvals — every round waiting for its artist, oldest applied first, with its position ("1 of 2"), the lines it rewrote (… |
+| GET | `/api/bongos/copy-desk/artists/:id/pages` | `any-builder` | — | any signed-in builder may read any artist's approved pages, as the profile's other Activity tabs are; a stranger gets the sign-in line. |
 | POST | `/api/bongos/copy-desk/flags` | `any-builder` | `scope`, `surface`, `string_id`, `reason`, `kind` | ------------------------------------------------------------------------- POST /copy-desk/flags — file a flag. |
 | POST | `/api/bongos/copy-desk/flags/:id/close` | `any-builder` | `status`, `resolution_note`, `resolved_task_id` | ------------------------------------------------------------------------- POST /copy-desk/flags/:id/close — resolve or dismiss. |
 | GET | `/api/bongos/copy-desk/next` | `any-builder` | — | ------------------------------------------------------------------------- GET /copy-desk/next — the Tweak/CopyWrite Flow's recommendation… |