@bongos/core 1.21.138 → 1.21.139

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.138",
-  "core_contract": "1.21.138",
-  "source_commit": "3307f4f23dc68c88922c26c206f2b041da8bf3d4",
+  "core_version": "1.21.139",
+  "core_contract": "1.21.139",
+  "source_commit": "9c3b6a3669e6d8122345fde40f98189a34d6809d",
   "source_ref": "HEAD",
-  "built_at": "2026-10-16T15:05:39.871Z",
+  "built_at": "2026-10-16T15:50:00.989Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 608,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3793,
-  "tree_sha256": "148552833fb05705d271f53afc3ac47d86e7af12487257789793806e78b80056",
+  "tree_sha256": "442b7a9383f6629ccb8a89fca8867a4ced006e1d7e334673b517e6f11c9eea5c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2927,7 +2927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a396e4e846449b27335fe9d06c7f21f68ede73befc3523547792a261a5cbd069"
+      "sha256": "bdd801f3f3af2b93f31a37b2f2eb1b9ac3b394ab8ef980400e6aaa2ae8e5c476"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8977,7 +8977,7 @@
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
       "mode": "0000644",
-      "sha256": "9e7600697815b92d96cb325a3e9a6a5771e30566cfabe08b4a9db3ee1688b29c"
+      "sha256": "31d4ecf950b8fecd34d305c4744a1ac5335a009933a4a2e7ac15ad8947c874d5"
     },
     {
       "path": "modules/provisioning/ui/.gitkeep",
@@ -10532,12 +10532,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "29a972d04433a70d46c6b360d0674eced22aa9cd2ac7061cc3644624c27e0050"
+      "sha256": "6c35ef513a1c02f3f73e27af737b43d8d444be0c810bbbab5400d408562b1d24"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "71e3545fc65fccd8d6c291665472d7651f64c0d7357ef022dfa9c6fc84290888"
+      "sha256": "cbb5b48ee0147aeb0e05c4cf38add512a7df4efed3b521bd3e069d99102f9cb7"
     },
     {
       "path": "public-docs/index.html",
@@ -10557,7 +10557,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "384135bd5f6ed0188913dc93c0d1b66b5f576f13963d3a6de57702e43d4bf7f7"
+      "sha256": "8d3cfe743193bd2308275eb71e3bee00e0467d19861ea18413605f796af9ab0f"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11842,7 +11842,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "213d8e4199ab429e64d0c65f4eda42a9d0cb4c64baa1424f793e223af3e66308"
+      "sha256": "d2808e1b6cb79433d4b82dba0672bf63aec48d341d9efad63f4fcd435a26112b"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -12922,7 +12922,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9d00a52aa43e32e3acabebfaabc32cea009a1bece8044336cc9f44b482a4ff2d"
+      "sha256": "6751283b546731a5e4ce9df1826bc81ec8c71d7df3784b23692c38fd079bb979"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/module-api-changelog.md

@@ -3113,5 +3113,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.136 with no explicit bump. run 38837186601. (task 1002620)
   1.21.138 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.137 with no explicit bump. run 38920999785. (task 1002620)
+  1.21.139 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.138 with no explicit bump. run 38927010049. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/tests/provisioning.mjs

@@ -9,7 +9,6 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const P = require('../provisioning.js');
@@ -178,19 +177,6 @@ t('every non-dedicated shape is $0 — it co-tenants on infrastructure already p
   }
 });
 
-t('the estimate and the RUNNER agree on the default — they cannot import each other', () => {
-  // provision.js sits in a generator's executed closure (tests/executed_closure.mjs
-  // pins its size), so it cannot require this module for the constant. This pin is
-  // what stops the two literals drifting apart again.
-  const runner = readFileSync(new URL('../../../scripts/gds/provision.js', import.meta.url), 'utf8');
-  const m = runner.match(/size:\s*inst\.tier\s*\|\|\s*'([^']+)'/);
-  assert.ok(m, "provision.js no longer spells its default as `inst.tier || '<size>'` — re-pin this");
-  assert.equal(m[1], P.DEFAULT_DEDICATED_TIER,
-    'the runner creates a different size than the ledger prices — the 1003692 bug, returning');
-  assert.ok(P.DEFAULT_DEDICATED_TIER in { 's-1vcpu-1gb': 1, 's-1vcpu-2gb': 1, 's-2vcpu-2gb': 1, 's-2vcpu-4gb': 1, 's-4vcpu-8gb': 1 },
-    'the default tier must be one the price table knows, or the fix silently returns 0 again');
-});
-
 console.log('\nGitHub App Manifest — pure builders (task 2080, ADR 0133):');
 
 t('githubAppName prefers the DOMAIN (unique + reads on the consent screen)', () => {
@@ -309,27 +295,27 @@ await ta('recordDnsNote / clearErrorNote are NARROW single-column updates — no
 console.log('\nPer-project settings (task 1003040):');
 
 t('effectiveSettings: defaults for a bare/empty row = today\'s behavior; stored keys overlay; junk falls back', () => {
-  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
-  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
-  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
+  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' });
+  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' });
+  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' });
   assert.deepEqual(
     P.effectiveSettings({ settings: { platform_visibility: 'gated' } }),
-    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' },
+    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' },
     'a stored key overlays only itself'
   );
   assert.deepEqual(
     P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x', visibility: 'unlisted', join_grant: 'everything' } }),
-    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' },
+    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' },
     'off-vocabulary values fall back to the default; unknown keys never leak out'
   );
   assert.deepEqual(P.effectiveSettings({ settings: ['not', 'an', 'object'] }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' }, 'a non-object settings value reads as defaults');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' }, 'a non-object settings value reads as defaults');
   // the join door reads back like any other policy key (task 1002324)
   assert.deepEqual(P.effectiveSettings({ settings: { visibility: 'stealth' } }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' }, 'a stored door overlays only itself');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' }, 'a stored door overlays only itself');
   // what a public join grants is a policy key like any other (task 1002331)
   assert.deepEqual(P.effectiveSettings({ settings: { join_grant: 'view' } }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'view', artist_gate: 'strict', spend_payer: 'none' }, 'the grant overlays only itself');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'view', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' }, 'the grant overlays only itself');
 });
 
 t('SETTINGS_VOCAB / DEFAULT_SETTINGS: every default is on its own vocabulary (lockstep guard)', () => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.138",
+  "version": "1.21.139",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.138",
+      "version": "1.21.139",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.138",
+  "version": "1.21.139",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9830,5 +9830,11 @@
       "id": "1004751",
       "text": "A provisioning test that had quietly been failing since August passes again, and it can no longer reach a real database by accident."
     }
+  ],
+  "1.21.139": [
+    {
+      "id": "1004752",
+      "text": "Provisioning's own tests now run in the automated checks, so they can't quietly break again."
+    }
   ]
 }

package/scripts/gds/run-unit-tests.js

@@ -19,9 +19,9 @@
 // Module-owned tests (ADR 0107 / task 1768): a contributed module may ALSO ship
 // its own DB-free tests at modules/<key>/tests/*.mjs. These are discovered by
 // directory the same way the loader discovers modules/*/module.json (no
-// allowlist to maintain here either) and gated by isModuleEnabled(key) — a
-// module this instance doesn't enable contributes no tests to this gate, same
-// as the curated MODULE_TESTS/MODULE_DISABLED mechanism above.
+// allowlist to maintain here either). main() runs every module's tests whether or
+// not this instance enables it (a default:false module still ships in the repo);
+// discoverModuleTests() keeps the isEnabled gate for callers that inject one.
 
 const fs = require('node:fs');
 const path = require('node:path');
@@ -534,9 +534,11 @@ function main() {
     .sort();
 
   // Module-owned tests are DB-free unit tests — only the default gate runs them.
+  // Run every module's tests, enabled here or not: the code ships in the repo either way, and
+  // a default:false module (provisioning) otherwise goes unexercised and rots unseen.
   const { included: moduleTests, skippedDisabled: moduleTestsSkipped } = integrationMode
     ? { included: [], skippedDisabled: [] }
-    : discoverModuleTests();
+    : discoverModuleTests({ isEnabled: () => true });
 
   if (integrationMode) {
     console.log(`run-unit-tests --integration: ${files.length} integration-smoke test file(s) (${files.join(', ') || 'none found'}); per-test budget ${INTEGRATION_TIMEOUT_MS / 1000}s`);

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.138'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.139'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');