@bongos/core 1.21.28 → 1.21.29

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.28",
-  "core_contract": "1.21.28",
-  "source_commit": "f4f417579fcc36610366fba8d4c91baac46e2ca0",
+  "core_version": "1.21.29",
+  "core_contract": "1.21.29",
+  "source_commit": "47c503a90f562777b8bea3ae2f5d2917844830c7",
   "source_ref": "HEAD",
-  "built_at": "2026-10-03T08:27:13.110Z",
+  "built_at": "2026-10-03T08:36:53.941Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 581,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2900,
+    "functional_verbatim": 2901,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3509,
-  "tree_sha256": "27b881361795c4561f820cbffc291efd498201842581ff2375646cc537c14479",
+  "file_count": 3510,
+  "tree_sha256": "b99af8ea7acd69227bca10ae513544dafb2fde2c69f1bc0d03307fc949181873",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2292,12 +2292,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "d777b55865ecfa5a21314670adbeb2beac32108edad08757edb4df5cdc25bcf5"
+      "sha256": "f7a74e0d63a68d2e806d9f24288f2a15549819baafcd041aa472ecd0f604b7d4"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "6b1825bfec2fdcf183266c4cb4a3e66cef2d66ef0d712050b9361a534ce78313"
+      "sha256": "7f94594aed0457b0adb4c1812602aa59199f61540653d378c2e326a1a50fd9a5"
     },
     {
       "path": "docs/architecture.md",
@@ -2322,12 +2322,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "e33e980a5183f9eebe93bfa460652eb59bcf3f4ab1bb06ef0d4a46581a9dd114"
+      "sha256": "37516da1e8fca729b967fe377d6bd0fdc29c7b64a2e067e9e4584093d8d2cbc2"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "f083eecee0085f809e74568ea6e45e9f77eb1a35bdc13800d1c127dc925f7f60"
+      "sha256": "dc74ec9315b7bbbf770d7b4d089a78a45046fd258d1e8ee25b9d199bcd43c4f8"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2832,7 +2832,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "958a9c75c30cae115c89289d3a88c85dff8e8b4183ac02dda389b5b7c067677e"
+      "sha256": "e86a2083d594e9e7c58aaf4dd37eb6049ae45270f18a1ec96f80cff7ff55f926"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2922,7 +2922,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "3c7bd0020a5202f49aad825608ac729c3fbe64495772e135f2570375a1a366bd"
+      "sha256": "9fb83eee65da29a899152445be295abae9487b3870ab41e642b86511c1d94bd3"
     },
     {
       "path": "docs/project-context.template.md",
@@ -8352,7 +8352,7 @@
     {
       "path": "modules/provisioning/routes/callback-page.js",
       "mode": "0000644",
-      "sha256": "6b43ebf71a778277b94de1b9400f690fac9f51b48010e50a159af57195f99f02"
+      "sha256": "2fede95d3be1859e99df1f1e616be6a7744b15379ae9c2b800bf4b1014997f32"
     },
     {
       "path": "modules/provisioning/routes/core-upgrade.js",
@@ -8382,7 +8382,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "ec152c36225c742e4b40dcefca4944d11ce3bd7045ba93d95272d49b82a30aa4"
+      "sha256": "9a86f12dde92fd867e16d4b061abde6d3967b6103d5ea43357c4d102271cfe6e"
     },
     {
       "path": "modules/provisioning/routes/render-standup.js",
@@ -9072,7 +9072,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "b1fabd6091511bdaefe83dea9bf49ba4da6da366f111c818b1143b007c0daf8c"
+      "sha256": "b8be6a642ea811faacce4e6acbf2417a79bff757265a9099767adfddfbe1dae3"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -9802,12 +9802,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e4eaf704bf61ccd93ea4955f5d1ade78f47403192e7dccc1f8069d197fd0c758"
+      "sha256": "514268c479c62f1789c8076e825b38584f0559fae8d18a367db5ff165e893720"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "40a74af040b7651df0eacefb5e01774c590001a409955078d083e4a835447136"
+      "sha256": "4c4c9fcd6742891511b33204b74058ebb94b0da892c1c10e66ccffbf50dd6422"
     },
     {
       "path": "public-docs/index.html",
@@ -9827,7 +9827,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "21845b3246770c6cebb496081fc42fd3c5c63c2d16e4e8d76c6c0971dcc845db"
+      "sha256": "aabfcff6ca8179dfc4340a81ce1c8e912653bce2cb3a18159b4f8bb0ba3b3f6d"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -12052,7 +12052,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "eb507a86526c5e34a11d452df8bebb01cd08946e6f49d8eff25befa20289633e"
+      "sha256": "2ffa034d8d000f29352474827589f39061f569e5f143e63d182a1f472315693f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -15967,7 +15967,7 @@
     {
       "path": "tests/provisioning_callback_page.mjs",
       "mode": "0000644",
-      "sha256": "74d53ae7f3c93883bdc6db5187c904cc6c641267233d70bfef1a25d5b2a4ca05"
+      "sha256": "8886fae6d241f2360c5948d9a243821d6ac20d0021d14ea6477ebf0651e4a712"
     },
     {
       "path": "tests/provisioning_capacity.mjs",
@@ -16027,7 +16027,7 @@
     {
       "path": "tests/provisioning_github_app_routes.mjs",
       "mode": "0000644",
-      "sha256": "4eac40eb55769719c92940d9d7c84334edcda0015e26ee19f8a1905892158edb"
+      "sha256": "88f434ce11204dd239122ba2e8860461b9d78245c4fb4c888dc5edfdc3819ca2"
     },
     {
       "path": "tests/provisioning_look.mjs",
@@ -17479,6 +17479,11 @@
       "mode": "0000644",
       "sha256": "dfb1683e7654269be0c92fce88954aa25146027373581d3b8bfcc6fbdf11f2b0"
     },
+    {
+      "path": "tests/wizard_auto_open.mjs",
+      "mode": "0000644",
+      "sha256": "a64302adf1faf9567911c98eaae3ee25952de242f2b2cf155b892aaec7838def"
+    },
     {
       "path": "tests/wizard_born_first_board.mjs",
       "mode": "0000644",
@@ -17502,7 +17507,7 @@
     {
       "path": "tests/wizard_intent_resume.mjs",
       "mode": "0000644",
-      "sha256": "683dbd4b608b65977e1ebbd1fed4916ff0ed74eead0f379d2309e940779c4b1f"
+      "sha256": "9893ebecadffcce3b2c982322755091e0f5af9e867e41c84d75b3b4eb6edc089"
     },
     {
       "path": "tests/wizard_physics.mjs",

package/docs/api/openapi.json

@@ -15310,7 +15310,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/github-app/status",
-        "description": "GET /provisioning/github-app/status?state=<> — the PUBLIC progress read the onboarding callback page polls (task 2096) to know when setup is done + where to send the owner. Same public-by-state model as the callback: the unguessable, single-use `state` token is the only key, and the response reveals only the manifest lifecycle status + the instance's own (already-public) domain — never a secret. Per-IP rate-limited because the page polls it every ~3s. `ready` is true iff the manifest reached 'done' (creds placed + /healthz verified) — the page then auto-redirects to https://<domain>. rank: public — no session, no mutation, no secret; an unknown state is a 404 no-op.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "GET /provisioning/github-app/status?state=<> — the PUBLIC progress read the onboarding setup checklist polls (task 1004548) to know when setup is done + where to send the owner. Same public-by-state model as the callback: the unguessable, single-use `state` token is the only key, and the response reveals only the manifest lifecycle status + the instance's own (already-public) domain — never a secret. Per-IP rate-limited because the page polls it every ~3s. `ready` is true iff the manifest reached 'done' (creds placed + /healthz verified) — the setup checklist then opens https://<domain>. rank: public — no session, no mutation, no secret; an unknown state is a 404 no-op.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "responses": {

package/docs/api-reference.md

@@ -605,7 +605,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/provisioning/fleet` | `metic+archon` | — | GET /provisioning/fleet — the full instance roster across all owners. |
 | GET | `/api/bongos/provisioning/fleet/cost-ledger` | `metic+archon` | — | GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals. |
 | GET | `/api/bongos/provisioning/github-app/callback` | `public` | — | GET /provisioning/github-app/callback?code=&state= — GitHub redirects the owner's BROWSER here after they approve the App Manifest (task … |
-| GET | `/api/bongos/provisioning/github-app/status` | `public` | — | GET /provisioning/github-app/status?state=<> — the PUBLIC progress read the onboarding callback page polls (task 2096) to know when setup… |
+| GET | `/api/bongos/provisioning/github-app/status` | `public` | — | GET /provisioning/github-app/status?state=<> — the PUBLIC progress read the onboarding setup checklist polls (task 1004548) to know when … |
 | GET | `/api/bongos/provisioning/health` | `public` | — | GET /provisioning/health — liveness + the core version this module mounted against. |
 | GET | `/api/bongos/provisioning/instances` | `any-builder` | — | GET /provisioning/instances — the caller's own instances + each open intent. |
 | POST | `/api/bongos/provisioning/instances` | `any-builder` | `slug`, `target_ref`, `hosting_shape`, `domain`, `no_address`, `tier`, `onboard_mode`, `type`, `description`, `detail`, `modules`, `terms_acknowledged`, `demo` | POST /provisioning/instances — request a new instance. |