@bongos/core 1.21.21 → 1.21.22

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.21",
-  "core_contract": "1.21.21",
-  "source_commit": "088255d528bc15019f3b97bed4f7fd8c9c80381c",
+  "core_version": "1.21.22",
+  "core_contract": "1.21.22",
+  "source_commit": "2a68dd5cb2764b3c551ad24493634477b247f32f",
   "source_ref": "HEAD",
-  "built_at": "2026-10-02T21:39:51.692Z",
+  "built_at": "2026-10-02T22:27:46.033Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 580,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3506,
-  "tree_sha256": "ca41de04801a1525a0277b802b9333104f8869cabad1645575f242ea5407caf5",
+  "tree_sha256": "a83f91642c863272631c45c06c69ef23e87fcb7055ad828f1f97c01ebd14274a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2267,7 +2267,7 @@
     {
       "path": "docs/adr/0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md",
       "mode": "0000644",
-      "sha256": "65a0dc5fd120b37b6c59a6e1b19c34d951a5cb277853ffb1664cd5506f490ff6"
+      "sha256": "2e260e1e429e59156800f0abe9958a14e96c8cd027b7266a0e81ed79f7794cfa"
     },
     {
       "path": "docs/adr/0362-the-governor-docket-is-collected-from-contributed-sources.md",
@@ -2832,7 +2832,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "c1ff4f9c102a10de1b72fadff53df9ecb4f69db353058af6d82d2a41cfc05bcb"
+      "sha256": "d54ceb69ddfd770cf8158a72c8a2772cb2bc0031e0412f4dd253d3ac04d38eaa"
     },
     {
       "path": "docs/modules-contract.md",
@@ -9787,12 +9787,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "412dc3a888e904e384aaf313170d1481e3eff74731ec56a8bd1b04e6f2590442"
+      "sha256": "154fe2dcd1ad8a4dec91ca642e11b8c909320b8bb651105eb0ce687ba7a3f0f5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e78240e17e2fa848a9eafb6bf579ef4ae8d2d9e55849c415e913caf37c4e5bbc"
+      "sha256": "c426e05132b8fb4f04e5136e175a2b368551200c561633e8d86e8d12a34f5653"
     },
     {
       "path": "public-docs/index.html",
@@ -9812,7 +9812,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "af98468e105af7980f0537e07b165f46f5159ba90500f4ff9bac9c9c3c2e7315"
+      "sha256": "be314ea66baa33af4fc01f325fc0e70e4b9b4b947a70291b4174be59486591de"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10857,7 +10857,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "2ce88d5c4597d79b7efcc8023f74a1925f294a171284ee9b00d7c32a0ac9d1d8"
+      "sha256": "ca7e46a175308c7789a530284c73ccf58b8c09eac873e07b516206e234be99ab"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
@@ -12037,7 +12037,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5d62285199c27e8be924d39c61bba97235e3da8465cbe4a37e76bd83bb3045b7"
+      "sha256": "75593eff057e1eacf641e8a33686e084bfe4f50308e33818bcd027e568760523"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -15892,7 +15892,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "56664f258f297c98b883b2d02c5ad669796b817946d660826c9301598e6e2c09"
+      "sha256": "4c9a2fb72e70f57aa9a83a9e9b526ff7004a1c15dd87628ba5436e53947001e5"
     },
     {
       "path": "tests/provision_account_identity.mjs",

package/docs/adr/0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md

@@ -41,6 +41,7 @@ The deploy page's **Release** section lists the versions this hall runs that are
 - The "update available" banner (`src/bongos/core-update.js`) offers versions at or below `latest`, read from the same packument. With no readable label it has no answer.
 - The platform's upgrade runner for hosted projects (`scripts/gds/provision-core-upgrade.js`) offers a project the versions its follow admits. The follow comes from its hosting shape: the `control-plane` row is the platform hall and takes candidates; every other shape takes releases (`followForShape`). It is derived, not a column, because there is exactly one platform hall. A column someone could set on a tenant would be one more way to hand a project an unreleased version.
 - **A new project is born on the release** ([task 1004299](https://cloudbongos.com/builders#/task/1004299)). The wizard vendors the core this hall runs (ADR 0292), which is a candidate once D1 is on. `projectCoreDecision` (`scripts/gds/provision-repo.js`) gives the project the `latest` version instead whenever the hall runs ahead of it, packed from the registry; the core-pin refresh that runs in the same provisioning pass uses the same target, so it cannot bump the new pin straight back. Level, or no readable label, keeps the byte-exact running core.
+- **Behind the release, too** ([task 1004556](https://cloudbongos.com/builders#/task/1004556), 2026-10-02). The runner that scaffolds is not always the platform hall: on cloudbongos.com it ran from a patch-channel install stuck on 1.20.82, which cannot cross the 1.21.0 minor, so new projects were born without founding mode. A runner *behind* `latest` now also gives the project the release. A released core has already run on the platform hall, so this never hands out an untried version.
 
 ## Arming (owner steps, in this order)
 

package/docs/module-api-changelog.md

@@ -2869,5 +2869,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.19 with no explicit bump. run 37066131214. (task 1002620)
   1.21.21 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.20 with no explicit bump. run 37068094560. (task 1002620)
+  1.21.22 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.21 with no explicit bump. run 37072549675. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.21",
+  "version": "1.21.22",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.21",
+      "version": "1.21.22",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.21",
+  "version": "1.21.22",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8882,5 +8882,11 @@
       "id": "1004544",
       "text": "The governor city and the street now open inside the normal hall, with the sidebar and top bar around them like every other page. A full-screen button in the corner hides both so the city or the street fills the window again,"
     }
+  ],
+  "1.21.22": [
+    {
+      "id": "1004556",
+      "text": "New projects are now always started on the latest released version of Cloud Bongos, even when the service that sets them up is running an older one. Until now, a lagging setup service passed its own old version to every new pr"
+    }
   ]
 }

package/scripts/gds/provision-repo.js

@@ -515,8 +515,14 @@ function runningCoreVersion({ instanceRoot, coreV }) {
 // publish as candidates, the platform hall runs ahead of the registry's `latest` label by
 // design — and the ladder below vends whatever the hall runs, so every new project would
 // be born on a version nobody released. When the hall is AHEAD of the release, the project
-// gets the release instead. Equal (or the hall behind it, which a release can't normally
-// produce) → the running core, byte-exact, as before.
+// gets the release instead. Equal → the running core, byte-exact, as before.
+//
+// BEHIND the release is real too (task 1004556): the runner that scaffolds is not always
+// the platform hall. On cloudbongos.com it ran from a patch-channel install that could not
+// cross the 1.21.0 minor, so it sat on 1.20.82 and every new project was born there,
+// without founding mode (1.21+). The release is what ADR 0361 D5 promises a new project,
+// and a released core has already run on the platform hall, so the runner's lag must not
+// set the project's version: behind → the release, packed from the registry, too.
 //
 // No readable label → the running core, deliberately (fail-open). Until candidates are
 // armed the running core IS the release; vendoring is the path that works with no
@@ -525,6 +531,7 @@ function runningCoreVersion({ instanceRoot, coreV }) {
 function projectCoreDecision({ running, released }) {
   if (!released || !isStable(released)) return { version: running, source: 'running', reason: 'no readable released (latest) label — using the core this hall runs' };
   if (compareSemver(running, released) > 0) return { version: released, source: 'released', reason: `this hall runs ${running}, ahead of the release` };
+  if (compareSemver(running, released) < 0) return { version: released, source: 'released', reason: `this runner is on ${running}, behind the release` };
   return { version: running, source: 'running', reason: `this hall runs the released core ${released}` };
 }
 

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.21'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.22'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/provision.mjs

@@ -1078,12 +1078,17 @@ await ta('scaffoldStandaloneRepo: a REGISTRY-pinned consumer control plane PACKS
 // ADR 0361: merges publish as candidates and the platform hall runs them, so the core
 // this hall runs is routinely AHEAD of the registry's `latest` label. A new project —
 // and the pin refresh that runs in the same provisioning pass — must get the release.
-t('projectCoreDecision: the hall ahead of the release → the release; level or unreadable → the running core', () => {
+t('projectCoreDecision: the hall ahead of OR behind the release → the release; level or unreadable → the running core', () => {
   assert.deepEqual(
     (({ version, source }) => ({ version, source }))(RP.projectCoreDecision({ running: '1.19.60', released: '1.19.50' })),
     { version: '1.19.50', source: 'released' });
   assert.equal(RP.projectCoreDecision({ running: '1.19.50', released: '1.19.50' }).source, 'running', 'level → byte-exact running core, no registry pack');
-  assert.equal(RP.projectCoreDecision({ running: '1.19.40', released: '1.19.50' }).version, '1.19.40', 'never moves a project PAST what the hall has run');
+  // task 1004556: a runner BEHIND the release (a patch-channel install stuck on 1.20.82
+  // while 1.21.x was released) must not hand its stale core to a new project
+  assert.deepEqual(
+    (({ version, source }) => ({ version, source }))(RP.projectCoreDecision({ running: '1.20.82', released: '1.21.20' })),
+    { version: '1.21.20', source: 'released' }, 'behind the release → the release, across a minor too');
+  assert.equal(RP.projectCoreDecision({ running: '1.19.40', released: '1.19.50' }).source, 'released', 'and within a minor');
   assert.equal(RP.projectCoreDecision({ running: '1.19.60', released: null }).version, '1.19.60', 'no label → fail-open to the running core');
   assert.equal(RP.projectCoreDecision({ running: '1.19.60', released: '1.19.50-rc.1' }).source, 'running', 'a prerelease label is not a release');
   assert.equal(RP.projectCoreDecision({ running: '1.19.60', released: '1.19.50;touch /tmp/x' }).source, 'running', 'a non-semver label never reaches a shell');