@bongos/core 1.21.137 → 1.21.138

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.137",
-  "core_contract": "1.21.137",
-  "source_commit": "c86eb51909d157098d89f465fc59e049fa7d1e58",
+  "core_version": "1.21.138",
+  "core_contract": "1.21.138",
+  "source_commit": "3307f4f23dc68c88922c26c206f2b041da8bf3d4",
   "source_ref": "HEAD",
-  "built_at": "2026-10-16T01:50:11.654Z",
+  "built_at": "2026-10-16T15:05:39.871Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 608,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3793,
-  "tree_sha256": "8d4bf55e04fe47b2dec6621adc95f663ff1324a9e0ed6740af8800eccc2626e1",
+  "tree_sha256": "148552833fb05705d271f53afc3ac47d86e7af12487257789793806e78b80056",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2927,7 +2927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "5ea7a7e2b29d2b955b5cd63a3e7824b8ad061869ba333d80cfcca4743a69e623"
+      "sha256": "a396e4e846449b27335fe9d06c7f21f68ede73befc3523547792a261a5cbd069"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8972,7 +8972,7 @@
     {
       "path": "modules/provisioning/tests/liveness.mjs",
       "mode": "0000644",
-      "sha256": "f4adaf4dacf05b31f7848c62fafafc3f0498e276b2f4fe4d04f18ee5b27fd969"
+      "sha256": "df0d0d2a55b014921aba7095340d4faa37ef24ddc51d61b62fedb101f07ab41c"
     },
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
@@ -10532,12 +10532,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5d3f851dfffdd8dbe16087aac434d8a61c1ea2b787fea127e96826403dab0d88"
+      "sha256": "29a972d04433a70d46c6b360d0674eced22aa9cd2ac7061cc3644624c27e0050"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "829d826c6156f982b406a867b1da02ebe7ec434bf891b9983673611665d7adba"
+      "sha256": "71e3545fc65fccd8d6c291665472d7651f64c0d7357ef022dfa9c6fc84290888"
     },
     {
       "path": "public-docs/index.html",
@@ -10557,7 +10557,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "4897187dcf8923c5d1844383a8d40b2c936539fc95ed163bb5317626445a740f"
+      "sha256": "384135bd5f6ed0188913dc93c0d1b66b5f576f13963d3a6de57702e43d4bf7f7"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12922,7 +12922,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "625f9f01ac46bee06958b614342e87158b4051716ac67e0a3b4f35117f9a300a"
+      "sha256": "9d00a52aa43e32e3acabebfaabc32cea009a1bece8044336cc9f44b482a4ff2d"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/module-api-changelog.md

@@ -3111,5 +3111,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.135 with no explicit bump. run 38824385358. (task 1002620)
   1.21.137 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.136 with no explicit bump. run 38837186601. (task 1002620)
+  1.21.138 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.137 with no explicit bump. run 38920999785. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/tests/liveness.mjs

@@ -394,10 +394,17 @@ provisioning.enqueueIntent = async (_db, id, action) => {
   return { intent: { id: 9, action, state: 'pending' }, created: true };
 };
 provisioning.recordEvent = async () => {};
+// The instance read also carries the GitHub-App leg and its checklist; create looks up
+// the slug first, and a "Try again" is a re-request of the row that already exists.
+provisioning.getLatestOAuthManifestForInstance = async () => null;
+provisioning.getInstanceBySlug = async () => (createResult ? { ...createResult.instance } : null);
+require('../github-setup.js').githubSetupFacts = async () => ({});
 
 const api = require('../../../src/module-api.js');
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
 api.requirePermission = () => (_req, _res, next) => next();
+// Any read the stubs above miss fails here by name, never by dialling a real Postgres.
+Object.defineProperty(api, 'pool', { value: { query: async (sql) => { throw new Error(`liveness.mjs: unstubbed query: ${sql}`); } } });
 
 const express = require('express');
 const provisioningRoutes = require('../routes/provisioning.js');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.137",
+  "version": "1.21.138",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.137",
+      "version": "1.21.138",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.137",
+  "version": "1.21.138",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9824,5 +9824,11 @@
       "id": "1004746",
       "text": "Builders can now register, list, rename and remove a hardware security card from Settings."
     }
+  ],
+  "1.21.138": [
+    {
+      "id": "1004751",
+      "text": "A provisioning test that had quietly been failing since August passes again, and it can no longer reach a real database by accident."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.137'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.138'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');