unoverse 0.1.177 → 0.1.179

package/operator/infra/aws/main.tf

@@ -307,6 +307,33 @@ resource "aws_instance" "app" {
   }
 
   tags = { Name = "${var.name}-app" }
+
+  # THE IMAGE IS CHOSEN ONCE, AT BUILD, AND NEVER AGAIN BY ACCIDENT.
+  #
+  # `ami` is a force-replacement attribute: an instance's image cannot be swapped in place,
+  # so any change to it means DESTROY AND REBUILD, losing the 100 GB root volume and
+  # everything on it. The lookup above asks for `most_recent`, so the value feeding it
+  # changes whenever Canonical publishes, roughly monthly. Together those two facts arm a
+  # trap that fires on the first `unoverse deploy aws` after a publish, on a universe
+  # nobody has touched, with nothing in the repo to explain it.
+  #
+  # Observed 2026-08-26. BPP's box was built from ...-20260731; every deploy for four weeks
+  # got that same id back and planned nothing. Canonical published ...-20260826 at 07:52
+  # UTC, and the next deploy that morning planned to replace the server. Terraform was
+  # right and the config was wrong, and the only warning was one line in a plan that also
+  # said "Changing".
+  #
+  # An EXISTING universe now keeps the image it was built on; a NEW one still takes
+  # whatever is current when it is created, because the lookup is untouched and only drift
+  # is ignored. The trade is deliberate: nothing upgrades the OS for you. Patch in place
+  # with apt, and move to a newer image by rebuilding on purpose — a decision, rather than
+  # a side effect of deploying on the wrong day.
+  #
+  # DigitalOcean needs none of this: its droplet names a fixed slug (`ubuntu-22-04-x64`),
+  # a literal in the file that cannot drift.
+  lifecycle {
+    ignore_changes = [ami]
+  }
 }
 
 resource "aws_eip" "app" {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.177",
+  "version": "0.1.179",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",

package/vendor/base/lint/design/index.mjs

@@ -705,18 +705,20 @@ for (const orgDir of [DS, ...orgDirs]) {
       if (hookYaml && !Array.isArray(readDef(mf).allowedHosts))
         report("error", mf, `${custom} makes requests, so this manifest must declare "allowedHosts". Deny by default: no list, no network`);
 
-      // A NAME with no definition behind it is a key nobody can ever enter: nothing offers
-      // a form for it, the hook runs credential-less, the vendor refuses, and the card
-      // renders its preview defaults with no error anywhere. Caught here instead. Skipped
-      // when no definition was found at all, since that means the nodes tree is absent
-      // rather than the name being wrong.
+      // A credential is a NAME (owner ruling 2026-08-26): it references a value that
+      // exists in the universe or does not, and shipping NEVER blocks on it — the gap is
+      // a WARNING here and a loud runtime warning when the hook runs without it
+      // (resolveCredentials says so on every keyless run). A missing DEFINITION only
+      // means no package offers a pre-built entry form; the value can still be provided.
+      // This was an org-blocking error until it stopped a yasisland deploy over a form
+      // nobody needed that day.
       if (credentialDefs.size)
         for (const cname of Array.isArray(readDef(mf).credentials) ? readDef(mf).credentials : [])
           if (!credentialDefs.has(String(cname)))
             report(
-              "error",
+              "warn",
               mf,
-              `credential "${cname}" has no definition in any installed node package, so nothing can offer a form to enter it. Install the package that defines it, or name one that exists: ${[...credentialDefs].sort().join(", ")}`,
+              `credential "${cname}" has no definition in any installed node package, so no pre-built form exists to enter it — the hook will run without it until a value is provided. Installed definitions: ${[...credentialDefs].sort().join(", ")}`,
             );
 
     }