@bongos/core 1.20.78 → 1.20.80

package/docs/recipes/upgrading-the-core.md

@@ -97,7 +97,7 @@ A **major** is never automatic; prereleases are never auto-targeted.
 | `released` *(default)* | versions at or below the registry's `latest` label, what the owner has released | every project |
 | `candidates` | every published version, as soon as it is published | **the platform's own hall only** |
 
-An instance that follows releases and whose `latest` label cannot be read is **skipped**, never upgraded on a guess. Until candidates publish under their own label (task 1004298), `latest` is the newest version, so the two follows pick the same target. Set the platform's own entry to `"follow": "candidates"` **before** that split lands, or the platform stops taking candidates the day they appear.
+An instance that follows releases and whose `latest` label cannot be read is **skipped**, never upgraded on a guess. Once merges publish as candidates (task 1004298, [ADR 0361](../adr/0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md), switched on by the repo variable `PUBLISH_AS_CANDIDATE=1`), `latest` moves only when the owner presses **Release** on /deploy, and the two follows part. Until that variable is set, `latest` is the newest version and they pick the same target. Set the platform's own entry to `"follow": "candidates"` **before** setting it, or the platform stops taking new versions the moment it is set. The platform's runner for hosted projects needs no roster entry: the `control-plane` row follows candidates and every other project follows releases.
 
 **Crossing a minor from /deploy** (task [1004405](https://cloudbongos.com/builders#/task/1004405)): set the project's update rule to **Fixes and new releases** (`minor`), or press **Allow new releases and move** on the refused move — either is the explicit "this crosses a minor version" choice. That only works once the box runs a core whose runner reads the rule (core 1.20.29 or later, task [1004445](https://cloudbongos.com/builders#/task/1004445)). A box on anything older runs the old runner, which bounds every move to `patch` whatever the rule says, so its **first** crossing is the manual `upgrade.js --to <version>` above; every later one goes through /deploy.
 

package/modules/lifecycle/module.json

@@ -41,7 +41,8 @@
   "provides": [
     "lifecycle",
     "lifecycle.kickoffSeed",
-    "lifecycle.removals"
+    "lifecycle.removals",
+    "lifecycle.workflowDispatch"
   ],
   "consumes": []
 }

package/modules/lifecycle/routes/lifecycle.js

@@ -53,6 +53,13 @@ function registerSeams() {
   if (!api.hasProvider('lifecycle')) {
     api.registerProvider('lifecycle', lifecycle);
   }
+  // The one GitHub act another module may borrow (task 1004298): start a workflow. The npm-release
+  // module's Release button runs publish.yml through it. A port of one function rather than the
+  // github-push module whole, so the borrower can start a workflow and do nothing else with the
+  // server's GitHub credential.
+  if (!api.hasProvider('lifecycle.workflowDispatch')) {
+    api.registerProvider('lifecycle.workflowDispatch', { dispatchWorkflow: (args) => require('../workflow-dispatch').dispatchWorkflow(args) });
+  }
   if (_cascadeListenerOff) _cascadeListenerOff();
   // Torn down with its sibling: the factory runs again every time a test rebuilds
   // the router, and a leaked subscription would fire this cascade twice.

package/modules/lifecycle/workflow-dispatch.js

@@ -0,0 +1,45 @@
+'use strict';
+
+// modules/lifecycle/workflow-dispatch.js — the one GitHub act another module may borrow.
+// Lent through the `lifecycle.workflowDispatch` port (routes/lifecycle.js); see ADR 0361.
+// Kept beside github-push.js rather than in it: it shares that file's credential and headers,
+// and nothing else.
+
+const { resolveToken, ghHeaders, isSafeBranch } = require('./github-push');
+const { repoInfo: { loadRepoInfo } } = require('../../src/module-api');
+
+// dispatchWorkflow — start a GitHub Actions workflow on this repo (task 1004298, ADR 0361). The
+// Release button on /deploy uses it to run publish.yml's release job, so the npm credential never
+// leaves GitHub: the server holds only the GitHub App key it already holds, and the App needs
+// Actions: write for this one call. Returns { ok:true } on GitHub's 204, otherwise
+// { ok:false, code, status? } — UNCONFIGURED (no credential), NO_REPO_INFO, BAD_INPUT, REFUSED
+// (GitHub said no: 403 = the App lacks Actions: write, 404 = no such workflow or no access,
+// 422 = an input the workflow does not declare), UNREACHABLE. Never throws.
+//
+// ONLY THE WORKFLOWS NAMED HERE can be started. The port lends the server's GitHub credential to
+// another module; an allowlist keeps a buggy or future borrower from running any other workflow in
+// the repo. Adding one is a reviewed edit to this line.
+const DISPATCHABLE_WORKFLOWS = Object.freeze(['publish.yml']);
+async function dispatchWorkflow({ workflow, ref = 'main', inputs = {} }, deps = {}) {
+  if (!DISPATCHABLE_WORKFLOWS.includes(String(workflow || '')) || !isSafeBranch(ref)) return { ok: false, code: 'BAD_INPUT' };
+  let token;
+  try { token = await resolveToken(deps); } catch (_) { return { ok: false, code: 'UNCONFIGURED' }; }
+  if (!token) return { ok: false, code: 'UNCONFIGURED' };
+  const repoInfo = deps.repoInfo || loadRepoInfo();
+  if (!repoInfo || repoInfo.error) return { ok: false, code: 'NO_REPO_INFO' };
+  const { owner, repo } = repoInfo;
+  const doFetch = deps.fetchImpl || fetch;
+  try {
+    const res = await doFetch(`https://api.github.com/repos/${owner}/${repo}/actions/workflows/${workflow}/dispatches`, {
+      method: 'POST',
+      headers: { ...ghHeaders(token), 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ref, inputs }),
+    });
+    if (res.status === 204 || res.ok) return { ok: true };
+    return { ok: false, code: 'REFUSED', status: res.status };
+  } catch (_) {
+    return { ok: false, code: 'UNREACHABLE' };
+  }
+}
+
+module.exports = { dispatchWorkflow };

package/modules/npm-release/module.json

@@ -16,7 +16,8 @@
     "routes": [
       "work",
       "task-where",
-      "preview"
+      "preview",
+      "release"
     ],
     "uiSections": [
       "task-where"

package/modules/npm-release/public/work.js

@@ -136,6 +136,77 @@
       </li>`;
   }
 
+  // ---- the Release button (task 1004298) ---------------------------------------------------
+  //
+  // Merges publish as candidates: this hall runs each one, no other project is offered it. Release
+  // makes a version the one every other project is offered. Beside each button, the evidence the
+  // owner decides on — how long the version has run here, and whether it was ever rolled back —
+  // read by the server from this hall's upgrade ledger.
+  let releasing = '';
+  let releaseNote = null;   // { ok, text } — the last press's answer, shown until the next read
+
+  function hoursText(h) {
+    if (h == null) return 'not in this hall\'s upgrade ledger';
+    if (h < 1) return 'under an hour';
+    if (h < 48) return `${Math.round(h)} hour${Math.round(h) === 1 ? '' : 's'}`;
+    return `${Math.round(h / 24)} days`;
+  }
+
+  function candidateRow(c) {
+    const ran = c.on_hall_since == null
+      ? 'This hall\'s upgrade ledger does not show it going in.'
+      : c.still_running ? `Running here for ${hoursText(c.hours_on_hall)}.` : `Ran here for ${hoursText(c.hours_on_hall)} before a newer version replaced it.`;
+    const facts = [];
+    if (c.rolled_back) facts.push('<span class="ov-fact"><b>was rolled back here</b></span>');
+    if (c.still_running) facts.push('<span class="ov-fact">running now</span>');
+    const busy = releasing === c.version;
+    return `<li class="ov-row ov-row--dense${c.rolled_back ? ' nr-upgrade--back' : ''}">
+        <div class="ov-row__main">
+          <span class="ov-row__title ov-key">${escapeHtml(c.version)}</span>
+          <p class="ov-row__sub">${escapeHtml(ran)}${c.rolled_back ? ' A move to it did not come back healthy at least once, and was undone.' : ''}</p>
+          ${facts.length ? `<div class="ov-row__facts">${facts.join('')}</div>` : ''}
+        </div>
+        <div class="ov-row__right"><button type="button" class="ov-toggle" data-release="${escapeHtml(c.version)}"${releasing ? ' disabled' : ''}>${busy ? 'Starting…' : 'Release'}</button></div>
+      </li>`;
+  }
+
+  function releaseHtml(d) {
+    const r = d.release;
+    if (!r) return '';
+    let body;
+    if (!r.ok) body = `<p class="ov-row__sub">${escapeHtml(r.error || 'The registry could not be read')}, so nothing can be released right now.</p>`;
+    else if (!r.candidates.length) body = `<p class="ov-row__sub">Nothing is waiting: every version this hall runs is already released${d.released ? ` (the release is ${escapeHtml(d.released)})` : ''}.</p>`;
+    else body = `<ul class="ov-rows">${r.candidates.map(candidateRow).join('')}</ul>`;
+    const note = releaseNote ? `<div class="ov-note${releaseNote.ok ? '' : ' ov-note--warn'}"><p>${escapeHtml(releaseNote.text)}</p></div>` : '';
+    const ledger = r.ok && r.ledger_error ? `<p class="ov-row__sub">${escapeHtml(r.ledger_error)}.</p>` : '';
+    return `<div class="ov-group" data-release-section>
+        <div class="ov-group__head">
+          <span class="ov-group__name">Release</span>
+          ${r.ok ? `<span class="ov-group__n">${r.candidates.length}</span>` : ''}
+        </div>
+        <p class="ov-row__sub">New versions run here first and are offered to no other project. Release makes a version, and everything merged before it, what every other project is offered: their Settings, their banner, their automatic updates.${d.released ? ` Released now: ${escapeHtml(d.released)}.` : ''}</p>
+        ${note}${ledger}${body}
+      </div>`;
+  }
+
+  async function release(version) {
+    if (releasing) return;
+    if (!window.confirm(`Release ${version} to every project?\n\nEvery other project will be offered ${version} and everything merged before it. This cannot be pressed back; a newer version can be released after it.`)) return;
+    releasing = version;
+    releaseNote = null;
+    paint();
+    try {
+      const res = await client.request('POST', `${API}/npm-release/release`, { body: { version } });
+      const msg = (res.data && (res.data.message || (res.data.error && res.data.error.message))) || `release → ${res.status}`;
+      releaseNote = { ok: res.ok, text: msg };
+    } catch (e) {
+      releaseNote = { ok: false, text: `Nothing was released: ${e.message || e}` };
+    } finally {
+      releasing = '';
+      paint();
+    }
+  }
+
   function upgradesHtml(d) {
     const u = d.upgrades;
     if (!u) return '';
@@ -322,6 +393,7 @@
       ${problemsHtml(data)}
       ${figsHtml(stages, data)}
       ${groups || '<p class="ov-row__sub">Nothing was finished in this window.</p>'}
+      ${releaseHtml(data)}
       ${upgradesHtml(data)}
       <p class="ov-foot">read ${escapeHtml(new Date(data.checked_at).toLocaleTimeString())} · ${escapeHtml(data.package)} · release notes from ${escapeHtml(data.notes.source ? `${data.notes.source.from === 'package' ? 'the published' : 'this hall\'s'} ${data.notes.source.version} package` : 'nowhere')}</p>`;
     work.hidden = false;
@@ -398,6 +470,8 @@
     const ex = t.closest('[data-expand]');
     if (ex) { expanded.add(ex.getAttribute('data-expand')); paint(); return; }
     if (t.closest('#nr-older')) { loadOlder(); return; }
+    const rel = t.closest('[data-release]');
+    if (rel) { release(rel.getAttribute('data-release')); return; }
     const pv = t.closest('[data-preview]');
     if (pv) { previewAct(() => previewCall('POST', { version: pv.getAttribute('data-preview') })); return; }
     if (t.closest('[data-preview-stop]')) previewAct(() => previewCall('DELETE'));

package/modules/npm-release/release.js

@@ -0,0 +1,129 @@
+'use strict';
+
+// modules/npm-release/release.js — the Release button's half of the deploy page (task 1004298,
+// ADR 0361).
+//
+// Merges publish as CANDIDATES: on npm, run by this (the platform) hall, offered to no other project.
+// Release makes a version the one every other project is offered, by moving the registry's `latest`
+// label. The move itself happens in GitHub (publish.yml's release job), so the npm credential never
+// leaves GitHub; this server only asks GitHub to run it, through the lifecycle module's one-function
+// workflowDispatch port.
+//
+// TWO THINGS LIVE HERE:
+//   releaseCandidates — the evidence beside each button: how long the version has run on this hall,
+//                       and whether a move to it was ever rolled back here. Read from core_upgrades,
+//                       the ledger `bongos upgrade` writes on every move and rollback.
+//   requestRelease    — what the button does: the same rule the workflow applies (release-core.js,
+//                       imported, never restated), then the dispatch.
+
+const { releaseDecision } = require('../../scripts/gds/release-core.js');
+
+const VERSION_RE = /^\d+\.\d+\.\d+$/;
+// The ledger window the evidence reads. A candidate older than this has been superseded many
+// times over; the page shows the newest few.
+const LEDGER_DAYS = 60;
+const CANDIDATES_SHOWN = 5;
+const WORKFLOW = 'publish.yml';
+
+function compareVersions(a, b) {
+  const pa = String(a).split('.').map(Number);
+  const pb = String(b).split('.').map(Number);
+  for (let i = 0; i < 3; i++) if ((pa[i] || 0) !== (pb[i] || 0)) return (pa[i] || 0) - (pb[i] || 0);
+  return 0;
+}
+
+// The version a rollback row says it ATTEMPTED: "rolled_back: <why> (attempted A → B, restored C)".
+function attemptedIn(note) {
+  const m = /\(attempted\s+\S+\s*→\s*(\d+\.\d+\.\d+)/.exec(String(note || ''));
+  return m ? m[1] : null;
+}
+
+/**
+ * PURE. The versions Release can be pressed on, newest first, each with its evidence.
+ *
+ * A candidate is a published version newer than the release and no newer than what this hall runs
+ * (a version this hall never ran has no evidence, and the hall runs every candidate by design).
+ *
+ * `rows`: core_upgrades rows, any order, { to_version, applied_at, note }. A row whose note begins
+ * `rolled_back:` is a rollback; every other row is a move that went in.
+ *   on_hall_since — when the version first went in here (null: the ledger does not show it);
+ *   hours_on_hall — from then until this hall moved past it, or until now if it still runs it;
+ *   rolled_back   — a move to it was rolled back here at least once.
+ */
+function releaseCandidates({ rows, versions, released, live, now = Date.now() } = {}) {
+  if (!VERSION_RE.test(String(live || ''))) return [];
+  const list = (Array.isArray(versions) ? versions : [])
+    .filter((v) => VERSION_RE.test(v))
+    .filter((v) => compareVersions(v, live) <= 0)
+    .filter((v) => !released || compareVersions(v, released) > 0)
+    .sort(compareVersions)
+    .reverse()
+    .slice(0, CANDIDATES_SHOWN);
+  const ledger = (Array.isArray(rows) ? rows : [])
+    .map((r) => ({ to: r.to_version || null, at: r.applied_at ? Date.parse(r.applied_at) : NaN, note: r.note == null ? '' : String(r.note) }))
+    .filter((r) => Number.isFinite(r.at))
+    .sort((a, b) => a.at - b.at);
+  const moves = ledger.filter((r) => !/^rolled_back:/.test(r.note));
+  const rollbacks = ledger.filter((r) => /^rolled_back:/.test(r.note));
+  return list.map((v) => {
+    const i = moves.findIndex((r) => r.to === v);
+    const since = i >= 0 ? moves[i].at : null;
+    const next = i >= 0 ? moves.slice(i + 1).find((r) => r.to !== v) : null;
+    const until = next ? next.at : now;
+    return {
+      version: v,
+      on_hall_since: since == null ? null : new Date(since).toISOString(),
+      hours_on_hall: since == null ? null : Math.max(0, Math.round(((until - since) / 3600000) * 10) / 10),
+      still_running: v === live,
+      rolled_back: rollbacks.some((r) => attemptedIn(r.note) === v),
+    };
+  });
+}
+
+async function readReleaseLedger(pool) {
+  try {
+    const { rows } = await pool.query(
+      `SELECT to_version, applied_at, note
+         FROM core_upgrades
+        WHERE applied_at > now() - ($1 || ' days')::interval
+        ORDER BY applied_at, id`,
+      [String(LEDGER_DAYS)]
+    );
+    return { ok: true, rows };
+  } catch (e) {
+    return { ok: false, error: e.message, rows: [] };
+  }
+}
+
+/**
+ * What the Release button does. Returns { status, body } for the route to send.
+ *
+ * The rule is release-core.js's releaseDecision — the one the workflow applies again before it
+ * moves anything, so the button cannot promise what the workflow would refuse. Refusals here save a
+ * GitHub run; they are not the gate (the workflow is).
+ */
+async function requestRelease({ version, registry, dispatch } = {}) {
+  if (!registry || !registry.ok) {
+    return { status: 503, body: { error: { code: 'registry_unreadable', message: 'The npm registry could not be read, so nothing was released. Try again in a minute.' } } };
+  }
+  const d = releaseDecision({ version, versions: registry.versions, latest: registry.latest });
+  if (d.noop) return { status: 200, body: { ok: true, noop: true, version, message: `${version} is already the release.` } };
+  if (!d.go) return { status: 409, body: { error: { code: 'not_releasable', message: `Not released: ${d.reason}. Pick a version from the Release list, which shows only the ones that can be released.` } } };
+  if (typeof dispatch !== 'function') {
+    return { status: 503, body: { error: { code: 'dispatch_unavailable', message: 'This hall cannot start GitHub workflows (the lifecycle module is not running), so nothing was released.' } } };
+  }
+  const r = await dispatch({ workflow: WORKFLOW, ref: 'main', inputs: { release_version: version } });
+  if (r && r.ok) {
+    return { status: 202, body: { ok: true, version, message: `Release of ${version} started. GitHub moves the label in a minute or two; other projects are offered it from then on.` } };
+  }
+  const why = !r ? 'no answer'
+    : r.code === 'UNCONFIGURED' ? 'this server has no GitHub credential'
+      : r.code === 'REFUSED' && r.status === 403 ? "GitHub refused: the server's GitHub App needs the Actions: write permission"
+        : r.code === 'REFUSED' && r.status === 404 ? 'GitHub could not find publish.yml, or the App cannot see this repository'
+          : r.code === 'REFUSED' ? `GitHub refused the request (${r.status})`
+            : r.code === 'UNREACHABLE' ? 'GitHub could not be reached'
+              : r.code;
+  return { status: 502, body: { error: { code: 'dispatch_failed', message: `Nothing was released: ${why}.` } } };
+}
+
+module.exports = { releaseCandidates, readReleaseLedger, requestRelease, WORKFLOW };

package/modules/npm-release/routes/release.js

@@ -0,0 +1,65 @@
+'use strict';
+
+// modules/npm-release/routes/release.js — POST /npm-release/release, the deploy page's Release
+// button (task 1004298, ADR 0361). Body: { version }.
+//
+// It does not move anything itself. It asks GitHub to run publish.yml's release job, which checks
+// the same rule again and moves the registry's `latest` label — the version every project other
+// than the platform hall is offered. So the npm credential never leaves GitHub.
+//
+// GATED LIKE THE PAGE (`core.pin.move`), as an atom: the deploy page is served only to holders of
+// it, and a button wider than its page would be a door nobody sees. Never requireRank —
+// tests/government_require_permission.mjs fails the build on one in a modules/*/routes gate.
+//
+// Only the core's page releases: publish.yml publishes @bongos/core, and another package's
+// deploy page has no workflow here to run.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { requestRelease } = require('../release');
+
+const log = api.logger('npm-release');
+const CORE_PACKAGE = '@bongos/core';
+
+// The kernel validator checks presence, type and length; the x.y.z shape is checked by hand below.
+const releaseSchema = { version: { type: 'string', required: true, maxLength: 32 } };
+const VERSION_RE = /^[0-9]+\.[0-9]+\.[0-9]+$/;
+
+module.exports = function buildNpmReleaseReleaseRouter({
+  pkg = () => process.env.NPM_RELEASE_PACKAGE || CORE_PACKAGE,
+  readRegistry = () => api.readPackageRegistry({ pkg: CORE_PACKAGE, haveNotesFor: () => true }),
+  port = () => api.resolveOptional && api.resolveOptional('lifecycle.workflowDispatch'),
+} = {}) {
+  const router = express.Router();
+
+  router.post(
+    '/npm-release/release',
+    api.requireBuilder,
+    api.requirePermission('core.pin.move'),
+    async (req, res) => {
+      if (api.validateOrRespond(req, res, releaseSchema, { strict: true })) return undefined;
+      if (!VERSION_RE.test(req.body.version)) {
+        return res.status(400).json({ error: { code: 'validation_failed', message: 'version must be x.y.z', details: [{ field: 'version', reason: 'bad_format' }] } });
+      }
+      if (pkg() !== CORE_PACKAGE) {
+        return res.status(409).json({ error: { code: 'not_the_core', message: 'Release runs only on the deploy page of the package this repository publishes (@bongos/core).' } });
+      }
+      const version = req.body.version;
+      try {
+        const { registry } = await readRegistry();
+        const p = port();
+        const dispatch = p && typeof p.dispatchWorkflow === 'function' ? (args) => p.dispatchWorkflow(args) : null;
+        const r = await requestRelease({ version, registry, dispatch });
+        const who = req.builder && req.builder.id;
+        if (r.status === 202) log.info(`release of core ${version} requested by builder ${who}`);
+        else log.warn(`release of core ${version} by builder ${who} not started: ${(r.body.error && r.body.error.code) || 'noop'}`);
+        return res.status(r.status).json(r.body);
+      } catch (e) {
+        log.error(`npm-release release failed: ${e && e.message}`);
+        return res.status(500).json({ error: { code: 'release_failed', message: 'Nothing was released: the request failed on this server.' } });
+      }
+    },
+  );
+
+  return router;
+};

package/modules/npm-release/work.js

@@ -30,6 +30,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const api = require('../../src/module-api');
+const { releaseCandidates, readReleaseLedger } = require('./release');
 
 // The package this server runs — the one whose "live" version is this process's own core.
 // Any other package has no "live on this hall" stage: nothing here runs it.
@@ -292,6 +293,18 @@ async function readVersions({ pkg, live, installedNotes, get, now, store }) {
   return { liveVersion, registry, versions, source, notesError, coversTo, published, released };
 }
 
+// The Release section's reading. Fail-soft like the ledger it reads: an unreadable ledger still
+// lists the candidates, with no evidence and the reason, rather than hiding the button.
+async function releaseReading({ pool, registry, released, live, now }) {
+  if (!registry.ok) return { ok: false, error: registry.error || 'the registry could not be read', candidates: [] };
+  const ledger = await readReleaseLedger(pool);
+  return {
+    ok: true,
+    ledger_error: ledger.ok ? null : `this hall's upgrade ledger could not be read (${ledger.error})`,
+    candidates: releaseCandidates({ rows: ledger.rows, versions: registry.versions, released, live, now }),
+  };
+}
+
 async function readWork({
   pool, pkg = configuredPackage(), live, days, before, limit,
   installedNotes = readInstalledNotes, get, now, store,
@@ -332,6 +345,9 @@ async function readWork({
     // Only the core's page has a "this hall" to have upgraded: another package is not what this
     // server runs.
     upgrades: isCore ? await recentUpgrades(pool) : null,
+    // THE RELEASE BUTTON'S EVIDENCE (task 1004298): each version this hall runs that is not yet
+    // released, with how long it has run here and whether a move to it was ever rolled back.
+    release: isCore ? await releaseReading({ pool, registry, released, live: liveVersion, now: at }) : null,
     waiting: isCore && registry.ok ? waitingHere({ live: liveVersion, versions: registry.versions, published, now: at }) : null,
   };
 }

package/modules/provisioning/render-standup.js

@@ -57,7 +57,8 @@ const SERVICE_RE = /^srv-[a-z0-9]{8,64}$/;
 // The hall is never the app (ADR 0345 D1). A command that runs the Bongos core itself puts
 // a second, database-less copy of the project's hall on Render, where it never answers and
 // the deploy times out — measured live on project 43 (task 1004483). It cannot see through
-// the scaffold's own `npm start`, which still runs the hall; that is task 1004484.
+// `npm start`, so the scaffold no longer puts the hall there: it is `npm run hall`, and
+// `npm start` is left for the app (task 1004484, scripts/gds/init.js).
 const HALL_COMMAND_RE = /platform-server\.js|node_modules[\\/]@bongos[\\/]core/i;
 const HALL_REFUSAL = 'That command starts the project’s Builders’ hall, which we already host — not your app. Give the command that starts your app.';
 function badRequest(body) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.78",
+  "version": "1.20.80",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.78",
+      "version": "1.20.80",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.78",
+  "version": "1.20.80",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8609,5 +8609,21 @@
       "id": "1004297",
       "text": "Each project can now be set to take every new version (Bongos) or only released ones (everyone else), a version that fails is no longer retried in a loop, and the deploy page shows each upgrade, any rollback, and when the auto"
     }
+  ],
+  "1.20.79": [
+    {
+      "id": "1004484",
+      "text": "New projects no longer have their 'start' command pointing at the Bongos hall, so when an owner later connects Render with the usual 'npm start', it runs their app instead of a broken second copy of the hall."
+    }
+  ],
+  "1.20.80": [
+    {
+      "id": "1004298",
+      "text": "New versions can now run on Bongos first and reach other projects only when the owner presses Release on the deploy page, which shows how long each version has run on Bongos and whether it was ever rolled back. Switched off un"
+    },
+    {
+      "id": "1003907",
+      "text": "Autobongos has now been proven against the live project: it shipped work by itself with nobody watching, refused every kind of work it is not allowed to touch, and recovered from restarts and network failures on its own. The o"
+    }
   ]
 }

package/scripts/gds/init.js

@@ -126,20 +126,24 @@ function coreVersionSafe() {
 }
 
 // The npm scripts a STANDALONE greenfield instance runs. They MIRROR how the control
-// plane runs a standalone instance (scripts/gds/provision.js): `start` = the systemd
+// plane runs a standalone instance (scripts/gds/provision.js): `hall` = the systemd
 // ExecStart (`node <core>/src/platform-server.js`), `migrate` = standaloneMigrateCmd
-// (`bash <core>/scripts/migrate.sh`). Keeping them identical means `npm start` /
+// (`bash <core>/scripts/migrate.sh`). Keeping them identical means `npm run hall` /
 // `npm run migrate` on the instance behave like production, and `bongos upgrade`'s
 // `npm run migrate` step resolves to the core's migrate.sh (ADR 0108).
+// The hall is deliberately NOT `start` (task 1004484): `npm start` belongs to the
+// project's own app, and a host like Render reads it as "how this app starts" — given the
+// hall there, the deploy has no database and times out. Nothing runs an instance's
+// `npm start`: the box unit and `bongos dev` both start platform-server.js directly.
 const INSTANCE_CORE_PKG_DIR = 'node_modules/@bongos/core';
-const INSTANCE_START_SCRIPT = `node ${INSTANCE_CORE_PKG_DIR}/src/platform-server.js`;
+const INSTANCE_HALL_SCRIPT = `node ${INSTANCE_CORE_PKG_DIR}/src/platform-server.js`;
 const INSTANCE_MIGRATE_SCRIPT = `bash ${INSTANCE_CORE_PKG_DIR}/scripts/migrate.sh`;
 
 // PURE (exported for tests) — build/augment the greenfield instance package.json so a
 // fresh instance is `npm ci`-installable and runnable (ADR 0108 greenfield gap 1/4,
 // task 2053): the @bongos/core dependency (the `file:` tarball pin when a tarball is
 // vendored, else the declared caret range — the CARET RESOLVES NOWHERE on npm, which is
-// exactly why the vendored path pins `file:`) plus the start/migrate npm scripts a
+// exactly why the vendored path pins `file:`) plus the hall/migrate npm scripts a
 // standalone instance runs. Preserves any pre-existing fields + scripts (fills only what
 // is missing); greenfield OWNS the core dep, so it is always (re)set to `coreDep`. Never
 // spawns npm — generating the lockfile is a separate imperative step in main().
@@ -155,7 +159,13 @@ function buildInstancePackageJson(existing, { name = 'cloudbongos-instance', cor
   if (!pkg.name) pkg.name = name;
   if (pkg.private === undefined) pkg.private = true;
   pkg.scripts = { ...(isObj(pkg.scripts) ? pkg.scripts : {}) };
-  if (!pkg.scripts.start) pkg.scripts.start = INSTANCE_START_SCRIPT;
+  // A scaffold from before task 1004484 wrote the hall as `start`; move exactly that
+  // command (never an owner's own start) to `hall`, unless they already have a `hall`.
+  if (pkg.scripts.start === INSTANCE_HALL_SCRIPT && !pkg.scripts.hall) {
+    pkg.scripts.hall = pkg.scripts.start;
+    delete pkg.scripts.start;
+  }
+  if (!pkg.scripts.hall) pkg.scripts.hall = INSTANCE_HALL_SCRIPT;
   if (!pkg.scripts.migrate) pkg.scripts.migrate = INSTANCE_MIGRATE_SCRIPT;
   pkg.dependencies = {
     ...(isObj(moduleDeps) ? moduleDeps : {}),
@@ -1136,7 +1146,7 @@ module.exports = {
   buildReadmeSection, appendReadmeSection, layerReadme, README_MARKER,
   KNOWN_MODULES, HOSTING_SHAPES, CORE_PKG,
   // greenfield installability (ADR 0108 gap 1/4, task 2053)
-  buildInstancePackageJson, coreVersionSafe, INSTANCE_START_SCRIPT, INSTANCE_MIGRATE_SCRIPT,
+  buildInstancePackageJson, coreVersionSafe, INSTANCE_HALL_SCRIPT, INSTANCE_MIGRATE_SCRIPT,
   // enabled-module dep composition (ADR 0138 / task 2160)
   moduleDeclaredDeps, enabledModuleDeps,
 };

package/scripts/gds/provision-core-upgrade.js

@@ -166,6 +166,34 @@ function instanceChannel(inst, channelMod) {
   return channelMod.normalizeChannel(inst && inst.update_channel != null ? inst.update_channel : channelMod.DEFAULT_CHANNEL);
 }
 
+// The versions this project may be moved to: the published ones its FOLLOW admits (task 1004298,
+// ADR 0361). The platform hall (control-plane) takes every candidate; every other project only what
+// has been released, and NOTHING when the registry cannot say which version that is — a project that
+// follows releases is never moved on a guess. A channel module without the follow (an old core
+// resolved at drain time) offers the whole list, which is what every version meant before candidates.
+//
+// The released label is one fact about the registry, the same for every project in a pass, and
+// reading it is a blocking `npm view`. So it is read once per channel module per RELEASE_TAGS_TTL_MS
+// and shared: a pass over N projects costs one extra subprocess, not N. A failed read is not kept.
+const RELEASE_TAGS_TTL_MS = 60 * 1000;
+const releaseTagsMemo = new WeakMap();
+function releaseTagsFor(channelMod, instanceDir, now = Date.now()) {
+  const hit = releaseTagsMemo.get(channelMod);
+  if (hit && now - hit.at < RELEASE_TAGS_TTL_MS) return hit.tags;
+  const tags = channelMod.readReleaseTags({ cwd: instanceDir });
+  if (tags && tags.ok) releaseTagsMemo.set(channelMod, { at: now, tags });
+  return tags;
+}
+
+function offeredVersions(channelMod, inst, instanceDir) {
+  const listed = channelMod.listAvailableVersions({ cwd: instanceDir });
+  if (!listed || !listed.ok || typeof channelMod.followForShape !== 'function') return listed;
+  if (channelMod.followForShape(inst && inst.hosting_shape) === 'candidates') return listed;
+  const tags = releaseTagsFor(channelMod, instanceDir);
+  if (!tags.ok) return { ok: false, error: `could not read which version is released (${tags.error})`, versions: [] };
+  return { ok: true, versions: channelMod.versionsForFollow({ follow: 'released', available: listed.versions, released: tags.released }) };
+}
+
 // A classified refusal (task 1004446): the drain loop stores `failure` beside last_error,
 // so the rest of the self-heal chain acts on a class, not on a sentence. PURE.
 function failed(reason, error, extra = {}) {
@@ -246,7 +274,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
   // pointed at nothing. A row from before the column (undefined) still normalises to that
   // default, so an old runner schema reads exactly as it always did.
   const channel = instanceChannel(inst, channelMod);
-  const listed = channelMod.listAvailableVersions({ cwd: instanceDir });
+  const listed = offeredVersions(channelMod, inst, instanceDir);
   const available = (listed && listed.versions) || [];
   const fault = targetFault(to, available, installed, channel, channelMod.channelAllows);
   if (fault) return failed(outcome.runnerReason(fault), fault);
@@ -1013,7 +1041,7 @@ async function snapshotCoreVersions(inst, deps) {
     const body = probe && !probe.softFailed ? (probe.stdout || '') : null;
     const served = parseServedVersion(body);
     const schemaPending = parseSchemaPending(body);
-    const listed = channelMod.listAvailableVersions({ cwd: instanceDir });
+    const listed = offeredVersions(channelMod, inst, instanceDir);
     const available = (listed && listed.versions) || [];
     // What the channel would take FROM the version the box is actually on. Resolving it
     // here rather than in the browser is what keeps the button's promise and the