@bongos/core 1.17.0 → 1.17.2

package/scripts/gds/lint-infra-exec.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+'use strict';
+// lint-infra-exec.js — task 2137 (ADR 0108 configurable-root). The dry-run/lint that proves every
+// host systemd unit running a CORE script still resolves AFTER the R89 split.
+//
+// The units (box-*, cohost-*, provision-*, search-index-db) keep living in the instance repo
+// (infra/ is host topology) while scripts/gds/ moves into node_modules/@bongos/core, so each
+// ExecStart runs through infra/core-node.sh, which resolves the script under the instance root OR
+// its node_modules/@bongos/core (both layouts). "Resolves in a consumer layout" is provable from
+// the package manifest: the referenced core script must be a PUBLISHABLE core file (isPublishable →
+// it ships inside @bongos/core → present at node_modules/@bongos/core/<rel> post-install). We also
+// assert it exists at the core root today (monolith resolution + a typo catch) and that NO unit
+// still uses the bare repo-relative `node scripts/…` form (which resolves nothing post-split).
+//
+// Usage: node scripts/gds/lint-infra-exec.js   (exit 0 = every unit resolves; 1 = violation)
+
+const fs = require('fs');
+const path = require('path');
+const { isPublishable } = require('./publish-manifest');
+const { resolveInstanceRoot, resolveCoreRoot } = require('../../src/instance-config');
+
+const LAUNCHER = 'infra/core-node.sh';
+// Repointed form:  ExecStart=/usr/bin/env bash infra/core-node.sh <core-rel> [args]
+const LAUNCHER_EXEC = /^ExecStart=.*\binfra\/core-node\.sh\s+(\S+)/;
+// Old bare form:   ExecStart=<node> scripts/…  — must no longer appear on a core-script unit.
+const BARE_EXEC = /^ExecStart=\S*node\s+(scripts\/\S+)/;
+
+// Pure-ish (reads the fs): classify every infra/*.service ExecStart. Returns
+// { ok, checked:[{unit,rel}], violations:[{unit,rel,why}] }. Roots are injectable for tests.
+function lintInfraExec({ instanceRoot, coreRoot } = {}) {
+  const iRoot = instanceRoot || resolveInstanceRoot();
+  const cRoot = coreRoot || resolveCoreRoot();
+  const dir = path.join(iRoot, 'infra');
+  const checked = [];
+  const violations = [];
+  const files = fs.existsSync(dir) ? fs.readdirSync(dir).filter((f) => f.endsWith('.service')).sort() : [];
+  for (const f of files) {
+    for (const raw of fs.readFileSync(path.join(dir, f), 'utf8').split('\n')) {
+      const L = raw.trim();
+      if (!L.startsWith('ExecStart=')) continue;
+      const viaLauncher = LAUNCHER_EXEC.exec(L);
+      if (viaLauncher) {
+        const rel = viaLauncher[1];
+        if (!isPublishable(rel)) {
+          violations.push({ unit: f, rel, why: 'not a publishable core file — ABSENT from node_modules/@bongos/core in a consumer layout' });
+        } else if (!fs.existsSync(path.join(cRoot, rel))) {
+          violations.push({ unit: f, rel, why: `does not exist at the core root (${cRoot})` });
+        } else {
+          checked.push({ unit: f, rel });
+        }
+        continue;
+      }
+      const bare = BARE_EXEC.exec(L);
+      if (bare && bare[1].startsWith('scripts/')) {
+        violations.push({ unit: f, rel: bare[1], why: `bare repo-relative ExecStart — route it through ${LAUNCHER}` });
+      }
+    }
+  }
+  return { ok: violations.length === 0, checked, violations };
+}
+
+if (require.main === module) {
+  const r = lintInfraExec();
+  for (const c of r.checked) console.log(`  ✓ ${c.unit.padEnd(38)} ${c.rel}  (publishable → resolves in a consumer layout)`);
+  for (const v of r.violations) console.error(`  ✗ ${v.unit.padEnd(38)} ${v.rel}  — ${v.why}`);
+  console.log(`\nlint-infra-exec: ${r.checked.length} core-script unit(s) resolve; ${r.violations.length} violation(s)`);
+  process.exit(r.ok ? 0 : 1);
+}
+
+module.exports = { lintInfraExec };

package/scripts/gds/lint-workflow-exec.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+'use strict';
+// lint-workflow-exec.js — task 2136 (ADR 0108 configurable-root). The dry-run/lint that proves
+// every .github/workflows/*.yml invocation of a CORE script still resolves AFTER the R89 split.
+//
+// Workflows keep living in the instance repo (.github/ is host topology) while scripts/gds/* +
+// scripts/migrate.sh move into @bongos/core, so each core invocation runs through the both-layouts
+// resolver: infra/core-node.sh for node targets, infra/core-path.sh for bash targets. "Resolves in
+// a consumer layout" is provable from the package manifest: the referenced core script must be a
+// PUBLISHABLE core file (ships in @bongos/core → present at node_modules/@bongos/core post-install)
+// AND exist at the core root today. A BARE `node scripts/gds/x.js` / `bash scripts/migrate.sh` (not
+// routed through the resolver) is a violation — it resolves nothing from the instance root
+// post-split. Host scripts (scripts/art/*) stay at the instance root, so they are NOT flagged.
+//
+// Usage: node scripts/gds/lint-workflow-exec.js   (exit 0 = all routed + resolve; 1 = violation)
+
+const fs = require('fs');
+const path = require('path');
+const { isPublishable } = require('./publish-manifest');
+const { resolveInstanceRoot, resolveCoreRoot } = require('../../src/instance-config');
+
+// Routed:  `… core-node.sh <rel>` / `… core-path.sh <rel>` (rel = a scripts/… core path).
+const ROUTED = /core-(?:node|path)\.sh\s+(scripts\/[^\s"')]+)/g;
+// Bare core invocation the resolver should have wrapped. Core scripts = scripts/gds/*.{js,sh} +
+// scripts/migrate.sh; host scripts/art/* deliberately excluded (they stay at the instance root).
+const BARE = /(?:^|[^/\w])(?:node|bash)\s+(scripts\/(?:gds\/[^\s"']+\.(?:js|sh)|migrate\.sh))/;
+
+function lintWorkflowExec({ instanceRoot, coreRoot } = {}) {
+  const iRoot = instanceRoot || resolveInstanceRoot();
+  const cRoot = coreRoot || resolveCoreRoot();
+  const dir = path.join(iRoot, '.github', 'workflows');
+  const checked = [];
+  const violations = [];
+  const files = fs.existsSync(dir) ? fs.readdirSync(dir).filter((f) => /\.ya?ml$/.test(f)).sort() : [];
+  for (const f of files) {
+    for (const raw of fs.readFileSync(path.join(dir, f), 'utf8').split('\n')) {
+      const line = raw.replace(/\s+$/, '');
+      if (line.trim().startsWith('#')) continue; // a YAML/shell comment — reference, not an invocation
+      let m;
+      ROUTED.lastIndex = 0;
+      while ((m = ROUTED.exec(line)) !== null) {
+        const rel = m[1];
+        if (!isPublishable(rel)) violations.push({ file: f, rel, why: 'routed but NOT a publishable core file — absent from @bongos/core in a consumer layout' });
+        else if (!fs.existsSync(path.join(cRoot, rel))) violations.push({ file: f, rel, why: `routed but does not exist at the core root (${rel})` });
+        else checked.push({ file: f, rel });
+      }
+      if (/core-(?:node|path)\.sh/.test(line)) continue; // routed line — the arg was handled above
+      const bare = BARE.exec(line);
+      if (bare) violations.push({ file: f, rel: bare[1], why: 'bare core invocation — route it through infra/core-node.sh (node) or infra/core-path.sh (bash)' });
+    }
+  }
+  return { ok: violations.length === 0, checked, violations };
+}
+
+if (require.main === module) {
+  const r = lintWorkflowExec();
+  for (const c of r.checked) console.log(`  ✓ ${c.file.padEnd(26)} ${c.rel}  (publishable → resolves in a consumer layout)`);
+  for (const v of r.violations) console.error(`  ✗ ${v.file.padEnd(26)} ${v.rel}  — ${v.why}`);
+  console.log(`\nlint-workflow-exec: ${r.checked.length} routed core invocation(s) resolve; ${r.violations.length} violation(s)`);
+  process.exit(r.ok ? 0 : 1);
+}
+
+module.exports = { lintWorkflowExec };

package/scripts/gds/migration-namespace.js

@@ -13,7 +13,7 @@
 //
 // DISCIPLINE. Every migration SOURCE owns a distinct filename namespace, so stems can
 // never collide across sources and each source's allocator counts only its own numbers:
-//   • CORE      (the @cloudbongos/core package's  migrations/*.sql)        → core_NNN_slug.sql
+//   • CORE      (the @bongos/core package's  migrations/*.sql)        → core_NNN_slug.sql
 //   • MODULE    (modules/<key>/migrations/*.sql)                           → <key>_NNN_slug.sql   (key: dev-box → dev_box_)
 //   • INSTANCE  (the host repo's                   migrations/instance/*.sql) → NNN_slug.sql        (BARE — the instance owns the bare namespace)
 //

package/scripts/gds/mirror-lineage-check.js

@@ -55,9 +55,11 @@ const { nextFree } = require(path.join(REPO_ROOT, 'scripts/gds/next-number.js'))
 // deterministic regardless of file order.
 const KNOWN_SECRET_SHAPES = SECRET_PATTERNS.map((re) => new RegExp(re.source, re.flags.replace('g', '')));
 
-// Core migrations are migrations/NNN_slug.sql (3+ digit prefix). Module migrations
-// live under modules/<key>/migrations/ and are numbered independently — the
-// claim-time allocator only reads the core dir, so only core numbering can diverge.
+// Core migrations are migrations/NNN_slug.sql (3+ digit prefix) DIRECTLY under
+// migrations/. Module migrations live under modules/<key>/migrations/ and instance
+// SEEDS under migrations/instance/ (ADR 0105) — both numbered independently and
+// excluded from the publishable mirror; the claim-time allocator only reads the
+// top-level core dir, so only core numbering can diverge.
 const MIGRATION_BASENAME_RE = /^(\d{3,})_.*\.sql$/;
 
 // ---- pure helpers (exported for tests) ------------------------------------
@@ -67,8 +69,15 @@ function migrationNumbersFromPaths(paths) {
   const out = new Set();
   for (const p of paths || []) {
     const s = String(p);
-    if (!s.startsWith('migrations/')) continue; // core dir only
-    const m = MIGRATION_BASENAME_RE.exec(s.split('/').pop());
+    if (!s.startsWith('migrations/')) continue; // the migrations dir …
+    // … and ONLY its top level. migrations/instance/NNN_*.sql are this instance's host
+    // seeds (ADR 0105), excluded from the publishable mirror (task 2140) — counting them
+    // here put every instance seed in the PRIVATE set but not the MIRROR set, a false
+    // private⇄mirror divergence that red-lined the unit gate (task 2152). A path with a
+    // further slash is a subdir, never a core migration.
+    const rest = s.slice('migrations/'.length);
+    if (rest.includes('/')) continue;
+    const m = MIGRATION_BASENAME_RE.exec(rest);
     if (m) out.add(parseInt(m[1], 10));
   }
   return out;

package/scripts/gds/mirror-redact.js

@@ -171,6 +171,14 @@ function deriveInstanceLiterals(branding = {}, extra = {}) {
   add(owners, branding.firstAdmin);
   const identity = branding.identity || {};
   add(tokens, identity.worldName);
+  // The PRODUCT name is instance identity too. It was leaking into the published core (the
+  // onboarding primer described this instance's product as the reader's own project) because
+  // only worldName was derived — the redactor never saw it AND findLeaks couldn't gate it.
+  // Deriving it here closes both in one place. (task 2153)
+  add(tokens, identity.productName);
+  // The reward-currency label is per-instance identity as well; a vanilla core must not ship
+  // another instance's currency name (the currency/karma onboarding doc carried it verbatim).
+  add(tokens, (branding.currency || {}).label);
   // The fulfillment/parent company is instance identity too (a coined single word like
   // "Acme"); redact its name + its site's registrable label.
   const company = identity.company || {};

package/scripts/gds/module.js

@@ -351,6 +351,40 @@ function recordSignOff(key, signedBy, { modulesDir = MODULES_DIR } = {}) {
   return { ...record, path: path.relative(REPO_ROOT, file) };
 }
 
+// Reads a previously-recorded sign-off (recordSignOff above), or null if the
+// module has never been signed off. Never throws on a missing/garbled file —
+// "no sign-off yet" is the expected common case, not an error.
+function readSignOff(key, { modulesDir = MODULES_DIR } = {}) {
+  return readJson(path.join(modulesDir, key, '.upstream-signoff.json'));
+}
+
+// ---------------------------------------------------------------------------
+// bongos module submit <key> — ADR 0107 §1 upstreaming submission
+// ---------------------------------------------------------------------------
+
+// Packages a module for the upstreaming queue: its manifest + a full file
+// snapshot (base64, so binary assets round-trip identically) + whatever
+// sign-off is on disk. Pure fs read — no pre-check, no network; the caller
+// (cmdSubmit locally, the POST /modules/:key/submit route server-side) is
+// responsible for having already run checkModulePublishability() and for
+// deciding whether a missing sign-off is fatal.
+function packageModuleForSubmission(key, { modulesDir = MODULES_DIR } = {}) {
+  const dir = path.join(modulesDir, key);
+  const manifest = readJson(path.join(dir, 'module.json'));
+  if (!manifest) throw new Error(`modules/${key}/module.json missing or unreadable`);
+  let totalBytes = 0;
+  const files = listModuleFiles(dir)
+    .map((abs) => {
+      const rel = path.relative(dir, abs).split(path.sep).join('/');
+      const buf = fs.readFileSync(abs);
+      totalBytes += buf.length;
+      return { path: rel, contentBase64: buf.toString('base64'), bytes: buf.length };
+    })
+    .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+  const signOff = readSignOff(key, { modulesDir });
+  return { key, manifest, files, totalBytes, signOff };
+}
+
 // ---------------------------------------------------------------------------
 // Commands
 // ---------------------------------------------------------------------------
@@ -445,6 +479,79 @@ function cmdCheck(args, { log = console.log, errlog = console.error, check = che
   return 0;
 }
 
+// `bongos module submit <key>` — ADR 0107 §1. Runs the §4 pre-check + requires
+// a sign-off (locally, for fast refusal without a network round trip), then
+// POSTs to POST /modules/:key/submit — the SAME route the hall "Modules" tab's
+// submit button calls (src/bongos/routes/modules.js). That route re-runs the
+// pre-check against ITS OWN on-disk copy of the module and is the authoritative
+// gate: a local pass here is a courtesy, not a guarantee, if the module's
+// changes aren't committed + shipped + deployed yet.
+async function cmdSubmit(args, {
+  log = console.log, errlog = console.error,
+  check = checkModulePublishability, sign = recordSignOff, readSign = readSignOff,
+  submit,
+} = {}) {
+  const key = args.find((a) => !a.startsWith('-'));
+  if (!key) {
+    errlog('usage: bongos module submit <key> [--sign-off "Name <email>"]');
+    return 2;
+  }
+  const signIdx = args.indexOf('--sign-off');
+  const signedBy = signIdx !== -1 ? args[signIdx + 1] : null;
+
+  log(`bongos module submit — upstreaming "${key}" (ADR 0107 §1)`);
+
+  let result;
+  try { result = check(key); }
+  catch (e) { errlog(`bongos module submit: ${e.message}`); return 1; }
+
+  if (!result.ok) {
+    for (const f of result.findings) errlog(`  ✗ ${f.kind}: ${f.detail}`);
+    errlog(`\nREFUSING: "${key}" is not clear to submit upstream. Fix the finding(s) above and re-run.`);
+    return 1;
+  }
+  log('  ✓ AGPL/publish pre-check passed.');
+
+  let signOff = readSign(key);
+  if (!signOff && signedBy) {
+    const record = sign(key, signedBy);
+    log(`  ✓ Sign-off recorded — ${record.path}`);
+    signOff = readSign(key);
+  }
+  if (!signOff) {
+    errlog(`\nREFUSING: no DCO-style sign-off on file for "${key}". Pass --sign-off "Name <email>" (or run \`bongos module check ${key} --sign-off "Name <email>"\` first).`);
+    return 1;
+  }
+  log(`  ✓ Sign-off on file — "${signOff.signOff.signedBy}", ${signOff.signOff.date}.`);
+
+  const doSubmit = submit || (async (k, body) => {
+    // Lazy require: cli-lib.js carries session/fetch plumbing that must NEVER
+    // load into the always-on server process — this file is also required by
+    // src/bongos/routes/modules.js for the pre-check it reuses. A real network
+    // call only happens when a human/agent actually invokes this CLI command.
+    const { cliClient, requireSession } = require('./cli-lib');
+    await requireSession();
+    const api = await cliClient();
+    return api.modules.postModulesKeySubmit({ key: k, body });
+  });
+
+  let res;
+  try { res = await doSubmit(key, { signed_by: signedBy || undefined }); }
+  catch (e) { errlog(`bongos module submit: request failed — ${e.message}`); return 1; }
+
+  if (!res.ok) {
+    const detail = (res.data && (res.data.message || res.data.error)) || JSON.stringify(res.data);
+    errlog(`\nREFUSING: the review queue rejected the submission (HTTP ${res.status}): ${detail}`);
+    if (res.status === 422) errlog('(the server re-runs the pre-check/sign-off check against its OWN deployed copy — commit + ship first if this module has local-only changes.)');
+    return 1;
+  }
+
+  const submission = res.data && res.data.submission;
+  log(`\n✓ Filed — submission id ${submission ? submission.id : '?'} for "${key}", status ${submission ? submission.status : 'pending'}.`);
+  log('Task 1771 (core-side review & accept flow) picks it up from here.');
+  return 0;
+}
+
 function printHelp(out = console.log) {
   out('bongos module — scaffold + manage Cloud Bongos modules\n');
   out('Usage:');
@@ -452,14 +559,17 @@ function printHelp(out = console.log) {
   out('  bongos upgrade              Pre-check enabled modules against the core version (fail-closed)');
   out('  bongos module check <key> [--sign-off "Name <email>"]');
   out('                              AGPL/publish pre-check before upstreaming + record a DCO-style sign-off');
+  out('  bongos module submit <key> [--sign-off "Name <email>"]');
+  out('                              Pre-check + sign-off, then file into the rank-gated upstreaming review queue');
 }
 
-function main(argv) {
+async function main(argv) {
   const args = argv.slice(2);
   const sub = args[0];
   if (sub === 'new') return cmdNew(args.slice(1));
   if (sub === 'upgrade') return cmdUpgrade(args.slice(1));
   if (sub === 'check') return cmdCheck(args.slice(1));
+  if (sub === 'submit') return cmdSubmit(args.slice(1));
   if (!sub || sub === 'help' || sub === '--help' || sub === '-h') {
     printHelp();
     return sub ? 0 : 2;
@@ -470,13 +580,17 @@ function main(argv) {
 }
 
 module.exports = {
-  main, cmdNew, cmdUpgrade, cmdCheck, printHelp,
+  main, cmdNew, cmdUpgrade, cmdCheck, cmdSubmit, printHelp,
   scaffoldModule, gatherUpgrade, evaluateUpgrade, buildManifest,
-  checkModulePublishability, recordSignOff, DCO_STATEMENT,
+  checkModulePublishability, recordSignOff, readSignOff, DCO_STATEMENT,
+  listModuleFiles, packageModuleForSubmission,
   routeTemplate, claudeMdTemplate, titleize, camel, coreVersion,
   MODULES_DIR,
 };
 
 if (require.main === module) {
-  process.exit(main(process.argv));
+  Promise.resolve(main(process.argv)).then(
+    (code) => process.exit(code),
+    (e) => { console.error(e); process.exit(1); }
+  );
 }

package/scripts/gds/npmrc.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+'use strict';
+//
+// scripts/gds/npmrc.js — env-fed `.npmrc` for installing the PRIVATE @bongos/* core
+// from the npm registry (ADR 0134, task 2090). The single place that knows the
+// registry host + scope + the `.npmrc` shape + the opt-in/token gates, shared by:
+//   • init.js       — the greenfield `--registry-core` scaffold
+//   • provision.js  — the standalone scaffold's registry path (opt-in, fail-soft)
+//   • upgrade.js     — the `--registry <version>` update channel
+//
+// WHY private + env-fed. `@bongos/core` publishes as a SCOPED, PRIVATE package (ADR
+// 0134): a private scoped package can only be installed with auth. Consumers
+// authenticate with an `.npmrc` whose token EXPANDS FROM THE ENVIRONMENT at install
+// time (`_authToken=${NPM_TOKEN}`) — so the committed file carries NO secret, and a
+// tokenless install 404s cleanly (the expected pre-launch outcome).
+//
+// The vendored-tarball path (task 2053) stays the DEFAULT/fallback until this registry
+// path is proven end-to-end on a real greenfield standup (ADR 0134 §Consequences).
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REGISTRY_HOST = 'registry.npmjs.org';
+const CORE_SCOPE = '@bongos'; // the paid, canonical npm org (ADR 0134 scope correction, task 2092)
+const TOKEN_ENV = 'NPM_TOKEN';
+const REQUEST_ENV = 'PROVISION_CORE_FROM_REGISTRY';
+
+// The `.npmrc` a scaffolded instance commits. The token is the LITERAL `${NPM_TOKEN}`
+// (npm expands env vars in `.npmrc` values at read time), so the file is safe to
+// commit — it holds no secret. Scoping @bongos to the registry keeps every unrelated
+// install on the default public registry.
+function npmrcContent({ scope = CORE_SCOPE, host = REGISTRY_HOST, tokenEnv = TOKEN_ENV } = {}) {
+  return [
+    `; Cloud Bongos — env-fed auth for the PRIVATE ${scope}/* packages (ADR 0134, task 2090).`,
+    `; The token EXPANDS FROM THE ENVIRONMENT at install time; nothing secret is committed here.`,
+    `; \`npm ci\` needs ${tokenEnv} set (a read-only automation token from the paid \`bongos\` org);`,
+    `; without it the private package 404s — that is the expected tokenless outcome.`,
+    `${scope}:registry=https://${host}/`,
+    `//${host}/:_authToken=\${${tokenEnv}}`,
+    '',
+  ].join('\n');
+}
+
+// Is a registry token present in the environment? The fail-soft gate: provisioning
+// falls back to the vendored tarball when this is false, so a tokenless standup still
+// works (never a broken instance).
+function hasNpmToken(env = process.env) {
+  return !!String(env[TOKEN_ENV] || '').trim();
+}
+
+// Has the operator opted the standalone scaffold into the registry path? OFF by
+// default — the vendored tarball stays the default until the registry path is proven
+// end-to-end (ADR 0134). '1'/'true'/'yes'/'on' (case-insensitive) → true.
+function registryCoreRequested(env = process.env) {
+  return /^(1|true|yes|on)$/i.test(String(env[REQUEST_ENV] || '').trim());
+}
+
+// Write the env-fed `.npmrc` into an instance dir. Default overwrites (a greenfield
+// scaffold owns the file); pass overwrite:false to leave a pre-existing `.npmrc`
+// untouched (an upgrade must not clobber a consumer's other registries). Returns the
+// path (or null when skipped). Dry-run writes nothing.
+function writeNpmrc(dir, { fsImpl = fs, dryRun = false, overwrite = true, log = () => {} } = {}) {
+  const p = path.join(dir, '.npmrc');
+  if (!overwrite && fsImpl.existsSync(p)) {
+    log(`  • .npmrc already present — left untouched (add \`${CORE_SCOPE}:registry\` + \`_authToken=\${${TOKEN_ENV}}\` if the private core doesn't resolve).`);
+    return null;
+  }
+  if (dryRun) {
+    log(`  [dry-run] would write ${p} (env-fed ${CORE_SCOPE} auth; token via $${TOKEN_ENV}, never committed)`);
+    return p;
+  }
+  fsImpl.writeFileSync(p, npmrcContent());
+  log(`  ✓ wrote .npmrc (env-fed ${CORE_SCOPE} auth; token via $${TOKEN_ENV}, never committed)`);
+  return p;
+}
+
+module.exports = {
+  REGISTRY_HOST, CORE_SCOPE, TOKEN_ENV, REQUEST_ENV,
+  npmrcContent, hasNpmToken, registryCoreRequested, writeNpmrc,
+};
+
+// Tiny CLI: `node scripts/gds/npmrc.js [--print | --write <dir>]` — print the `.npmrc`
+// body or materialize it into <dir>. Handy for a manual registry-standup rehearsal.
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  const writeIdx = args.indexOf('--write');
+  if (writeIdx !== -1 && args[writeIdx + 1]) {
+    const p = writeNpmrc(path.resolve(args[writeIdx + 1]), { log: console.log });
+    process.stdout.write(`${p}\n`);
+  } else {
+    process.stdout.write(npmrcContent());
+  }
+}

package/scripts/gds/onboard.js

@@ -22,28 +22,12 @@ const oauth = require(path.join(__dirname, 'oauth-secret.js'));     // validateC
 
 // ── PURE core (exported for tests) ───────────────────────────────────────────
 
-// The canonical step sequence — the SINGLE source of truth the skill + hall wizard
-// mirror. `kind: 'human'` steps are the irreducibly-manual ones (UI-first prompts).
-// The sequence branches at exactly ONE leg — scaffold — into greenfield (`bongos init`,
-// a fresh empty repo) vs brownfield (`bongos init --adopt`, LAYER onto an existing repo;
-// ADR 0121 §Decision 1 / task 2046). Every other leg is identical, so passing `mode`
-// only relabels the github-repo / init / scaffold steps.
-function onboardPlan(mode = 'greenfield') {
-  const adopt = mode === 'adopt';
-  return [
-    { key: 'name-address', kind: 'auto', label: 'Decide name + address (interview)' },
-    { key: 'github-repo', kind: 'human', label: adopt ? 'Use your EXISTING GitHub repository' : 'Create the empty GitHub repository' },
-    { key: 'dns-preflight', kind: 'auto', label: 'DNS token preflight — before the address step (task 1980)' },
-    { key: 'init', kind: 'auto', label: adopt ? 'bongos init --adopt — LAYER onto the existing repo (pre-flight + accept)' : 'bongos init — scaffold the instance config' },
-    { key: 'scaffold', kind: 'auto', label: adopt ? 'Layer config + pinned @cloudbongos/core onto the existing repo (no clobber)' : 'Scaffold the standalone repo (own repo + pinned @cloudbongos/core)' },
-    { key: 'provision', kind: 'auto', label: 'Provision core + DB + address + service (standalone, task 1978)' },
-    { key: 'oauth-app', kind: 'human', label: 'Wire GitHub sign-in — one-click GitHub App (task 2080), or a manual OAuth app' },
-    { key: 'oauth-place', kind: 'auto', label: 'Place the OAuth secret — auto via the Manifest flow, or verified manual (task 1979)' },
-    { key: 'first-sign-in', kind: 'human', label: 'First sign-in (seats the founding Archon)' },
-    { key: 'verify', kind: 'auto', label: 'Verify /healthz auth_configured' },
-    { key: 'brand', kind: 'auto', label: 'Brand the instance look' },
-  ];
-}
+// The canonical step sequence now lives in ONE place — the provisioning module — so the
+// CLI (here), the branded /create page, and the hall wizard can't drift (task 2085; goal
+// 35 / criterion 165: "the canonical step sequence is the source of truth; skill/CLI/hall
+// are forms over it"). The web forms read it over GET /provisioning/onboard-plan; the CLI
+// requires it directly. Re-exported below so `bongos onboard` + tests keep the same API.
+const { onboardPlan } = require(path.join(__dirname, '..', '..', 'modules', 'provisioning', 'onboard-plan.js'));
 
 // The exact GitHub OAuth-app values for a domain. The callback is PINNED to the apex
 // /api/gds/auth/web/callback (auth.js WEB_REDIRECT_ORIGIN — a sign-in begun on a
@@ -54,6 +38,10 @@ function oauthAppInstructions(domain) {
     location: "GitHub → your ACCOUNT's Settings → Developer settings → OAuth Apps → New OAuth App",
     homepageUrl: origin,
     callbackUrl: `${origin}/api/gds/auth/web/callback`,
+    // GitHub disables Device Flow on a new OAuth App by DEFAULT, but the terminal
+    // `bongos login` uses it — leaving it off makes CLI sign-in fail with
+    // device_flow_disabled (the 2026-07-08 demo login-500). Must be enabled. (task 2127)
+    enableDeviceFlow: 'Check "Enable Device Flow" on the app page and save — off by default; the terminal `bongos login` needs it.',
   };
 }
 
@@ -149,13 +137,13 @@ async function run() {
     // Step 5 — the standalone repo (greenfield scaffolds it; adopt already layered it in ③)
     if (adopt) {
       log('\n④ Your repo is now the standalone instance (ADR 0108):');
-      log('   `bongos init --adopt` already layered config/ + .claude/ + the pinned @cloudbongos/core dep onto it.');
+      log('   `bongos init --adopt` already layered config/ + .claude/ + the pinned @bongos/core dep onto it.');
       log(`   Commit + push ${a.repoOwner}/${a.repoName}. That checkout is what the service runs.`);
       await ask(rl, 'Press Enter once the layered repo is committed + pushed…');
     } else {
       log('\n④ Scaffold the STANDALONE repo (ADR 0108):');
       log(`   Clone ${a.repoOwner}/${a.repoName} to the control-plane standalone root, add the config/ + .claude/`);
-      log('   from init, pin @cloudbongos/core in its package.json, commit + push. That checkout is what the service runs.');
+      log('   from init, pin @bongos/core in its package.json, commit + push. That checkout is what the service runs.');
       await ask(rl, 'Press Enter once the standalone repo is pushed…');
     }
 
@@ -175,11 +163,16 @@ async function run() {
       log('   RECOMMENDED — one click: in the control-plane hall, open “Start a project” →');
       log('   “Set up GitHub sign-in”. Approve the pre-filled GitHub App; the control plane');
       log('   places the credentials automatically (no secret to paste). Then skip to ⑦.');
+      log('   ⚠ Terminal CLI only: the one-click App cannot enable Device Flow via the manifest,');
+      log('     but `bongos login` needs it. After approving, open the app (github.com → Settings');
+      log('     → Developer settings → GitHub Apps → your app), check "Enable Device Flow", save.');
+      log('     Web sign-in works without this.');
       log('   — or, to create an OAuth app BY HAND —');
       log(`   ${oa.location}`);
       log('   (Developer settings is under your ACCOUNT, not the repository.)');
       log(`   Homepage URL:              ${oa.homepageUrl}`);
       log(`   Authorization callback URL: ${oa.callbackUrl}`);
+      log(`   Enable Device Flow:        ✅  ${oa.enableDeviceFlow}`);
       log('   Copy the Client ID; Generate a new client secret and copy it (shown once).');
       const clientId = await ask(rl, 'Paste the OAuth Client ID:');
       const clientSecret = await ask(rl, 'Paste the OAuth Client Secret:');