@bongos/core 1.20.78 → 1.20.79

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.78",
-  "core_contract": "1.20.78",
-  "source_commit": "54fe45a4edf4789308fc09a05904110b20b555ff",
+  "core_version": "1.20.79",
+  "core_contract": "1.20.79",
+  "source_commit": "64ae8acdc9544a463ce41e8e0ce8dfee875327cd",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T20:43:40.208Z",
+  "built_at": "2026-10-01T20:53:47.318Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 575,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3414,
-  "tree_sha256": "f7d14f92e9dd084e4959190624762c8a22148f6700e48f0ef079e9988a92a5dc",
+  "tree_sha256": "5941d8223207a2d128e436b272afafd9d42babc2a4e3a6f53703030f345c2524",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2812,7 +2812,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "2b7d697f9a5870c16de63e84268ee995f0c1ef7aedc825cf1d7610559744677d"
+      "sha256": "00fccfe8cd2be193718d7afb974532b1894c9a7e84d253efbc4d701bdeb77fd8"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8062,7 +8062,7 @@
     {
       "path": "modules/provisioning/render-standup.js",
       "mode": "0000644",
-      "sha256": "e1ace20074d6bcb25cc457b240512925ed5b7d4cc931633082d262067fce9f8a"
+      "sha256": "51c00d712c515978cdffcde9ae2c6a170c96be931937a10d557b56de553baf67"
     },
     {
       "path": "modules/provisioning/repo-private.js",
@@ -9492,12 +9492,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f8da6c11ec17d4c4a83d5e070d3ae0c941376a527b4a9a0be7ce1903d7beb482"
+      "sha256": "a4642f9f20444bff0403d128e168c46d6b4f324e2ac1f4c96d7bedfd46364993"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8dfe3adc1e608279f3ffee6a8cdfd3c7c32b7581395ea81bb000dc370afe0035"
+      "sha256": "777adb699d644169fbc9f584cc905c72f2194e128bbbd2b9964e3cc5f0b85c8a"
     },
     {
       "path": "public-docs/index.html",
@@ -9517,7 +9517,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "e70c626913df104cf096a75eb4b06ff9cabcddda470e063839a4fffd26e78407"
+      "sha256": "3e51a0173ecdada1d9b65f38767b58a304e2a6b8db380d19cd385161a04802f5"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10242,7 +10242,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "14c21f1640f81fa039c59a49acb0155e5fa6eb4eb177e845ceec1f88bc067528"
+      "sha256": "f9e77db85aa1ec20f55f0e96cade7c2977863d21a4c148407deb965b436bfdc3"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -11712,7 +11712,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f11189e9084e5a2b10a2767bfa8166a419fbd202e90252a628a1fc426f7102f9"
+      "sha256": "63daeed9c2794aa30bb815c8e2af623e13808ecbe4d58c3d02b9d8fb1aeeae79"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14367,7 +14367,7 @@
     {
       "path": "tests/init.mjs",
       "mode": "0000644",
-      "sha256": "376da89565a6ad32788029406163bc6b5198e3279e07645256550747ec1b728a"
+      "sha256": "6549706010a545b9d387d8e3f4f4a157a5088c4292dbc288e3e7fc27f5335ead"
     },
     {
       "path": "tests/instance_config.mjs",
@@ -16892,7 +16892,7 @@
     {
       "path": "tests/upgrade_migrate.mjs",
       "mode": "0000644",
-      "sha256": "d3f5b941b89ede78ebb3cd7af43467363e5d6c6d35c7ad26a2977683ecf869e7"
+      "sha256": "47048521bb37c9debc02ef5c366bfe863450eb944023cce60ba182b9640563ee"
     },
     {
       "path": "tests/upgrade_outcome.mjs",

package/docs/module-api-changelog.md

@@ -2813,5 +2813,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.76 with no explicit bump. run 36909904812. (task 1002620)
   1.20.78 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.77 with no explicit bump. run 36923602676. (task 1002620)
+  1.20.79 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.78 with no explicit bump. run 36924822923. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/render-standup.js

@@ -57,7 +57,8 @@ const SERVICE_RE = /^srv-[a-z0-9]{8,64}$/;
 // The hall is never the app (ADR 0345 D1). A command that runs the Bongos core itself puts
 // a second, database-less copy of the project's hall on Render, where it never answers and
 // the deploy times out — measured live on project 43 (task 1004483). It cannot see through
-// the scaffold's own `npm start`, which still runs the hall; that is task 1004484.
+// `npm start`, so the scaffold no longer puts the hall there: it is `npm run hall`, and
+// `npm start` is left for the app (task 1004484, scripts/gds/init.js).
 const HALL_COMMAND_RE = /platform-server\.js|node_modules[\\/]@bongos[\\/]core/i;
 const HALL_REFUSAL = 'That command starts the project’s Builders’ hall, which we already host — not your app. Give the command that starts your app.';
 function badRequest(body) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.78",
+  "version": "1.20.79",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.78",
+      "version": "1.20.79",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.78",
+  "version": "1.20.79",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8609,5 +8609,11 @@
       "id": "1004297",
       "text": "Each project can now be set to take every new version (Bongos) or only released ones (everyone else), a version that fails is no longer retried in a loop, and the deploy page shows each upgrade, any rollback, and when the auto"
     }
+  ],
+  "1.20.79": [
+    {
+      "id": "1004484",
+      "text": "New projects no longer have their 'start' command pointing at the Bongos hall, so when an owner later connects Render with the usual 'npm start', it runs their app instead of a broken second copy of the hall."
+    }
   ]
 }

package/scripts/gds/init.js

@@ -126,20 +126,24 @@ function coreVersionSafe() {
 }
 
 // The npm scripts a STANDALONE greenfield instance runs. They MIRROR how the control
-// plane runs a standalone instance (scripts/gds/provision.js): `start` = the systemd
+// plane runs a standalone instance (scripts/gds/provision.js): `hall` = the systemd
 // ExecStart (`node <core>/src/platform-server.js`), `migrate` = standaloneMigrateCmd
-// (`bash <core>/scripts/migrate.sh`). Keeping them identical means `npm start` /
+// (`bash <core>/scripts/migrate.sh`). Keeping them identical means `npm run hall` /
 // `npm run migrate` on the instance behave like production, and `bongos upgrade`'s
 // `npm run migrate` step resolves to the core's migrate.sh (ADR 0108).
+// The hall is deliberately NOT `start` (task 1004484): `npm start` belongs to the
+// project's own app, and a host like Render reads it as "how this app starts" — given the
+// hall there, the deploy has no database and times out. Nothing runs an instance's
+// `npm start`: the box unit and `bongos dev` both start platform-server.js directly.
 const INSTANCE_CORE_PKG_DIR = 'node_modules/@bongos/core';
-const INSTANCE_START_SCRIPT = `node ${INSTANCE_CORE_PKG_DIR}/src/platform-server.js`;
+const INSTANCE_HALL_SCRIPT = `node ${INSTANCE_CORE_PKG_DIR}/src/platform-server.js`;
 const INSTANCE_MIGRATE_SCRIPT = `bash ${INSTANCE_CORE_PKG_DIR}/scripts/migrate.sh`;
 
 // PURE (exported for tests) — build/augment the greenfield instance package.json so a
 // fresh instance is `npm ci`-installable and runnable (ADR 0108 greenfield gap 1/4,
 // task 2053): the @bongos/core dependency (the `file:` tarball pin when a tarball is
 // vendored, else the declared caret range — the CARET RESOLVES NOWHERE on npm, which is
-// exactly why the vendored path pins `file:`) plus the start/migrate npm scripts a
+// exactly why the vendored path pins `file:`) plus the hall/migrate npm scripts a
 // standalone instance runs. Preserves any pre-existing fields + scripts (fills only what
 // is missing); greenfield OWNS the core dep, so it is always (re)set to `coreDep`. Never
 // spawns npm — generating the lockfile is a separate imperative step in main().
@@ -155,7 +159,13 @@ function buildInstancePackageJson(existing, { name = 'cloudbongos-instance', cor
   if (!pkg.name) pkg.name = name;
   if (pkg.private === undefined) pkg.private = true;
   pkg.scripts = { ...(isObj(pkg.scripts) ? pkg.scripts : {}) };
-  if (!pkg.scripts.start) pkg.scripts.start = INSTANCE_START_SCRIPT;
+  // A scaffold from before task 1004484 wrote the hall as `start`; move exactly that
+  // command (never an owner's own start) to `hall`, unless they already have a `hall`.
+  if (pkg.scripts.start === INSTANCE_HALL_SCRIPT && !pkg.scripts.hall) {
+    pkg.scripts.hall = pkg.scripts.start;
+    delete pkg.scripts.start;
+  }
+  if (!pkg.scripts.hall) pkg.scripts.hall = INSTANCE_HALL_SCRIPT;
   if (!pkg.scripts.migrate) pkg.scripts.migrate = INSTANCE_MIGRATE_SCRIPT;
   pkg.dependencies = {
     ...(isObj(moduleDeps) ? moduleDeps : {}),
@@ -1136,7 +1146,7 @@ module.exports = {
   buildReadmeSection, appendReadmeSection, layerReadme, README_MARKER,
   KNOWN_MODULES, HOSTING_SHAPES, CORE_PKG,
   // greenfield installability (ADR 0108 gap 1/4, task 2053)
-  buildInstancePackageJson, coreVersionSafe, INSTANCE_START_SCRIPT, INSTANCE_MIGRATE_SCRIPT,
+  buildInstancePackageJson, coreVersionSafe, INSTANCE_HALL_SCRIPT, INSTANCE_MIGRATE_SCRIPT,
   // enabled-module dep composition (ADR 0138 / task 2160)
   moduleDeclaredDeps, enabledModuleDeps,
 };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.78'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.79'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/init.mjs

@@ -389,15 +389,18 @@ test('layerPackageJson: no package.json → creates one; second run → present,
 // ---- greenfield installability: package.json minting + writeConfigs (ADR 0108 gap 1/4, task 2053) ----
 // PURE — no fs, no npm. The imperative vendor + `npm install` lockfile step lives in main()
 // and is deliberately NOT unit-tested (keeps real npm out of the suite, per the task).
-test('buildInstancePackageJson: no package.json → mints a private one with the caret core dep + start/migrate scripts', () => {
+test('buildInstancePackageJson: no package.json → mints a private one with the caret core dep + hall/migrate scripts', () => {
   const pkg = init.buildInstancePackageJson(null, { name: 'demo' });
   assert.equal(pkg.name, 'demo');
   assert.equal(pkg.private, true);
   assert.equal(pkg.dependencies[init.CORE_PKG], init.coreDepRange());   // caret when no tarball vendored
-  assert.equal(pkg.scripts.start, init.INSTANCE_START_SCRIPT);
+  assert.equal(pkg.scripts.hall, init.INSTANCE_HALL_SCRIPT);
   assert.equal(pkg.scripts.migrate, init.INSTANCE_MIGRATE_SCRIPT);
-  // the start/migrate scripts must target the installed core package so `npm ci` output is runnable
-  assert.match(pkg.scripts.start, /node_modules\/@bongos\/core\/src\/platform-server\.js$/);
+  // `npm start` is left for the project's OWN app (task 1004484): a host like Render reads it
+  // as "how this app starts", and the hall there has no database and times out.
+  assert.equal(pkg.scripts.start, undefined);
+  // the hall/migrate scripts must target the installed core package so `npm ci` output is runnable
+  assert.match(pkg.scripts.hall, /node_modules\/@bongos\/core\/src\/platform-server\.js$/);
   assert.match(pkg.scripts.migrate, /node_modules\/@bongos\/core\/scripts\/migrate\.sh$/);
 });
 
@@ -419,6 +422,18 @@ test('buildInstancePackageJson: preserves existing fields + never clobbers a cus
   assert.equal(pkg.dependencies[init.CORE_PKG], 'file:vendor/bongos-core-1.17.0.tgz'); // dep (re)pinned
 });
 
+test('buildInstancePackageJson: a start that is exactly the old scaffolded hall command moves to "hall" (task 1004484)', () => {
+  const old = 'node node_modules/@bongos/core/src/platform-server.js';
+  const pkg = init.buildInstancePackageJson({ scripts: { start: old, test: 'node --test' } }, { name: 'demo' });
+  assert.equal(pkg.scripts.start, undefined, 'npm start no longer runs the hall');
+  assert.equal(pkg.scripts.hall, old);
+  assert.equal(pkg.scripts.test, 'node --test');
+  // an owner's own "hall" script is never overwritten by the move
+  const kept = init.buildInstancePackageJson({ scripts: { start: old, hall: 'node my-hall.js' } }, { name: 'demo' });
+  assert.equal(kept.scripts.hall, 'node my-hall.js');
+  assert.equal(kept.scripts.start, old, 'with "hall" taken, start is left as the owner has it');
+});
+
 // --- enabled-module dep composition (ADR 0138 / task 2160) --------------------
 
 test('enabledModuleDeps: merges only the ENABLED modules’ declared deps', () => {
@@ -475,7 +490,8 @@ test('writeConfigs (greenfield): mints package.json with the caret core dep + st
     assert.equal(pkg.name, 'cloud-bongos');                  // slugified productName
     assert.equal(pkg.private, true);
     assert.equal(pkg.dependencies[init.CORE_PKG], init.coreDepRange());
-    assert.equal(pkg.scripts.start, init.INSTANCE_START_SCRIPT);
+    assert.equal(pkg.scripts.hall, init.INSTANCE_HALL_SCRIPT);
+    assert.equal(pkg.scripts.start, undefined);
     assert.equal(pkg.scripts.migrate, init.INSTANCE_MIGRATE_SCRIPT);
   } finally {
     rmSync(dir, { recursive: true, force: true });

package/tests/upgrade_migrate.mjs

@@ -47,7 +47,7 @@ function adoptedProject({ installed = '1.19.312' } = {}) {
   return dir;
 }
 
-function scaffoldedProject(scripts = { migrate: init.INSTANCE_MIGRATE_SCRIPT, start: init.INSTANCE_START_SCRIPT }) {
+function scaffoldedProject(scripts = { migrate: init.INSTANCE_MIGRATE_SCRIPT, hall: init.INSTANCE_HALL_SCRIPT }) {
   const dir = fixture('upgrade-migrate-scaffold-');
   writeFileSync(path.join(dir, 'package.json'), `${JSON.stringify({ name: 'charter', private: true, scripts, dependencies: { '@bongos/core': '1.19.871' } }, null, 2)}\n`);
   return dir;