@bongos/core 1.21.115 → 1.21.117

package/docs/copy-registry.json

@@ -824,8 +824,8 @@
       "text": "Allow new releases and move to {…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/deploy.js:252",
-        "modules/hall-ui/public/deploy.js:680"
+        "modules/hall-ui/public/deploy.js:254",
+        "modules/hall-ui/public/deploy.js:682"
       ]
     },
     {
@@ -1494,8 +1494,8 @@
       "text": "Move to {…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/deploy.js:564",
-        "modules/hall-ui/public/deploy.js:726"
+        "modules/hall-ui/public/deploy.js:566",
+        "modules/hall-ui/public/deploy.js:728"
       ]
     },
     {
@@ -2084,8 +2084,8 @@
       "text": "Waiting to try core {…} again at {…}.",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/deploy.js:212",
-        "modules/hall-ui/public/deploy.js:215"
+        "modules/hall-ui/public/deploy.js:214",
+        "modules/hall-ui/public/deploy.js:217"
       ]
     },
     {
@@ -2679,7 +2679,7 @@
       "surface": "builders-hall",
       "text": "(checked {…})",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 460,
+      "line": 462,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3003,7 +3003,7 @@
       "surface": "builders-hall",
       "text": "A known snag stopped the move to core {…}:",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 209,
+      "line": 211,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3021,7 +3021,7 @@
       "surface": "builders-hall",
       "text": "A move to core {…} failed{…} — this project has moved on since, and is serving {…} now. Whatever stopped that one may or may not still apply; the check above is the live answer.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 369,
+      "line": 371,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3381,7 +3381,7 @@
       "surface": "builders-hall",
       "text": "Allow new releases and move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 252,
+      "line": 254,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3390,7 +3390,7 @@
       "surface": "builders-hall",
       "text": "Allow new releases and move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 680,
+      "line": 682,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3426,7 +3426,7 @@
       "surface": "builders-hall",
       "text": "An earlier attempt did not land.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 369,
+      "line": 371,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4200,7 +4200,7 @@
       "surface": "builders-hall",
       "text": "Change to",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 297,
+      "line": 299,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4254,7 +4254,7 @@
       "surface": "builders-hall",
       "text": "Changing the rule…",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 674,
+      "line": 676,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -4308,7 +4308,7 @@
       "surface": "builders-hall",
       "text": "Checked against {…} — nothing blocks this move.{…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 463,
+      "line": 465,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4344,7 +4344,7 @@
       "surface": "builders-hall",
       "text": "Checking what this would do, and what it would bring in. The answer comes from the machine itself, so it can take a couple of minutes.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 452,
+      "line": 454,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5289,7 +5289,7 @@
       "surface": "builders-hall",
       "text": "Could not read this project's deploy state: {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 619,
+      "line": 621,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5298,7 +5298,7 @@
       "surface": "builders-hall",
       "text": "Could not read what this would bring in: {…}. The check below still applies.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 537,
+      "line": 539,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5766,7 +5766,7 @@
       "surface": "builders-hall",
       "text": "Database behind.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 582,
+      "line": 584,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7620,7 +7620,7 @@
       "surface": "builders-hall",
       "text": "If you own this project,",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 419,
+      "line": 421,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8682,7 +8682,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 564,
+      "line": 566,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8691,7 +8691,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 726,
+      "line": 728,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -8700,7 +8700,7 @@
       "surface": "builders-hall",
       "text": "Moved {…}, and the box confirmed it. The project’s repository on GitHub still names the old core, so changes pushed there may not reach the live site until the two match.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 385,
+      "line": 387,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8709,7 +8709,7 @@
       "surface": "builders-hall",
       "text": "Moving to core",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 333,
+      "line": 335,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9177,7 +9177,7 @@
       "surface": "builders-hall",
       "text": "No running box to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 703,
+      "line": 705,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9222,7 +9222,7 @@
       "surface": "builders-hall",
       "text": "No shipped work is recorded between core {…} and {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 544,
+      "line": 546,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9447,7 +9447,7 @@
       "surface": "builders-hall",
       "text": "Not checked yet — the runner takes this reading on its own tick.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 458,
+      "line": 460,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9744,7 +9744,7 @@
       "surface": "builders-hall",
       "text": "Nothing newer is published that this box can take. There is nothing to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 599,
+      "line": 601,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9798,7 +9798,7 @@
       "surface": "builders-hall",
       "text": "Now running core {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 395,
+      "line": 397,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9807,7 +9807,7 @@
       "surface": "builders-hall",
       "text": "Now running core {…} — but GitHub was not updated.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 385,
+      "line": 387,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11670,7 +11670,7 @@
       "surface": "builders-hall",
       "text": "Save rule",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 297,
+      "line": 299,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11886,7 +11886,7 @@
       "surface": "builders-hall",
       "text": "See what would change",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 425,
+      "line": 427,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11985,7 +11985,7 @@
       "surface": "builders-hall",
       "text": "Serving {…} — read from the box itself, {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 602,
+      "line": 604,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12714,7 +12714,7 @@
       "surface": "builders-hall",
       "text": "Still working on core {…}. It keeps going without this page — reload to see where it got to.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 764,
+      "line": 766,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -13065,7 +13065,7 @@
       "surface": "builders-hall",
       "text": "Technical detail — what the upgrade said",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 365,
+      "line": 367,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14037,7 +14037,7 @@
       "surface": "builders-hall",
       "text": "The upgrade checked {…} and refused:{…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 468,
+      "line": 470,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14424,7 +14424,7 @@
       "surface": "builders-hall",
       "text": "This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies on {…} may fail until the migrations run.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 582,
+      "line": 584,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14433,7 +14433,7 @@
       "surface": "builders-hall",
       "text": "This restarts {…} onto core",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 564,
+      "line": 566,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14505,7 +14505,7 @@
       "surface": "builders-hall",
       "text": "This would fail.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 468,
+      "line": 470,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14559,7 +14559,7 @@
       "surface": "builders-hall",
       "text": "Try again",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 268,
+      "line": 270,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14568,7 +14568,7 @@
       "surface": "builders-hall",
       "text": "Try now",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 217,
+      "line": 219,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14775,7 +14775,7 @@
       "surface": "builders-hall",
       "text": "Update rule: {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 297,
+      "line": 299,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14955,7 +14955,7 @@
       "surface": "builders-hall",
       "text": "Waiting to try core {…} again at {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 212,
+      "line": 214,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14964,7 +14964,7 @@
       "surface": "builders-hall",
       "text": "Waiting to try core {…} again at {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 215,
+      "line": 217,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15243,7 +15243,7 @@
       "surface": "builders-hall",
       "text": "What this brings in",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 553,
+      "line": 555,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15711,7 +15711,7 @@
       "surface": "builders-hall",
       "text": "You can still press Move — the runner will refuse it the same way, and the box is left where it is.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 468,
+      "line": 470,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -16260,7 +16260,7 @@
       "surface": "builders-hall",
       "text": "access: the hub keeps a key of its own for this repository, so this change and every later upgrade are saved to GitHub without asking you again.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 419,
+      "line": 421,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17097,7 +17097,7 @@
       "surface": "builders-hall",
       "text": "is published and this box is not on it yet.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 425,
+      "line": 427,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17673,7 +17673,7 @@
       "surface": "builders-hall",
       "text": "reads the control plane's own observation · ADR 0293 · every move is recorded with who asked",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 707,
+      "line": 709,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17682,7 +17682,7 @@
       "surface": "builders-hall",
       "text": "reconnect GitHub with repository access",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 419,
+      "line": 421,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18213,7 +18213,7 @@
       "surface": "builders-hall",
       "text": "the owner’s blockers",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 229,
+      "line": 231,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18825,7 +18825,7 @@
       "surface": "builders-hall",
       "text": "{…} Nothing needs doing — this page shows the result when it lands.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 217,
+      "line": 219,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19464,7 +19464,7 @@
       "surface": "builders-hall",
       "text": "— moved {…}, and the box confirmed it.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 395,
+      "line": 397,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19554,7 +19554,7 @@
       "surface": "builders-hall",
       "text": "— {…} {…} of work landed between core {…} and {…}{…}:",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 553,
+      "line": 555,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19572,7 +19572,7 @@
       "surface": "builders-hall",
       "text": "— {…}. The project restarts as part of this, and puts itself back on {…} if the new core does not answer. This page is watching and will say when it lands.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 333,
+      "line": 335,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19599,7 +19599,7 @@
       "surface": "builders-hall",
       "text": "…and {…} more, not listed.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 551,
+      "line": 553,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3067,5 +3067,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.113 with no explicit bump. run 38515161804. (task 1002620)
   1.21.115 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.114 with no explicit bump. run 38516937959. (task 1002620)
+  1.21.116 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.115 with no explicit bump. run 38545604578. (task 1002620)
+  1.21.117 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.116 with no explicit bump. run 38548762428. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -485,7 +485,7 @@
       "surface": "builders",
       "title": "Deploy",
       "states_read": ["work","out"],
-      "files_hash": "58c2ba633fd0e80c",
+      "files_hash": "e556930736d4e0b1",
       "reading_hash": "ba271ca64d71e7b3",
       "counts": {"lines":19,"placed":5,"shared":8,"unplaced":6},
       "omitted": {"data":3},

package/modules/hall-ui/public/deploy.js

@@ -156,6 +156,8 @@
     remedy_failed: 'the automatic fix itself did not work',
     health: 'the project did not answer after restarting on the new core',
     migrate: 'updating the project’s database failed',
+    // task 1004734: the new core adds a rule some of the project's existing records break
+    migrate_check_violation: 'updating the project’s database failed: some records the project already has break a rule the new core adds',
     restart: 'the project would not restart',
     rollback_failed: 'the new core failed, and putting the old one back failed too',
     no_target: 'the move did not say which version to go to',

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.115",
+  "version": "1.21.117",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.115",
+      "version": "1.21.117",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.115",
+  "version": "1.21.117",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9664,5 +9664,21 @@
       "id": "1004671",
       "text": "When you start a new project, \"Where are you?\" now starts on United States and is a search box instead of a long dropdown. Type a few letters and the list narrows to matching countries; capitals and accents don't matter, so \"c"
     }
+  ],
+  "1.21.116": [
+    {
+      "id": "1004734",
+      "text": "When a project's update fails while updating its database, the deploy page and the auto-filed blocker now say which database change failed and why, so nobody has to log into the machine to find out."
+    }
+  ],
+  "1.21.117": [
+    {
+      "id": "1004733",
+      "text": "When a project's owner has saved newer work on GitHub, an automatic platform update now adds its new version number on top of that work instead of leaving GitHub pointing at the old version, so a later deploy can no longer qui"
+    },
+    {
+      "id": "1004737",
+      "text": "Projects that install Cloud Bongos from npm can run the project health check again: it now says plainly that those checks belong to Cloud Bongos itself and skips them, instead of crashing."
+    }
   ]
 }

package/scripts/gds/fitness-lib.js

@@ -80,7 +80,42 @@ function keyTokenRe(key) {
   return new RegExp(`(^|[^\\w-])${esc}($|[^\\w-])`);
 }
 
+// Is this an INSTALLED core (task 1004737)? A project that installs the core from npm has it
+// at <project>/node_modules/@bongos/core: git there answers for the PROJECT's repo, where that
+// folder is ignored, so every git-enumerating check finds nothing and throws a "scan defect".
+//
+// Decided POSITIVELY, never from a failure: only a core under a node_modules directory can
+// be installed. Anywhere else the answer is no, whatever git says — so a core checkout with
+// git missing, no .git, or a misresolved root still runs every check and fails closed the
+// way each check always has, instead of folding an error into the skip below. Under
+// node_modules it is installed unless it is the top of its own git checkout.
+function isInstalledCore(root = CORE_ROOT) {
+  if (!path.resolve(root).split(/[\\/]/).includes('node_modules')) return false;
+  try {
+    const top = require('node:child_process').execFileSync('git', ['rev-parse', '--show-toplevel'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    return fs.realpathSync.native(top) !== fs.realpathSync.native(root);
+  } catch { return true; } // a package with no repo around it at all
+}
+
+// runChecks — run every fitness check, or none (task 1004737). Every check guards the core's
+// own source, and an INSTALLED core's source is not the project's to change: the core repo's
+// CI ran this gate before publishing it (the same stance ship-merge-gate.js takes for a
+// vendored instance). Run there, the git scans enumerate nothing and the checks either throw
+// or report a "scan defect", so fitness crashed and every ship reading it stalled. One honest
+// skipped result instead — not silence, and not a pass dressed up as a measurement.
+function runChecks(checks, { installed = isInstalledCore() } = {}) {
+  if (!installed) return checks.map((fn) => fn());
+  return [{
+    name: 'fitness gate — skipped: the core here is an installed package (task 1004737)',
+    ok: true, hardFail: false, violations: [],
+    warnings: ['none of the checks ran: this project installs the core rather than developing it'],
+    note: `${CORE_ROOT} is an installed package inside another repo, so there is no core source here to measure; the core repo's CI ran these ${checks.length} checks before it was published.`,
+  }];
+}
+
 module.exports = {
+  isInstalledCore,
+  runChecks,
   keyTokenRe,
   CORE_ROOT,
   INSTANCE_ROOT,

package/scripts/gds/fitness.js

@@ -33,7 +33,7 @@ const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-con
 // live beside it — the shared roots/walkers and three check clusters. They are
 // IMPORTED (not registered by path) so the CHECKS array and module.exports below
 // stay byte-identical to the single-file version every test was written against.
-const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, keyTokenRe, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
+const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, keyTokenRe, rel, runChecks, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
 const { IDENTITY_SCAN_ALLOWED, IDENTITY_SCAN_EXCLUDE, IDENTITY_SCAN_EXTRA_FILES, IDENTITY_SCAN_EXTS, IDENTITY_SCAN_ROOTS, IDENTITY_SCAN_SKIP_DIRS, PROMPT_IDENTITY_LITERALS, checkDesignContract, checkKernelPromptsNoHardcodedIdentity, checkNeutralConfigsNoHostIdentity, collectIdentityFiles, scanPromptIdentity, stripCommentsForIdentity } = require('./fitness-checks-identity.js');
 const { WRITE_VALIDATION_BASELINE, WRITE_VALIDATION_EXEMPT, checkWriteRoutesValidated, scanUnvalidatedWriteRoutes } = require('./fitness-checks-write-validation.js');
 const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, PRELAUNCH_SURFACE, RENAME_IDENTITY_RE, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_CITATION, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkGovernmentRenameIdentity, checkPrelaunchVocabulary, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
@@ -1404,7 +1404,7 @@ const CHECKS = [
 ];
 
 function runAll() {
-  return CHECKS.map((fn) => fn());
+  return runChecks(CHECKS); // task 1004737: an installed core has no core source to measure — one skipped result, not a crash
 }
 
 function main() {