@bongos/core 1.21.14 → 1.21.15

package/docs/copy-registry.json

@@ -710,8 +710,8 @@
       "text": "Allow new releases and move to {…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/deploy.js:249",
-        "modules/hall-ui/public/deploy.js:677"
+        "modules/hall-ui/public/deploy.js:252",
+        "modules/hall-ui/public/deploy.js:680"
       ]
     },
     {
@@ -1340,8 +1340,8 @@
       "text": "Move to {…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/deploy.js:561",
-        "modules/hall-ui/public/deploy.js:723"
+        "modules/hall-ui/public/deploy.js:564",
+        "modules/hall-ui/public/deploy.js:726"
       ]
     },
     {
@@ -1870,8 +1870,8 @@
       "text": "Waiting to try core {…} again at {…}.",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/deploy.js:209",
-        "modules/hall-ui/public/deploy.js:212"
+        "modules/hall-ui/public/deploy.js:212",
+        "modules/hall-ui/public/deploy.js:215"
       ]
     },
     {
@@ -2415,7 +2415,7 @@
       "surface": "builders-hall",
       "text": "(checked {…})",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 457,
+      "line": 460,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -2703,7 +2703,7 @@
       "surface": "builders-hall",
       "text": "A known snag stopped the move to core {…}:",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 206,
+      "line": 209,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -2721,7 +2721,7 @@
       "surface": "builders-hall",
       "text": "A move to core {…} failed{…} — this project has moved on since, and is serving {…} now. Whatever stopped that one may or may not still apply; the check above is the live answer.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 366,
+      "line": 369,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3054,7 +3054,7 @@
       "surface": "builders-hall",
       "text": "Allow new releases and move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 249,
+      "line": 252,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3063,7 +3063,7 @@
       "surface": "builders-hall",
       "text": "Allow new releases and move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 677,
+      "line": 680,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3099,7 +3099,7 @@
       "surface": "builders-hall",
       "text": "An earlier attempt did not land.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 366,
+      "line": 369,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3810,7 +3810,7 @@
       "surface": "builders-hall",
       "text": "Change to",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 294,
+      "line": 297,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3864,7 +3864,7 @@
       "surface": "builders-hall",
       "text": "Changing the rule…",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 671,
+      "line": 674,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3918,7 +3918,7 @@
       "surface": "builders-hall",
       "text": "Checked against {…} — nothing blocks this move.{…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 460,
+      "line": 463,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3954,7 +3954,7 @@
       "surface": "builders-hall",
       "text": "Checking what this would do, and what it would bring in. The answer comes from the machine itself, so it can take a couple of minutes.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 449,
+      "line": 452,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4854,7 +4854,7 @@
       "surface": "builders-hall",
       "text": "Could not read this project's deploy state: {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 616,
+      "line": 619,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4863,7 +4863,7 @@
       "surface": "builders-hall",
       "text": "Could not read what this would bring in: {…}. The check below still applies.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 534,
+      "line": 537,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5295,7 +5295,7 @@
       "surface": "builders-hall",
       "text": "Database behind.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 579,
+      "line": 582,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7032,7 +7032,7 @@
       "surface": "builders-hall",
       "text": "If you own this project,",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 416,
+      "line": 419,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8040,7 +8040,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 561,
+      "line": 564,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8049,7 +8049,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 723,
+      "line": 726,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -8058,7 +8058,7 @@
       "surface": "builders-hall",
       "text": "Moved {…}, and the box confirmed it. The project’s repository on GitHub still names the old core, so changes pushed there may not reach the live site until the two match.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 382,
+      "line": 385,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8067,7 +8067,7 @@
       "surface": "builders-hall",
       "text": "Moving to core",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 330,
+      "line": 333,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8472,7 +8472,7 @@
       "surface": "builders-hall",
       "text": "No running box to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 700,
+      "line": 703,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8508,7 +8508,7 @@
       "surface": "builders-hall",
       "text": "No shipped work is recorded between core {…} and {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 541,
+      "line": 544,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8679,7 +8679,7 @@
       "surface": "builders-hall",
       "text": "Not checked yet — the runner takes this reading on its own tick.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 455,
+      "line": 458,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8877,7 +8877,7 @@
       "surface": "builders-hall",
       "text": "Nothing newer is published that this box can take. There is nothing to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 596,
+      "line": 599,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8922,7 +8922,7 @@
       "surface": "builders-hall",
       "text": "Now running core {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 392,
+      "line": 395,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8931,7 +8931,7 @@
       "surface": "builders-hall",
       "text": "Now running core {…} — but GitHub was not updated.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 382,
+      "line": 385,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10614,7 +10614,7 @@
       "surface": "builders-hall",
       "text": "Save rule",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 294,
+      "line": 297,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10803,7 +10803,7 @@
       "surface": "builders-hall",
       "text": "See what would change",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 422,
+      "line": 425,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10893,7 +10893,7 @@
       "surface": "builders-hall",
       "text": "Serving {…} — read from the box itself, {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 599,
+      "line": 602,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11505,7 +11505,7 @@
       "surface": "builders-hall",
       "text": "Still working on core {…}. It keeps going without this page — reload to see where it got to.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 761,
+      "line": 764,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -11811,7 +11811,7 @@
       "surface": "builders-hall",
       "text": "Technical detail — what the upgrade said",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 362,
+      "line": 365,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12711,7 +12711,7 @@
       "surface": "builders-hall",
       "text": "The upgrade checked {…} and refused:{…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 465,
+      "line": 468,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13062,7 +13062,7 @@
       "surface": "builders-hall",
       "text": "This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies on {…} may fail until the migrations run.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 579,
+      "line": 582,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13071,7 +13071,7 @@
       "surface": "builders-hall",
       "text": "This restarts {…} onto core",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 561,
+      "line": 564,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13143,7 +13143,7 @@
       "surface": "builders-hall",
       "text": "This would fail.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 465,
+      "line": 468,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13197,7 +13197,7 @@
       "surface": "builders-hall",
       "text": "Try again",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 265,
+      "line": 268,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13206,7 +13206,7 @@
       "surface": "builders-hall",
       "text": "Try now",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 214,
+      "line": 217,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13395,7 +13395,7 @@
       "surface": "builders-hall",
       "text": "Update rule: {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 294,
+      "line": 297,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13575,7 +13575,7 @@
       "surface": "builders-hall",
       "text": "Waiting to try core {…} again at {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 209,
+      "line": 212,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13584,7 +13584,7 @@
       "surface": "builders-hall",
       "text": "Waiting to try core {…} again at {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 212,
+      "line": 215,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13836,7 +13836,7 @@
       "surface": "builders-hall",
       "text": "What this brings in",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 550,
+      "line": 553,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14214,7 +14214,7 @@
       "surface": "builders-hall",
       "text": "You can still press Move — the runner will refuse it the same way, and the box is left where it is.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 465,
+      "line": 468,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14691,7 +14691,7 @@
       "surface": "builders-hall",
       "text": "access: the hub keeps a key of its own for this repository, so this change and every later upgrade are saved to GitHub without asking you again.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 416,
+      "line": 419,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15492,7 +15492,7 @@
       "surface": "builders-hall",
       "text": "is published and this box is not on it yet.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 422,
+      "line": 425,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -16086,7 +16086,7 @@
       "surface": "builders-hall",
       "text": "reads the control plane's own observation · ADR 0293 · every move is recorded with who asked",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 704,
+      "line": 707,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -16095,7 +16095,7 @@
       "surface": "builders-hall",
       "text": "reconnect GitHub with repository access",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 416,
+      "line": 419,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -16599,7 +16599,7 @@
       "surface": "builders-hall",
       "text": "the owner’s blockers",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 226,
+      "line": 229,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17166,7 +17166,7 @@
       "surface": "builders-hall",
       "text": "{…} Nothing needs doing — this page shows the result when it lands.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 214,
+      "line": 217,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17805,7 +17805,7 @@
       "surface": "builders-hall",
       "text": "— moved {…}, and the box confirmed it.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 392,
+      "line": 395,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17886,7 +17886,7 @@
       "surface": "builders-hall",
       "text": "— {…} {…} of work landed between core {…} and {…}{…}:",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 550,
+      "line": 553,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17895,7 +17895,7 @@
       "surface": "builders-hall",
       "text": "— {…}. The project restarts as part of this, and puts itself back on {…} if the new core does not answer. This page is watching and will say when it lands.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 330,
+      "line": 333,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17922,7 +17922,7 @@
       "surface": "builders-hall",
       "text": "…and {…} more, not listed.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 548,
+      "line": 551,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2855,5 +2855,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.12 with no explicit bump. run 37053665960. (task 1002620)
   1.21.14 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.13 with no explicit bump. run 37055782677. (task 1002620)
+  1.21.15 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.14 with no explicit bump. run 37057118119. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -445,7 +445,7 @@
       "surface": "builders",
       "title": "Deploy",
       "states_read": ["work","out"],
-      "files_hash": "21a4d1ac180c64a3",
+      "files_hash": "a65f92429389e3fd",
       "reading_hash": "eb5acd9bd5fc73e9",
       "counts": {"lines":7,"placed":0,"shared":5,"unplaced":2},
       "omitted": {"data":1},

package/docs/recipes/upgrading-the-core.md

@@ -222,6 +222,7 @@ running a go-live.
 ## Gotchas
 
 - **The Deploy door fixes three known snags by itself, once** (task 1004448, `scripts/gds/wedge-remedy.js`). When a core move through `/deploy` fails on a **dirty tree** (it commits the tracked changes inside the project), a **full disk** (it prunes that project's own nightly dumps down to the newest 7) or a **database behind its code** (it migrates that database with its own `PGDATABASE` before the code moves), the runner applies the fix, records a `core-upgrade-remedy` event on the project, and tries the move once more on the next tick. If the retry fails for the same reason, or the fix itself fails, the move is retired as `unknown` (`remedy_did_not_hold` / `remedy_failed`) for a person — never a second fix. The manual fixes below still apply to the unattended nightly sweep, which does not go through the door.
+- **A core move uses TWO unix accounts, and which one does what is not interchangeable** (task 1004512, `resolveRunAs` in `scripts/gds/provision-core-upgrade.js`). The move runs as the account that owns the checkout — the app user, on every hosting shape — because everything it writes lives there: the pin, `node_modules`, `.claude/`, the pin commit, and the `git status` it starts with. Only the **database** steps (identity pre-check, migrate, the ledger insert) run as the project's own `bongos-<slug>` account, handed over with `--migrate-as`; that account owns the database and `PUBLIC` has no `CONNECT`, so nothing else can reach it. The flag is emitted only when the two differ, so a control plane and a project older than ADR 0281 run the command they always did. *The symptom when this is wrong:* every move on a project with its own account fails with `fatal: detected dubious ownership in repository`, which the clean-tree pre-flight used to report as a dirty tree — the remedy below then commits a tree nobody touched and the retry fails identically. A `git status` that could not answer is now its own reason (`git_unreadable`, class `unknown`), so it goes to a person instead of to that fix. **Do not "fix" a recurrence with `safe.directory`** — git would then read the tree and the next write step would fail instead.
 - **A Deploy-door move nobody can fix files a blocker and posts to Discord — once** (task 1004449, `scripts/gds/move-escalation.js`). A move retired as `unknown` (including `remedy_did_not_hold`, `remedy_failed` and a failed rollback) files one blocker (`source=provisioning`, `source_ref=core-move:<instance id>:<intent id>`) with the reason and what the move reported, and posts one notice to `#ship-news` that names the project only if it is public. The next core move on that project that lands closes the blocker by itself and posts an all-clear. Refusals the owner can act on (`needs_decision`) are shown on the deploy page instead, not filed.
 - **`--registry` needs no credential at all** (task 1003878). `@bongos/core` is **public** on npm (task 1003872), so `bongos upgrade --registry` resolves it from the default registry like any other dependency — no token, no login, and no instance `.npmrc`. An install failure on this path is therefore a *real* failure (network, registry outage, or a version that was never published), never a missing credential.
   *History, so the symptom is recognisable on an old instance:* the core used to publish private, and the instance `.npmrc` read `_authToken=<redacted> npm gives that per-project key precedence, so with the env var unset it expanded EMPTY and **masked a perfectly valid literal token in `~/.npmrc`** — npm went anonymous, the private core 404'd, and the error blamed a credential the box actually held. Task 1002754 worked around it by resolving the token in-process; task 1003878 deleted the whole mechanism along with the `.npmrc` that caused it. An instance still carrying a committed `.npmrc` from a pre-1003878 scaffold can safely delete it.

package/modules/hall-ui/public/deploy.js

@@ -142,6 +142,9 @@
     not_published: 'that version is not published yet',
     npm_install: 'installing the new core stopped part-way',
     dirty_tree: 'the project had unsaved file changes on its machine',
+    // Deliberately not a variant of dirty_tree above: nothing is known about the files here,
+    // which is the whole difference (task 1004512).
+    git_unreadable: 'the project’s files could not be read on its machine, so the move never started — nothing changed, and someone is looking at it',
     disk_full: 'the machine ran out of disk space',
     schema_pending: 'the project’s database was behind its code',
     outside_channel: 'that version is outside this project’s update rule',

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.14",
+  "version": "1.21.15",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.14",
+      "version": "1.21.15",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.14",
+  "version": "1.21.15",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8840,5 +8840,11 @@
       "id": "1004537",
       "text": "Autobongos no longer picks tasks that can only be done by logging into a live server. They are skipped before any claim and listed as \"needs_host_access\", so no more wasted runs and pointless owner blockers."
     }
+  ],
+  "1.21.15": [
+    {
+      "id": "1004512",
+      "text": "Deploying a core update to a project that runs under its own account used to fail every time, blaming unsaved file changes that were never there. The update now writes files as the account that owns them and touches the databa"
+    }
   ]
 }