@bongos/core 1.21.137 → 1.21.139

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.137",
-  "core_contract": "1.21.137",
-  "source_commit": "c86eb51909d157098d89f465fc59e049fa7d1e58",
+  "core_version": "1.21.139",
+  "core_contract": "1.21.139",
+  "source_commit": "9c3b6a3669e6d8122345fde40f98189a34d6809d",
   "source_ref": "HEAD",
-  "built_at": "2026-10-16T01:50:11.654Z",
+  "built_at": "2026-10-16T15:50:00.989Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 608,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3793,
-  "tree_sha256": "8d4bf55e04fe47b2dec6621adc95f663ff1324a9e0ed6740af8800eccc2626e1",
+  "tree_sha256": "442b7a9383f6629ccb8a89fca8867a4ced006e1d7e334673b517e6f11c9eea5c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2927,7 +2927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "5ea7a7e2b29d2b955b5cd63a3e7824b8ad061869ba333d80cfcca4743a69e623"
+      "sha256": "bdd801f3f3af2b93f31a37b2f2eb1b9ac3b394ab8ef980400e6aaa2ae8e5c476"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8972,12 +8972,12 @@
     {
       "path": "modules/provisioning/tests/liveness.mjs",
       "mode": "0000644",
-      "sha256": "f4adaf4dacf05b31f7848c62fafafc3f0498e276b2f4fe4d04f18ee5b27fd969"
+      "sha256": "df0d0d2a55b014921aba7095340d4faa37ef24ddc51d61b62fedb101f07ab41c"
     },
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
       "mode": "0000644",
-      "sha256": "9e7600697815b92d96cb325a3e9a6a5771e30566cfabe08b4a9db3ee1688b29c"
+      "sha256": "31d4ecf950b8fecd34d305c4744a1ac5335a009933a4a2e7ac15ad8947c874d5"
     },
     {
       "path": "modules/provisioning/ui/.gitkeep",
@@ -10532,12 +10532,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5d3f851dfffdd8dbe16087aac434d8a61c1ea2b787fea127e96826403dab0d88"
+      "sha256": "6c35ef513a1c02f3f73e27af737b43d8d444be0c810bbbab5400d408562b1d24"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "829d826c6156f982b406a867b1da02ebe7ec434bf891b9983673611665d7adba"
+      "sha256": "cbb5b48ee0147aeb0e05c4cf38add512a7df4efed3b521bd3e069d99102f9cb7"
     },
     {
       "path": "public-docs/index.html",
@@ -10557,7 +10557,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "4897187dcf8923c5d1844383a8d40b2c936539fc95ed163bb5317626445a740f"
+      "sha256": "8d3cfe743193bd2308275eb71e3bee00e0467d19861ea18413605f796af9ab0f"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11842,7 +11842,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "213d8e4199ab429e64d0c65f4eda42a9d0cb4c64baa1424f793e223af3e66308"
+      "sha256": "d2808e1b6cb79433d4b82dba0672bf63aec48d341d9efad63f4fcd435a26112b"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -12922,7 +12922,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "625f9f01ac46bee06958b614342e87158b4051716ac67e0a3b4f35117f9a300a"
+      "sha256": "6751283b546731a5e4ce9df1826bc81ec8c71d7df3784b23692c38fd079bb979"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/module-api-changelog.md

@@ -3111,5 +3111,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.135 with no explicit bump. run 38824385358. (task 1002620)
   1.21.137 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.136 with no explicit bump. run 38837186601. (task 1002620)
+  1.21.138 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.137 with no explicit bump. run 38920999785. (task 1002620)
+  1.21.139 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.138 with no explicit bump. run 38927010049. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/tests/liveness.mjs

@@ -394,10 +394,17 @@ provisioning.enqueueIntent = async (_db, id, action) => {
   return { intent: { id: 9, action, state: 'pending' }, created: true };
 };
 provisioning.recordEvent = async () => {};
+// The instance read also carries the GitHub-App leg and its checklist; create looks up
+// the slug first, and a "Try again" is a re-request of the row that already exists.
+provisioning.getLatestOAuthManifestForInstance = async () => null;
+provisioning.getInstanceBySlug = async () => (createResult ? { ...createResult.instance } : null);
+require('../github-setup.js').githubSetupFacts = async () => ({});
 
 const api = require('../../../src/module-api.js');
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
 api.requirePermission = () => (_req, _res, next) => next();
+// Any read the stubs above miss fails here by name, never by dialling a real Postgres.
+Object.defineProperty(api, 'pool', { value: { query: async (sql) => { throw new Error(`liveness.mjs: unstubbed query: ${sql}`); } } });
 
 const express = require('express');
 const provisioningRoutes = require('../routes/provisioning.js');

package/modules/provisioning/tests/provisioning.mjs

@@ -9,7 +9,6 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const P = require('../provisioning.js');
@@ -178,19 +177,6 @@ t('every non-dedicated shape is $0 — it co-tenants on infrastructure already p
   }
 });
 
-t('the estimate and the RUNNER agree on the default — they cannot import each other', () => {
-  // provision.js sits in a generator's executed closure (tests/executed_closure.mjs
-  // pins its size), so it cannot require this module for the constant. This pin is
-  // what stops the two literals drifting apart again.
-  const runner = readFileSync(new URL('../../../scripts/gds/provision.js', import.meta.url), 'utf8');
-  const m = runner.match(/size:\s*inst\.tier\s*\|\|\s*'([^']+)'/);
-  assert.ok(m, "provision.js no longer spells its default as `inst.tier || '<size>'` — re-pin this");
-  assert.equal(m[1], P.DEFAULT_DEDICATED_TIER,
-    'the runner creates a different size than the ledger prices — the 1003692 bug, returning');
-  assert.ok(P.DEFAULT_DEDICATED_TIER in { 's-1vcpu-1gb': 1, 's-1vcpu-2gb': 1, 's-2vcpu-2gb': 1, 's-2vcpu-4gb': 1, 's-4vcpu-8gb': 1 },
-    'the default tier must be one the price table knows, or the fix silently returns 0 again');
-});
-
 console.log('\nGitHub App Manifest — pure builders (task 2080, ADR 0133):');
 
 t('githubAppName prefers the DOMAIN (unique + reads on the consent screen)', () => {
@@ -309,27 +295,27 @@ await ta('recordDnsNote / clearErrorNote are NARROW single-column updates — no
 console.log('\nPer-project settings (task 1003040):');
 
 t('effectiveSettings: defaults for a bare/empty row = today\'s behavior; stored keys overlay; junk falls back', () => {
-  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
-  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
-  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
+  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' });
+  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' });
+  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' });
   assert.deepEqual(
     P.effectiveSettings({ settings: { platform_visibility: 'gated' } }),
-    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' },
+    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' },
     'a stored key overlays only itself'
   );
   assert.deepEqual(
     P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x', visibility: 'unlisted', join_grant: 'everything' } }),
-    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' },
+    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' },
     'off-vocabulary values fall back to the default; unknown keys never leak out'
   );
   assert.deepEqual(P.effectiveSettings({ settings: ['not', 'an', 'object'] }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' }, 'a non-object settings value reads as defaults');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' }, 'a non-object settings value reads as defaults');
   // the join door reads back like any other policy key (task 1002324)
   assert.deepEqual(P.effectiveSettings({ settings: { visibility: 'stealth' } }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' }, 'a stored door overlays only itself');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' }, 'a stored door overlays only itself');
   // what a public join grants is a policy key like any other (task 1002331)
   assert.deepEqual(P.effectiveSettings({ settings: { join_grant: 'view' } }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'view', artist_gate: 'strict', spend_payer: 'none' }, 'the grant overlays only itself');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'view', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' }, 'the grant overlays only itself');
 });
 
 t('SETTINGS_VOCAB / DEFAULT_SETTINGS: every default is on its own vocabulary (lockstep guard)', () => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.137",
+  "version": "1.21.139",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.137",
+      "version": "1.21.139",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.137",
+  "version": "1.21.139",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9824,5 +9824,17 @@
       "id": "1004746",
       "text": "Builders can now register, list, rename and remove a hardware security card from Settings."
     }
+  ],
+  "1.21.138": [
+    {
+      "id": "1004751",
+      "text": "A provisioning test that had quietly been failing since August passes again, and it can no longer reach a real database by accident."
+    }
+  ],
+  "1.21.139": [
+    {
+      "id": "1004752",
+      "text": "Provisioning's own tests now run in the automated checks, so they can't quietly break again."
+    }
   ]
 }

package/scripts/gds/run-unit-tests.js

@@ -19,9 +19,9 @@
 // Module-owned tests (ADR 0107 / task 1768): a contributed module may ALSO ship
 // its own DB-free tests at modules/<key>/tests/*.mjs. These are discovered by
 // directory the same way the loader discovers modules/*/module.json (no
-// allowlist to maintain here either) and gated by isModuleEnabled(key) — a
-// module this instance doesn't enable contributes no tests to this gate, same
-// as the curated MODULE_TESTS/MODULE_DISABLED mechanism above.
+// allowlist to maintain here either). main() runs every module's tests whether or
+// not this instance enables it (a default:false module still ships in the repo);
+// discoverModuleTests() keeps the isEnabled gate for callers that inject one.
 
 const fs = require('node:fs');
 const path = require('node:path');
@@ -534,9 +534,11 @@ function main() {
     .sort();
 
   // Module-owned tests are DB-free unit tests — only the default gate runs them.
+  // Run every module's tests, enabled here or not: the code ships in the repo either way, and
+  // a default:false module (provisioning) otherwise goes unexercised and rots unseen.
   const { included: moduleTests, skippedDisabled: moduleTestsSkipped } = integrationMode
     ? { included: [], skippedDisabled: [] }
-    : discoverModuleTests();
+    : discoverModuleTests({ isEnabled: () => true });
 
   if (integrationMode) {
     console.log(`run-unit-tests --integration: ${files.length} integration-smoke test file(s) (${files.join(', ') || 'none found'}); per-test budget ${INTEGRATION_TIMEOUT_MS / 1000}s`);

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.137'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.139'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');