@bongos/core 1.21.148 → 1.21.149

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.148",
-  "core_contract": "1.21.148",
-  "source_commit": "96de3db7b01db9d1d1ea6de0020e2863549ace48",
+  "core_version": "1.21.149",
+  "core_contract": "1.21.149",
+  "source_commit": "59efe78dbbc530e6743f98d50abc605e2184adcc",
   "source_ref": "HEAD",
-  "built_at": "2026-10-19T16:38:35.780Z",
+  "built_at": "2026-10-19T21:44:07.784Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 608,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3805,
-  "tree_sha256": "9aa795e140a79d60c77adddcf814eb815324f8778aa3e839f2eed0d221aba834",
+  "tree_sha256": "2fb626947478be776e71613c82d973ebf073298ea8d6e5561f4e604e1438d661",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -42,7 +42,7 @@
     {
       "path": ".claude/skills/bongos-feedback/SKILL.md",
       "mode": "0000644",
-      "sha256": "14b448ca3b42daa4b97d7d699099536047163d50f778f079daa6616cd9b0dd51"
+      "sha256": "8b295d76d7cc4c9e0f2549db0f1ac857aa8e76a92b3e00898f95820a32c855ba"
     },
     {
       "path": ".claude/skills/bug-triage/SKILL.md",
@@ -2927,7 +2927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8f019f26dca4f3a5b624cbabd6d28976deef91faab61279479708ab9585b3fc9"
+      "sha256": "af2424a88f8836e7035c00a52637fbbf137bf1b716130a360868fa50bab54b2d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -10552,12 +10552,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c5456eee2c0d7c56f4a86b537ad4a056d7ee25178017ce8b2c4a6d584a700b91"
+      "sha256": "d03c2a175c60400695aecccbe5c9ef87b085521c6bf92176c6d2ed08e514c8a6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "eeee21b5c79606fce2ec960818bbca2bda46e8487e821e086db727725dd34483"
+      "sha256": "9d6713f305cdfe492805906778e171c75c42e4fd8dff5935ad9245d185b6ce22"
     },
     {
       "path": "public-docs/index.html",
@@ -10577,7 +10577,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "e75ce28a56ae19d8e908bca8b07e539fcb4066b72fb7e6f282e8dff5803f22b4"
+      "sha256": "9394c3c784137020e70389b269a68f36f8f2d0757b306a1f64622b8b5886f368"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11102,7 +11102,7 @@
     {
       "path": "scripts/gds/feedback-send.js",
       "mode": "0000644",
-      "sha256": "2ea43986744a893b0f44954926447a4c817fae8af8ef4956d149b31ea51e96c2"
+      "sha256": "e3c82d95c9412126d0c064d40267c7ae7befbc3cebdba99c496c884dceb4a750"
     },
     {
       "path": "scripts/gds/fetch-art-key.js",
@@ -12957,7 +12957,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2b61d02ebd3b94b723ccec869d7d6432ce9c035c5135259cf6e709759622f0af"
+      "sha256": "b89f1cd4820d3d4257eabf44a666b44c722c9e159dd561bbced94784cceaf8ea"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16097,7 +16097,7 @@
     {
       "path": "tests/instance_feedback.mjs",
       "mode": "0000644",
-      "sha256": "704a506419ff49032b9604dc039113eaa63db68ac7a57fa09e09162ce7acfae5"
+      "sha256": "a0a558b9d9e0698fa4b6078a2f2e4e2d9679e517149876809c1478743db0f6ff"
     },
     {
       "path": "tests/instance_manifest.mjs",

package/.claude/skills/bongos-feedback/SKILL.md

@@ -14,7 +14,7 @@ Sends a note about Bongos — the tool — straight to its maintainers (tasks 10
 
 **When.** File when the builder (a) labels it — "Bongos feedback: …", "tell the Bongos team" — that **is** the go; (b) wishes — "Bongos should…" (**Suggestions count**: send with `--idea`, even if you also fix it in their project); or (c) vents that Bongos is broken — **File it without being asked**, don't argue them out of it. Only about **Bongos itself** (a `bongos`/`/builder-*` command, claim, ship, grade, deploy, upgrade, hall, Settings, sign-in, credits, how it organises work). Not their own project's code, Claude, their laptop or GitHub, nor a rule working as designed. **One filing per distinct problem per session.**
 
-**Write it yourself — Never paste the rant.** First line = what went wrong, in at most twelve words (it becomes the title); then what they did, what they expected, what happened, the exact error line. A wish (`--idea`) asks the maintainers to decide something, so it opens with the card `node scripts/gds/ask.js check <file>` prints, and the rest follows as detail (agents ask like humans, task 1004704). No code, file contents, secrets or personal data.
+**Write it yourself — Never paste the rant.** First line = what went wrong, in at most twelve words (it becomes the title); then what they did, what they expected, what happened, the exact error line. A wish (`--idea`) asks the maintainers to decide something, so open it as an ask (task 1004704): one question of at most twelve words, two or three answers with what each leads to, your pick and why; the rest follows as detail. Write that shape yourself — run no helper first: a project on an older core may not have one, and a failed command before the send is noise (task 1004759). No code, file contents, secrets or personal data.
 
 **Send** (stdin, so nothing in the text is mangled by the shell):
 
@@ -24,7 +24,7 @@ bongos feedback --message-file - <<'EOF'
 EOF
 ```
 
-Add `--idea` for a wish. The command prints one line — relay it, then carry on. Proactive filing: one short sentence, e.g. *"I've sent that to the Bongos team."* If it says the project runs only on this computer, tell the builder in one line; never retry.
+Add `--idea` for a wish. The command prints one line — relay it, then carry on. Proactive filing: one short sentence, e.g. *"I've sent that to the Bongos team."* If it says "Not sent", relay that in one line and never retry: "runs only on your computer" and "older Bongos" both mean this project cannot send yet, and the second names the file the note is saved in — send it with `--message-file <that file>` after the project is upgraded. Don't send the builder to GitHub or "the Bongos team" elsewhere instead, and don't call it sent.
 
 ## Files this skill touches
 

package/docs/module-api-changelog.md

@@ -3133,5 +3133,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.146 with no explicit bump. run 39274828902. (task 1002620)
   1.21.148 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.147 with no explicit bump. run 39286989989. (task 1002620)
+  1.21.149 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.148 with no explicit bump. run 39329687123. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.148",
+  "version": "1.21.149",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.148",
+      "version": "1.21.149",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.148",
+  "version": "1.21.149",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9902,5 +9902,11 @@
       "id": "1004732",
       "text": "When the hub upgrades a project's core, your laptop now notices at the next session start or ship, says so in one line, and on a clean main catches up and reinstalls the new core by itself."
     }
+  ],
+  "1.21.149": [
+    {
+      "id": "1004759",
+      "text": "When a project's site is too old to send Bongos feedback, the command now says 'Not sent' and keeps the note, instead of claiming it was sent."
+    }
   ]
 }

package/scripts/gds/feedback-send.js

@@ -14,8 +14,12 @@
 // signed-in builder does nothing extra.
 //
 // Fast and quiet by design (the owner, 2026-10-06): the command prints one line
-// and returns at once; a detached background process does the network. No task
-// number comes back. Only the typed text (secret-scrubbed) and version stamps travel.
+// and returns at once; a detached background process sends to the hub. The one
+// call made in the foreground is the receipt from the builder's own project, so
+// "Sent" is never printed for a report the project could not vouch for (task
+// 1004759: a project on an older core has no receipt door, and the background
+// 404 was invisible). No task number comes back. Only the typed text
+// (secret-scrubbed) and version stamps travel.
 
 'use strict';
 
@@ -47,6 +51,8 @@ const REFUSALS = {
   too_long: 'That is too long to send — keep it under 4,000 characters, or split it into two.',
   local_only: 'This project runs only on your computer, so Cloud Bongos cannot confirm who sent the report. Nothing was sent.',
   no_scrubber: 'Feedback was not sent: the secret filter that checks every report is missing from this install.',
+  project_too_old: "Not sent: this project's live site runs an older Bongos that cannot send feedback yet. It will work once the project is upgraded.",
+  receipt_failed: "Not sent: this project's live site did not confirm who sent it",
 };
 
 function stateDir() { return path.join(os.homedir(), '.config', ic.FALLBACK_DIR || 'cloudbongos'); }
@@ -98,12 +104,15 @@ function repeatKey(message) {
   const first = String(message).split('\n').map((l) => l.trim().toLowerCase()).find(Boolean) || '';
   return crypto.createHash('sha256').update(first).digest('hex').slice(0, 16);
 }
-function checkAndRecordRepeat(message, { file = path.join(stateDir(), 'feedback-sent.json'), now = Date.now() } = {}) {
+// `record: false` only looks: the CLI records a report once its project has
+// vouched for it, so a report that never left is not "already sent" (task 1004759).
+function checkAndRecordRepeat(message, { file = path.join(stateDir(), 'feedback-sent.json'), now = Date.now(), record = true } = {}) {
   let seen = {};
   try { seen = JSON.parse(fs.readFileSync(file, 'utf8')) || {}; } catch { /* first report */ }
   for (const [k, t] of Object.entries(seen)) if (!(now - t < REPEAT_WINDOW_MS)) delete seen[k];
   const key = repeatKey(message);
   if (Object.prototype.hasOwnProperty.call(seen, key)) return true;
+  if (!record) return false;
   seen[key] = now;
   try {
     fs.mkdirSync(path.dirname(file), { recursive: true });
@@ -112,22 +121,29 @@ function checkAndRecordRepeat(message, { file = path.join(stateDir(), 'feedback-
   return false;
 }
 
-// deliver — the network half: receipt from the project, then the report to the
-// hub. Returns an outcome object; never prints. Runs in the background child.
-async function deliver({ message, kind }, deps = {}) {
+// requestReceipt — the project vouches for this exact text. Foreground: one call
+// to the builder's own project. A 404 means the project's core predates the
+// receipt door (task 1004591), which no retry fixes until it is upgraded.
+async function requestReceipt({ message, kind }, deps = {}) {
   const api = deps.api || await cliClient();
   const base = deps.base || ic.resolveApiBase({ session: loadSessionSync() });
-  const doFetch = deps.fetchImpl || fetch;
   const sha256 = crypto.createHash('sha256').update(message, 'utf8').digest('hex');
   const r = await api.request('POST', '/feedback/receipt', { body: { sha256, kind } });
-  if (!r.ok) return { ok: false, step: 'receipt', code: errCode(r.data) || `http_${r.status}` };
+  if (!r.ok) return { ok: false, step: 'receipt', code: r.status === 404 ? 'project_too_old' : (errCode(r.data) || `http_${r.status}`) };
   const origin = new URL(base).origin;
   const hub = String((r.data && r.data.hub) || origin).replace(/\/+$/, '');
+  return { ok: true, receipt: r.data.receipt, origin, hub };
+}
+
+// sendToHub — the vouched report straight to the hub. Returns an outcome
+// object; never prints. Runs in the background child.
+async function sendToHub({ message, kind, receipt, origin, hub }, deps = {}) {
+  const doFetch = deps.fetchImpl || fetch;
   const res = await doFetch(`${hub}/api/bongos/sso/feedback/direct`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
     body: JSON.stringify({
-      origin, receipt: r.data.receipt, message, kind,
+      origin, receipt, message, kind,
       context: { cli_version: cliVersion(), os: `${os.platform()} ${os.release()}` },
     }),
     signal: AbortSignal.timeout(15000),
@@ -138,13 +154,31 @@ async function deliver({ message, kind }, deps = {}) {
   return { ok: false, step: 'hub', code: errCode(body) || `http_${res.status}` };
 }
 
+// deliver — both halves in one go.
+async function deliver(job, deps = {}) {
+  const r = await requestReceipt(job, deps);
+  if (!r.ok) return r;
+  return sendToHub({ ...job, receipt: r.receipt, origin: r.origin, hub: r.hub }, deps);
+}
+
+// A report the project could not vouch for is kept, so it can be sent after the
+// upgrade (`--message-file <it>`) instead of being written again.
+function keepUnsent(message, { dir = stateDir(), now = new Date() } = {}) {
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+    const file = path.join(dir, `feedback-unsent-${now.toISOString().replace(/[:.]/g, '-')}.md`);
+    fs.writeFileSync(file, message, { mode: 0o600 });
+    return file;
+  } catch { return null; }
+}
+
 // The background child: read the queued report, deliver it, record the outcome
 // where a curious builder (or a maintainer helping them) can look.
 async function runDeliverChild(file) {
   let job;
   try { job = JSON.parse(fs.readFileSync(file, 'utf8')); } finally { fs.rmSync(path.dirname(file), { recursive: true, force: true }); }
   let outcome;
-  try { outcome = await deliver(job); } catch (e) { outcome = { ok: false, step: 'network', code: String(e && e.message || e).slice(0, 200) }; }
+  try { outcome = job.receipt ? await sendToHub(job) : await deliver(job); } catch (e) { outcome = { ok: false, step: 'network', code: String(e && e.message || e).slice(0, 200) }; }
   try {
     fs.writeFileSync(path.join(stateDir(), 'feedback-last.json'), JSON.stringify({ at: new Date().toISOString(), ...outcome }), { mode: 0o600 });
   } catch { /* nowhere to record — the report itself is what mattered */ }
@@ -177,16 +211,27 @@ async function main(argv = process.argv.slice(2), deps = {}) {
   if (isLocalBase(base)) { console.error(REFUSALS.local_only); return 1; }
 
   const job = { message: scrubbed.text, kind };
-  if ((deps.checkRepeat || checkAndRecordRepeat)(job.message)) {
+  const checkRepeat = deps.checkRepeat || checkAndRecordRepeat;
+  if (checkRepeat(job.message, { record: false })) {
     console.log('Already sent — the Bongos team has this one.');
     return 0;
   }
+  // The receipt in the foreground: "Sent" only once the project has vouched.
+  const r = await (deps.requestReceipt || requestReceipt)(job, { base });
+  if (!r.ok) {
+    const kept = (deps.keepUnsent || keepUnsent)(job.message);
+    const why = r.code === 'project_too_old' ? REFUSALS.project_too_old : `${REFUSALS.receipt_failed} (${r.code}).`;
+    console.error(kept ? `${why} Your note is saved in ${kept}` : why);
+    return 1;
+  }
+  checkRepeat(job.message);
+  const vouched = { ...job, receipt: r.receipt, origin: r.origin, hub: r.hub };
   if (hasFlag('--wait', argv)) {
-    const outcome = await (deps.deliver || deliver)(job);
+    const outcome = await (deps.sendToHub || sendToHub)(vouched);
     console.log(outcome.ok ? SENT_LINE : `Not sent (${outcome.step}: ${outcome.code}).`);
     return outcome.ok ? 0 : 1;
   }
-  (deps.spawnDelivery || spawnDelivery)(job);
+  (deps.spawnDelivery || spawnDelivery)(vouched);
   console.log(SENT_LINE);
   return 0;
 }
@@ -201,4 +246,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { main, deliver, readMessage, REFUSALS, scrubReport, isLocalBase, repeatKey, checkAndRecordRepeat, SENT_LINE };
+module.exports = { main, deliver, requestReceipt, sendToHub, keepUnsent, readMessage, REFUSALS, scrubReport, isLocalBase, repeatKey, checkAndRecordRepeat, SENT_LINE };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.148'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.149'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/instance_feedback.mjs

@@ -326,6 +326,8 @@ async function runCli(argv, extra = {}) {
       requireSession: async () => ({ token: 't' }),
       base: 'https://mercury.cloudbongos.com',
       checkRepeat: () => false,
+      requestReceipt: async () => ({ ok: true, receipt: 'R'.repeat(24), origin: 'https://mercury.cloudbongos.com', hub: 'https://cloudbongos.com' }),
+      keepUnsent: () => null,
       spawnDelivery: (job) => spawned.push(job),
       ...extra,
     });
@@ -337,7 +339,49 @@ test('the CLI prints one line and hands the network to the background', async ()
   const r = await runCli(['claim', 'hung']);
   assert.equal(r.code, 0);
   assert.deepEqual(r.out, ['Sent to the Bongos team.']);
-  assert.deepEqual(r.spawned, [{ message: 'claim hung', kind: 'bug' }]);
+  assert.deepEqual(r.spawned, [{ message: 'claim hung', kind: 'bug', receipt: 'R'.repeat(24), origin: 'https://mercury.cloudbongos.com', hub: 'https://cloudbongos.com' }]);
+});
+
+// Task 1004759 (toast, core 1.21.20): the project's live site had no receipt
+// door, the background child got a 404, and the builder had been told "Sent".
+test('a project too old to vouch: "Not sent" in the foreground, the note kept, nothing recorded as sent', async () => {
+  const kept = []; const recorded = [];
+  const r = await runCli(['--idea', 'one', 'skill', 'for', 'project', 'purpose'], {
+    requestReceipt: async () => ({ ok: false, step: 'receipt', code: 'project_too_old' }),
+    keepUnsent: (m) => { kept.push(m); return '/home/x/.config/cloudbongos/feedback-unsent-1.md'; },
+    checkRepeat: (m, o = {}) => { if (o.record !== false) recorded.push(m); return false; },
+  });
+  assert.equal(r.code, 1);
+  assert.deepEqual(r.out, [], 'never says Sent');
+  assert.equal(r.spawned.length, 0);
+  assert.match(r.err.join('\n'), /older Bongos/);
+  assert.match(r.err.join('\n'), /feedback-unsent-1\.md/, 'says where the note is');
+  assert.deepEqual(kept, ['one skill for project purpose']);
+  assert.deepEqual(recorded, [], 'a report that never left is not "already sent"');
+  const other = await runCli(['x'], { requestReceipt: async () => ({ ok: false, step: 'receipt', code: 'not_signed_in' }) });
+  assert.equal(other.code, 1);
+  assert.match(other.err.join('\n'), /did not confirm.*not_signed_in/);
+});
+
+test('the repeat guard records only after the project vouched', async () => {
+  const calls = [];
+  await runCli(['x'], { checkRepeat: (m, o = {}) => { calls.push(o.record === false ? 'look' : 'record'); return false; } });
+  assert.deepEqual(calls, ['look', 'record']);
+});
+
+test('requestReceipt: a 404 from the project reads as project_too_old', async () => {
+  const { requestReceipt } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const api = { request: async () => ({ ok: false, status: 404, data: { error: 'Not found' } }) };
+  const r = await requestReceipt({ message: 'x', kind: 'idea' }, { api, base: 'https://toast.cloudbongos.com' });
+  assert.deepEqual(r, { ok: false, step: 'receipt', code: 'project_too_old' });
+});
+
+test('keepUnsent writes the note where the builder can send it again', () => {
+  const { keepUnsent } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'fb-unsent-'));
+  const file = keepUnsent('the note', { dir, now: new Date('2026-10-19T10:00:00Z') });
+  assert.equal(fs.readFileSync(file, 'utf8'), 'the note');
+  assert.match(path.basename(file), /^feedback-unsent-2026-10-19T10-00-00-000Z\.md$/);
 });
 
 test('the CLI refuses a project only this computer can reach, and sends nothing', async () => {