@bongos/core 1.17.0 → 1.17.2

package/scripts/gds/package-core.js

@@ -38,7 +38,7 @@
 //      carries a live credential verbatim, PRODUCE NOTHING — dist/ is never touched. The
 //      in-memory pass makes the abort atomic (same discipline as the mirror export).
 //   5. Only when the whole set is clean: write the tree to
-//      dist/cloudbongos-core-<version>/, the .tgz, and the pin MANIFEST.
+//      dist/bongos-core-<version>/, the .tgz, and the pin MANIFEST.
 //
 // THE VERSION STAMP is the platform version — src/module-api.js CORE_VERSION,
 // read via the SAME fail-soft accessor scripts/gds/module.js + bongos upgrade use
@@ -55,9 +55,9 @@
 //        [--version <v>] [--droplet-ip <ip>] [--publish [--live]]
 //   Defaults: --ref HEAD, --out-dir dist, --version = platform CORE_VERSION.
 //   Outputs (nothing is committed — dist/ is gitignored):
-//     dist/cloudbongos-core-<version>/           the redacted core tree (inspectable)
-//     dist/cloudbongos-core-<version>.tgz        the installable unit
-//     dist/cloudbongos-core-<version>.manifest.json   the PIN (tree hash + per-file hashes)
+//     dist/bongos-core-<version>/           the redacted core tree (inspectable)
+//     dist/bongos-core-<version>.tgz        the installable unit
+//     dist/bongos-core-<version>.manifest.json   the PIN (tree hash + per-file hashes)
 //   --publish        after building, `npm publish` the .tgz as a PRIVATE scoped
 //                    package (--access restricted). DRY-RUN unless --live is added
 //                    (task 2089 / ADR 0134). Private publish needs the cloudbongos
@@ -81,7 +81,7 @@ const { collectEnvSecrets } = require(path.join(REPO_ROOT, 'modules/security/sec
 const { redactBlob, parseLsTree } = require(path.join(REPO_ROOT, 'scripts/public-mirror-export.js'));
 
 const MANIFEST_SCHEMA = 1;
-const ARTIFACT_NAME = 'cloudbongos-core';
+const ARTIFACT_NAME = 'bongos-core';
 // The tar internal root MUST be `package/` — that is the one hardcoded npm
 // convention for an installable tarball (`npm install ./x.tgz` / `npm pack`
 // output both use it; npm does not read the directory name to find package.json,
@@ -92,7 +92,7 @@ const TAR_ROOT = 'package/';
 // The self-describing manifest carried INSIDE the artifact (minus tarball.* — a
 // file cannot contain its own hash). The authoritative PIN is the side-car next
 // to the .tgz, which adds tarball.{sha256,bytes}.
-const INNER_MANIFEST = `${TAR_ROOT}.cloudbongos-core.json`;
+const INNER_MANIFEST = `${TAR_ROOT}.bongos-core.json`;
 
 // ---------------------------------------------------------------------------
 // The platform version — read CORE_VERSION via the doorway, lazily + fail-soft,
@@ -136,6 +136,38 @@ function sha256hex(buf) {
 const DOC_RE = /\.(md|markdown)$/i;
 function isDocPath(p) { return DOC_RE.test(String(p || '')); }
 
+// ---------------------------------------------------------------------------
+// Agent-doc STUB (task 2121; surfaced by the 2026-07-08 demo task-creation audit).
+// Claude Code AUTO-LOADS the nearest file named CLAUDE.md (or AGENTS.md) into the
+// live session whenever an agent opens a sibling file. In a CONSUMER instance the
+// core installs at node_modules/@bongos/core/, so the core repo's OWN CLAUDE.md tree
+// (root + scripts/gds + src/bongos + every module) would silently inject the
+// platform's project memory — wrong project title, hundreds of lines, dangling links
+// — into the instance's context the moment an agent reads any core file.
+//   The PUBLIC MIRROR deliberately publishes CLAUDE.md as the portable methodology
+// (ADR 0065 §4), so this cannot live in the shared publish-manifest — it is a
+// package-core-only transform. We keep the files PRESENT (nothing that probes for
+// them by path breaks) but replace their body with a tiny, brand-free stub, turning
+// the auto-load into a harmless "this doesn't govern you" redirect.
+const AGENT_DOC_RE = /(^|\/)(CLAUDE|AGENTS)\.md$/i;
+function isAgentDoc(p) { return AGENT_DOC_RE.test(String(p || '')); }
+const CORE_AGENT_DOC_STUB = `# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
+
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
+
+**It does not govern this repository.** Your own root \`CLAUDE.md\`, your \`.claude/\`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
+
+You are seeing this only because an agent opened a file under \`node_modules/@bongos/core/\`.
+Nothing in here needs to be read to use the platform — run \`bongos help\` for commands.
+
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._
+`;
+
 // Fail-loud gate for a FUNCTIONAL file: only an exact live-credential value (an env-secret
 // VALUE present verbatim, >= 8 chars) is a real leak. The sample is withheld (it's a secret).
 function functionalSecretLeaks(view, envSecrets) {
@@ -154,6 +186,12 @@ function functionalSecretLeaks(view, envSecrets) {
 //     `advisories` = brand-identity substrings + public IPs that ship as-is (non-fatal, for
 //     human awareness) — REUSES findLeaks so the detector is defined once.
 function processCoreFile({ pathRel, raw, rules, sensitiveLiterals, envSecrets }) {
+  // An auto-loaded agent doc (CLAUDE.md/AGENTS.md) → ship a brand-free stub, never the
+  // core's own project memory (task 2121). The stub is brand-free by construction, so it
+  // needs no redaction and can never leak — it short-circuits ahead of the doc path.
+  if (isAgentDoc(pathRel)) {
+    return { buf: Buffer.from(CORE_AGENT_DOC_STUB, 'utf8'), leaks: [], advisories: [], kind: 'stub' };
+  }
   if (isDocPath(pathRel)) {
     const r = redactBlob({ buf: raw, rules, sensitiveLiterals, envSecrets });
     const leaks = r.leaks.map((l) => ({ label: `doc:${l.label}`, sample: l.sample }));
@@ -174,7 +212,7 @@ function processCoreFile({ pathRel, raw, rules, sensitiveLiterals, envSecrets })
 //
 // The source repo's package.json/package-lock.json (isPublishable() includes
 // both) are GAME-heavy — colyseus/phaser/sharp/discord.js plus the repo's own
-// name/version — and are not what a downstream `npm install @cloudbongos/core`
+// name/version — and are not what a downstream `npm install @bongos/core`
 // should see. These two files are SYNTHESIZED here (never copied verbatim from
 // git) and staged in their place. Everything else still ships through the
 // normal isPublishable()/processCoreFile path.
@@ -195,27 +233,42 @@ function buildPackageJson({ version, sourceDeps, sourceOverrides }) {
     dependencies[name] = range;
   }
   const pkg = {
-    name: '@cloudbongos/core',
+    name: '@bongos/core',
     version,
     description: 'Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).',
     license: 'AGPL-3.0-or-later',
     main: 'src/platform-server.js',
     bin: { bongos: 'bin/bongos.js' },
     // Named exports a consumer imports directly, alongside the default entry
-    // (buildPlatformApp, from `main`): mountInternalSurfaces (the shared
-    // host-routing surface both server.js and platform-server.js call) and the
-    // module-api doorway a module's routes/seams are authored against.
+    // (buildPlatformApp, from `main`). Two groups:
+    //   • the platform surface — serve-internal (the shared host-routing surface
+    //     both server.js and platform-server.js call) + the module-api doorway a
+    //     module's routes/seams are authored against.
+    //   • the GAME-HOST KIT (rehearsal F3, task 2161) — the core internals a
+    //     game-bearing instance's own entrypoint (server.js, kept host per task
+    //     2134) wires directly: the API-404 shaping, the uptime poller, the module
+    //     loader, the enabled-module gate, and the seam registry. A game-less
+    //     instance boots via `.`/platform-server.js and never imports these; a game
+    //     instance's server.js requires them, and the cutover codemod
+    //     (scripts/gds/cutover-codemod.js) rewrites its relative `./src/*` requires
+    //     to exactly these subpaths. Every subpath the codemod's CORE_INTERNAL_MAP
+    //     targets MUST appear here or the rewritten require won't resolve.
     exports: {
       '.': './src/platform-server.js',
       './serve-internal': './src/bongos/serve-internal.js',
       './module-api': './src/module-api.js',
+      './bongos/api-path-404': './src/bongos/api-path-404.js',
+      './bongos/uptime-poller': './src/bongos/uptime-poller.js',
+      './module-loader/loader': './src/module-loader/loader.js',
+      './modules': './src/modules.js',
+      './module-seams': './src/module-seams.js',
     },
     engines: { node: '>=22' },
     // Pre-launch distribution posture (task 2089 / ADR 0134): publish PRIVATE by
     // default. `access:"restricted"` makes a scoped package private on publish, so a
     // paid npm org can ship it where only members can install — no accidental public
     // leak if someone forgets the CLI flag. Going public at launch is one step:
-    // `npm access public @cloudbongos/core` (or flip this to "public"). The name must
+    // `npm access public @bongos/core` (or flip this to "public"). The name must
     // stay SCOPED to be private at all — unscoped npm names are always public.
     publishConfig: { access: 'restricted' },
     dependencies,
@@ -481,7 +534,7 @@ function publishTarball({ tgzPath, live }) {
   if (!live) {
     console.error('  Dry-run: nothing is uploaded. To publish for real: re-run with --publish --live.');
     console.error('  That is PERMANENT and requires `npm login` + the cloudbongos npm org on a paid plan');
-    console.error('  (private scoped publish needs one). Going public later: `npm access public @cloudbongos/core`.');
+    console.error('  (private scoped publish needs one). Going public later: `npm access public @bongos/core`.');
   }
   const r = spawnSync(NPM_BIN, args, { cwd: REPO_ROOT, stdio: ['inherit', process.stderr, 'inherit'] });
   if (r.error || r.status !== 0) {
@@ -489,7 +542,7 @@ function publishTarball({ tgzPath, live }) {
     if (live) console.error('  Common causes: not logged in (`npm login`), the org isn’t on a paid plan (private scoped publish requires one), or 2FA.');
     process.exit(r.status || 1);
   }
-  console.error(`[package-core] npm publish ${live ? 'succeeded — @cloudbongos/core is live (private).' : 'dry-run OK — the tarball is publishable.'}`);
+  console.error(`[package-core] npm publish ${live ? 'succeeded — @bongos/core is live (private).' : 'dry-run OK — the tarball is publishable.'}`);
 }
 
 function main() {
@@ -520,7 +573,7 @@ function main() {
 
   // 2b. Synthesize the core's own package.json + pruned package-lock.json from the
   //     SOURCE files at this ref (never the live working tree, so --ref stays
-  //     reproducible) — express+pg only, name @cloudbongos/core, version = the
+  //     reproducible) — express+pg only, name @bongos/core, version = the
   //     platform version being packaged.
   const pkgJsonBlob = entries.find((e) => e.path === 'package.json');
   const pkgLockBlob = entries.find((e) => e.path === 'package-lock.json');
@@ -557,6 +610,7 @@ function main() {
   const advisories = []; // { path, label, sample } — non-fatal (brand/IP that ships verbatim)
   let docCount = 0;
   let funcCount = 0;
+  let stubCount = 0; // agent docs (CLAUDE.md/AGENTS.md) replaced with the brand-free stub (task 2121)
   for (const e of publishable) {
     let raw;
     try { raw = gitBuf(['cat-file', 'blob', e.sha]); }
@@ -565,7 +619,7 @@ function main() {
       processCoreFile({ pathRel: e.path, raw, rules, sensitiveLiterals, envSecrets });
     for (const l of fileLeaks) leaks.push({ path: e.path, label: l.label, sample: l.sample });
     for (const a of fileAdvisories) advisories.push({ path: e.path, label: a.label, sample: a.sample });
-    if (kind === 'doc') docCount++; else funcCount++;
+    if (kind === 'doc') docCount++; else if (kind === 'stub') stubCount++; else funcCount++;
     filesMeta.push({ path: e.path, mode: e.mode, sha256: sha256hex(buf) });
     staged.push({ name: TAR_ROOT + e.path, mode: parseInt(normalizeMode(e.mode), 8), buf });
   }
@@ -593,7 +647,7 @@ function main() {
     console.error('     for a live-credential leak, remove the secret at SOURCE (it should never be committed). Then re-run. dist/ was NOT touched.');
     process.exit(1);
   }
-  console.error(`[package-core] no-leak gate PASSED — ${staged.length} files clean (${docCount} docs redacted, ${funcCount} functional verbatim).`);
+  console.error(`[package-core] no-leak gate PASSED — ${staged.length} files clean (${docCount} docs redacted, ${stubCount} agent-docs stubbed, ${funcCount} functional verbatim).`);
 
   // Advisory: brand-identity + public-IP literals that ship VERBATIM inside functional
   // files. Not a leak (these are public, not secrets; a downstream rebrands via config) —
@@ -614,6 +668,7 @@ function main() {
     redaction: {
       model: 'docs-redacted+functional-verbatim', // task 1824
       docs_redacted: docCount,
+      agent_docs_stubbed: stubCount, // CLAUDE.md/AGENTS.md → brand-free stub (task 2121)
       functional_verbatim: funcCount,
       rules: rules.length,
       gate_literals: sensitiveLiterals.length,
@@ -675,6 +730,8 @@ module.exports = {
   octal, tarChecksum, ustarHeader, splitUstarName, buildTar,
   // task 1824 — the consumer-core file-classification layer (pure; unit-tested)
   isDocPath, functionalSecretLeaks, processCoreFile,
+  // task 2121 — agent-doc (CLAUDE.md/AGENTS.md) stub so a consumer's node_modules can't auto-load core memory
+  isAgentDoc, CORE_AGENT_DOC_STUB,
   // task 1882 (ADR 0108 §2) — the real installable npm package
   CORE_DEP_NAMES, buildPackageJson, resolveLockDep, lockfileClosure, prunePackageLock,
   // task 2089 (ADR 0134) — private-by-default npm publish

package/scripts/gds/provision.js

@@ -56,6 +56,12 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 // plain require (its require.main guard means importing it runs no CLI).
 const oauthSecret = require('./oauth-secret');
 
+// The registry-install gates + env-fed .npmrc (ADR 0134, task 2090). Lets the
+// standalone scaffold OPT IN to pulling the PRIVATE @bongos/core from the npm
+// registry (PROVISION_CORE_FROM_REGISTRY=1) instead of vendoring a tarball, with a
+// fail-soft fallback to the vendored path when no NPM_TOKEN is present.
+const { registryCoreRequested, hasNpmToken } = require('./npmrc');
+
 // The HTTP User-Agent the manifest conversion stamps its GitHub call with (GitHub
 // requires a UA). Overridable so a fork can identify itself; not secret.
 const MANIFEST_UA = process.env.PROVISION_GITHUB_UA || 'cloudbongos-provisioner';
@@ -118,7 +124,7 @@ const CONFIG = {
   // since the control plane and the run box are then the same machine.
   controlPlaneIp: process.env.PROVISION_CONTROL_PLANE_IP || null,
   // Parent dir for a STANDALONE instance's OWN repo checkout (hosting_shape='standalone',
-  // ADR 0108): each lives at <standaloneBase>/<slug> with @cloudbongos/core installed as
+  // ADR 0108): each lives at <standaloneBase>/<slug> with @bongos/core installed as
   // an npm dep. Distinct from co-tenant (which shares THIS control-plane checkout).
   standaloneBase: process.env.PROVISION_STANDALONE_BASE || '/srv/cloudbongos',
   // ── Privilege escalation (task 2066, ADR 0128) ───────────────────────────
@@ -207,13 +213,45 @@ function migrateCmd(inst, { privileged = false } = {}) {
     : `PGDATABASE=${dbName(inst)} MEDUSA_GDS_ONLY=1 ./scripts/migrate.sh`;
 }
 
+// Seed the instance's FIRST version so it can take tasks from minute one (task 2119,
+// goal 35). A freshly-migrated instance DB comes up with an EMPTY versions table —
+// migrate runs instance-seeds-off (ADR 0105) and `bongos init` ran --no-seed — yet
+// every task requires a version (tasks.version_id NOT NULL) and POST /versions is
+// Archon-only (no Archon exists until first sign-in). Without a seed here, a brand-new
+// project has NOWHERE to file a task. This runs on the box's DB path (no rank gate),
+// ONLY IF the versions table is empty: idempotent, safe to re-run, and it never
+// disturbs a project that already has versions. Mirrors seedViaApi's shape — V1
+// (status 'building') + one done-when criterion so /status has a finish line from day
+// one. `track` is set EXPLICITLY: versions.track is NOT NULL with no default (mig 112
+// dropped the CHECK), and 'product' matches the canonical V1 seed in 003_pms.sql.
+//
+// The id/name/done_when come from instanceInitSpec so the starter version has ONE
+// source of truth (the same spec the greenfield `bongos init` seed uses). SQL string
+// literals are DOLLAR-QUOTED ($v$…$v$) so the whole -c argument is single-quoted —
+// the one form that is safe UNCHANGED across all three executors: inline (/bin/sh),
+// over SSH (bash -s), AND embedded in a dedicated droplet's cloud-init (bash -lc "…"),
+// with no nested-quote or $-expansion hazard.
+function seedFirstVersionCmd(inst, { privileged = false } = {}) {
+  const v = instanceInitSpec(inst).version;
+  const q = (s) => `$v$${s}$v$`;                 // dollar-quoted literal (no value contains a single quote or $)
+  const sql =
+    `INSERT INTO versions (id, name, track, status, done_when) ` +
+    `SELECT ${q(v.id)}, ${q(v.name)}, $v$product$v$, $v$building$v$, ${q(v.done_when)} ` +
+    `WHERE NOT EXISTS (SELECT 1 FROM versions); ` +
+    `INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, sort_order) ` +
+    `SELECT ${q(v.id)}, $v$first-goal$v$, ${q(v.done_when)}, 10 ` +
+    `WHERE EXISTS (SELECT 1 FROM versions WHERE id = ${q(v.id)}) ` +
+    `AND NOT EXISTS (SELECT 1 FROM done_when_criteria WHERE version_id = ${q(v.id)} AND criterion_id = $v$first-goal$v$);`;
+  return asPostgres(`psql -v ON_ERROR_STOP=1 -d ${dbName(inst)} -c '${sql}'`, privileged);
+}
+
 // ── STANDALONE shape (hosting_shape='standalone', ADR 0108, task 1978) ────────
 // A standalone instance runs from its OWN repo checkout (host content: config/,
-// migrations/instance/, the core PIN in package.json) with @cloudbongos/core installed
+// migrations/instance/, the core PIN in package.json) with @bongos/core installed
 // as an npm DEPENDENCY — NOT the shared control-plane checkout the co-tenant shape uses.
 // It is the ADR 0108 DESTINATION model; these generators make provision.js drive the
 // scripts/deploy/deploy-instance.sh runbook API-driven instead of by hand.
-const CORE_PKG_DIR = 'node_modules/@cloudbongos/core';
+const CORE_PKG_DIR = 'node_modules/@bongos/core';
 function standaloneRoot(inst, { base = CONFIG.standaloneBase } = {}) { return path.posix.join(base, inst.slug); }
 // Sync the instance's own repo (host content + the core pin). Mirrors deploy-instance.sh
 // step 1 — assumes the repo is already cloned at standaloneRoot (initial clone is a
@@ -281,7 +319,7 @@ function instanceInitSpec(inst, { ownerLogin } = {}) {
 const INSTANCE_GITIGNORE = ['node_modules/', 'dist/', '.env', '.env.local', '*.log', ''].join('\n');
 
 // Clone the (empty) target_ref → standaloneRoot → materialize config/ + .claude/ + a
-// file:-pinned @cloudbongos/core + lockfile (via `bongos init --vendor-core`, task 2053)
+// file:-pinned @bongos/core + lockfile (via `bongos init --vendor-core`, task 2053)
 // → commit + push. Idempotent (skips once the repo carries a package.json) and dry-run
 // safe (every mutation goes through the injected exec/writeFile). ADR 0108 / 0125.
 async function scaffoldStandaloneRepo(inst, deps) {
@@ -327,23 +365,44 @@ async function scaffoldStandaloneRepo(inst, deps) {
   }
   exec(`git -C ${root} checkout -B main`);
 
-  // 2. build the installable core tarball from THIS control-plane checkout (the core source).
-  exec(`node scripts/gds/package-core.js`);                       // cwd = REPO_ROOT → dist/cloudbongos-core-<v>.tgz
-  const tgz = path.join(REPO_ROOT, 'dist', `cloudbongos-core-${coreV}.tgz`);
+  // Core-install path (ADR 0134, task 2090). DEFAULT = vendor a tarball built from THIS
+  // control-plane checkout (offline, proven — task 2053). OPT-IN = pull the PRIVATE
+  // @bongos/core from the npm registry (PROVISION_CORE_FROM_REGISTRY=1). The registry
+  // path needs NPM_TOKEN at `npm ci` time; if the flag is set but no token is present we
+  // FAIL SOFT to the vendored path so a tokenless standup still works (never a broken
+  // instance). The env is injectable for tests; the runner falls back to process.env.
+  const env = deps.env || process.env;
+  const wantRegistry = registryCoreRequested(env);
+  const useRegistry = wantRegistry && hasNpmToken(env);
+  if (wantRegistry && !useRegistry) {
+    log('  [scaffold] PROVISION_CORE_FROM_REGISTRY set but no NPM_TOKEN in env — falling back to the vendored-tarball core (ADR 0134 fail-soft).');
+  }
 
-  // 3. materialize config/ + .claude/ + a file:-pinned package.json + lockfile via `bongos init`
-  //    (--vendor-core, task 2053). --no-seed: the instance's own DB is seeded by migrate, not here.
+  // materialize config/ + .claude/ + a pinned package.json + lockfile via `bongos init`.
+  // --no-seed: the instance's own DB is seeded by migrate, not here. Two mutually
+  // exclusive core-resolution shapes:
+  //   registry (--registry-core): caret pin + env-fed .npmrc; `npm ci` pulls from the
+  //     registry. init generates the lockfile (NPM_TOKEN is present — we gated on it).
+  //   vendored (--vendor-core, default): a tarball built from this checkout, file:-pinned.
   const spec = instanceInitSpec(inst, { ownerLogin });
   const specPath = path.join(os.tmpdir(), `bongos-init-${inst.slug}.json`);
   writeFile(specPath, JSON.stringify(spec, null, 2));
-  exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed --force --vendor-core ${tgz}`);
+  if (useRegistry) {
+    log(`  [scaffold] core install: registry — PRIVATE @bongos/core@${coreV} via env-fed NPM_TOKEN (ADR 0134)`);
+    exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed --force --registry-core`);
+  } else {
+    log(`  [scaffold] core install: vendored tarball (offline default)`);
+    exec(`node scripts/gds/package-core.js`);                      // cwd = REPO_ROOT → dist/bongos-core-<v>.tgz
+    const tgz = path.join(REPO_ROOT, 'dist', `bongos-core-${coreV}.tgz`);
+    exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed --force --vendor-core ${tgz}`);
+  }
 
   // 4. commit + push the scaffold to the instance's own main (keep node_modules out).
   writeFile(path.join(root, '.gitignore'), INSTANCE_GITIGNORE);
   exec(`git -C ${root} config user.name "Cloud Bongos"`);
   exec(`git -C ${root} config user.email "bot@cloudbongos.com"`);
   exec(`git -C ${root} add -A`);
-  exec(`git -C ${root} commit -m "chore: scaffold ${inst.slug} on a pinned @cloudbongos/core ${coreV} (provision.js, ADR 0108)"`, { allowFail: true });
+  exec(`git -C ${root} commit -m "chore: scaffold ${inst.slug} on a pinned @bongos/core ${coreV} (provision.js, ADR 0108)"`, { allowFail: true });
   exec(`git -C ${root} push -u origin main`);
   log(`  [scaffold] pushed initial scaffold to ${repo.owner}/${repo.name}@main`);
   return { ok: true, scaffolded: true };
@@ -446,11 +505,25 @@ ${prefix}_OAUTH_ORIGIN=${origin}
 # GitHub App Manifest flow (ADR 0133) — the owner clicked one link; no secret was pasted.`
     : `# Provisioned by scripts/gds/provision.js (ADR 0111). Fill the OAuth app creds via the
 # one-click GitHub App Manifest flow (ADR 0133), or manually (oauth-secret.js place):`;
+  // The founding owner (firstAdmin): the GitHub login src/bongos/auth.js seats as the
+  // instance's first Archon on first sign-in (maybeSeatFirstAdmin checks
+  // <prefix>_FIRST_ADMIN before branding.firstAdmin). WITHOUT it a provisioned instance
+  // has NO owner — first sign-in is refused / lands rankless and the owner can never
+  // claim their own instance (goal 35 / criterion 165 regression, caught live 2026-07-07:
+  // demo had every origin override but no FIRST_ADMIN, so lars589 could not be seated).
+  // Derived from the instance repo owner (target_ref = "<owner>/<repo>"), the SAME source
+  // instanceInitSpec uses for the scaffold's branding.firstAdmin — so this env override and
+  // the scaffolded config/branding.json agree. (Org-owned repo: the org login is not a
+  // sign-in identity, so it is left unset; the owner sets <prefix>_FIRST_ADMIN by hand.)
+  const ownerRepo = parseTargetRef(inst.target_ref);
+  const firstAdminLine = ownerRepo && ownerRepo.owner
+    ? `${prefix}_FIRST_ADMIN=${ownerRepo.owner}\n`
+    : '';
   return `# /etc/${inst.slug}/web.env — per-instance secrets (chmod 600, OUTSIDE the repo).
 ${credComment}
 ${prefix}_GITHUB_CLIENT_ID=${clientId || ''}
 ${prefix}_GITHUB_CLIENT_SECRET=${clientSecret || ''}
-GDS_BRANDING_FILE=${PROVISIONED_BRANDING_FILE}
+${firstAdminLine}GDS_BRANDING_FILE=${PROVISIONED_BRANDING_FILE}
 ${originLines}PORT=${inst.port}
 PGDATABASE=${dbName(inst)}
 `;
@@ -808,7 +881,7 @@ async function provisionInstance(inst, deps) {
     // Co-tenant OR standalone: a process bound to an allocated port on the box it runs
     // on. Co-tenant shares that box's checkout ($0, cloudbongos.com model — under
     // remote-exec, the co-hosting box); standalone (ADR 0108) runs from its OWN repo
-    // dir with a pinned @cloudbongos/core (synced in step 2) on the CONTROL PLANE.
+    // dir with a pinned @bongos/core (synced in step 2) on the CONTROL PLANE.
     // Allocate against the ports of whichever box it runs on (boxExec: remote for a
     // co-tenant, local for a standalone — task 2074), then run the rest there.
     if (!inst.port) {
@@ -838,11 +911,16 @@ async function provisionInstance(inst, deps) {
   // ── step 2: code sync (standalone) + database ─────────────────────────────
   if (local && standalone) {
     // Standalone (ADR 0108 / deploy-instance.sh steps 1-2): sync the instance's own
-    // repo + install the pinned @cloudbongos/core, so the migrate + service below run
+    // repo + install the pinned @bongos/core, so the migrate + service below run
     // from the INSTANCE root, not this control-plane checkout. cwd = standaloneRoot.
     // boxExec = the control plane (where scaffoldStandaloneRepo just created the dir).
+    // REGISTRY CORE (ADR 0134): when the scaffold pinned the registry core, the committed
+    // .npmrc reads `_authToken=${NPM_TOKEN}` — so `npm ci` resolves the PRIVATE package
+    // only if NPM_TOKEN is in this runner's env (makeExec inherits process.env). The
+    // scaffold already gated on the token, so it is present; the VENDORED default needs
+    // no token (the tarball is committed). A tokenless registry `npm ci` 404s cleanly.
     const root = standaloneRoot(inst);
-    log('  [code] standalone — pull instance repo + npm ci (pinned @cloudbongos/core)');
+    log('  [code] standalone — pull instance repo + npm ci (pinned @bongos/core)');
     boxExec(standalonePullCmd(), { cwd: root });
     boxExec(standaloneInstallCmd(), { cwd: root });
   }
@@ -851,7 +929,13 @@ async function provisionInstance(inst, deps) {
     boxExec(dbCreateCmd(inst, { privileged }), { allowFail: true });   // "already exists" is fine
     if (standalone) boxExec(standaloneMigrateCmd(inst, { privileged }), { cwd: standaloneRoot(inst) });  // instance-root migrate
     else boxExec(migrateCmd(inst, { privileged }));
-  } else { log('    (runs via cloud-init on the droplet)'); }
+    // Seed the first version so the instance can take tasks from minute one (task 2119,
+    // goal 35). Only fires if the versions table is empty — idempotent, never disturbs an
+    // existing project. NOT allowFail: a re-run is a clean 0-row no-op, so a real failure
+    // here should surface. Dedicated bakes the same step into cloud-init (dedicatedUserData).
+    log('  [seed] first version (only if versions is empty)');
+    boxExec(seedFirstVersionCmd(inst, { privileged }));
+  } else { log('    (db create + migrate + first-version seed run via cloud-init on the droplet)'); }
 
   // ── step 3: config + per-instance secrets ─────────────────────────────────
   log('  [config] per-instance web.env');
@@ -929,6 +1013,7 @@ function dedicatedUserData(inst) {
 runcmd:
   - [ bash, -lc, "${dbCreateCmd(i)} || true" ]
   - [ bash, -lc, "cd ${REPO_ROOT} && ${migrateCmd(i)}" ]
+  - [ bash, -lc, "${seedFirstVersionCmd(i)}" ]
   - [ bash, -lc, "systemctl daemon-reload && systemctl enable --now ${i.slug}" ]
 `;
 }
@@ -1310,7 +1395,7 @@ if (require.main === module) main();
 module.exports = {
   CONFIG, MAX_INTENT_ATTEMPTS,
   // pure step generators (tested directly)
-  dbName, dbCreateCmd, migrateCmd, serviceUnit, serviceUnitPath, webEnvBody, webEnvPath,
+  dbName, dbCreateCmd, migrateCmd, seedFirstVersionCmd, serviceUnit, serviceUnitPath, webEnvBody, webEnvPath,
   standaloneRoot, standalonePullCmd, standaloneInstallCmd, standaloneMigrateCmd,
   // standalone scaffold (ADR 0108 / 0125, task 2055)
   parseTargetRef, instanceRepoRemote, instanceInitSpec, scaffoldStandaloneRepo, coreVersionSafe,

package/scripts/gds/publish-manifest.js

@@ -44,7 +44,9 @@ const PUBLISH_ALLOWLIST = [
   'src/',                 // platform engine + GDS core (the game residue is denied below)
   'scripts/',             // build + methodology tooling (deploy is denied below)
   'bin/',                 // the `cloudbongos`/`bongos` CLI entrypoint
-  'server.js',            // the single-process app entry
+  // NB: repo-root server.js is the GAME+platform entry (top-level require('colyseus'),
+  // a pruned core dep) — HOST-excluded in CONTENT_EXCLUDE below; the core boots
+  // game-less via src/platform-server.js (package-core sets that as `main`). task 2134.
   // --- the build system's shared schema + its tests ---
   'migrations/',
   'tests/',
@@ -63,6 +65,7 @@ const PUBLISH_ALLOWLIST = [
   'modules/status-ui/',
   'modules/dev-box/',
   'modules/discord/',
+  'modules/provisioning/',   // instance-hosting control plane — CORE like its sibling dev-box (same do-api/cf-tunnel toolchain, all core). Reclassified IN so the core CLI scripts/gds/provision.js resolves it from the core package post-split, not a MODULE_NOT_FOUND (task 2135). default:false — shipped ≠ enabled.
   // --- neutral (customer-0) config starters + their schemas (the filled-in *.json twins are denied) ---
   'config/branding.neutral.json',
   'config/modules.neutral.json',
@@ -77,7 +80,7 @@ const PUBLISH_ALLOWLIST = [
   'CONTRIBUTING.md',
   'CODE_OF_CONDUCT.md',
   'docs/adr/',                       // sanitized — ADR 0065 §4 "docs/ADRs (sanitized)"
-  'docs/recipes/',
+  'docs/recipes/',                   // portable METHODOLOGY recipes only; project-specific ones (art/staging/load-test/standup/decouple) are denied below — task 2153
   'docs/design/',
   'docs/research/',
   'docs/architecture.md',
@@ -85,6 +88,11 @@ const PUBLISH_ALLOWLIST = [
   // renders broken onboarding + API-reference pages (task 2078). Redacted like the
   // rest of this docs section; the diagrams' .png/.svg regenerate on the box.
   'docs/onboarding/',                // primer.md + drachmae-and-karma.md + diagram sources (/builders/primer · /drachmae · /diagrams)
+  // API artifacts (classification settled, task 2141): CORE-shipped STARTERS so a fresh
+  // hall/docs render before first regen — but per-instance GENERATED. init + `bongos
+  // upgrade` regenerate them INTO the instance; the instance-root fitness gate
+  // (gen-api-docs --check) + tests/api_client.mjs guard drift. They ship; they are not a
+  // monolith-only artifact.
   'docs/api/openapi.json',           // the generated OpenAPI 3.1 spec served at /docs/openapi.json
   'docs/api-reference.md',           // the markdown API reference
   'docs/modules-contract.md',
@@ -161,12 +169,33 @@ const CONTENT_EXCLUDE = [
   'src/world/',
   'src/rooms/',
   'src/preview-server.js',
+  'server.js',               // repo-root game+platform entry: top-level require('colyseus') (a pruned core dep) → un-runnable in the game-less package; the core boots via src/platform-server.js. Mirrors src/preview-server.js. (task 2134)
   // the art feature's CLI tooling lives under scripts/ (legacy top-level) but belongs
   // to the excluded art module — exclude it with the feature it serves.
   'scripts/art/',
+  'scripts/gds/art-stage.js', // art sandbox-staging CLI: requires modules/art-pipeline's build_tilesheet.py; excluded with the art feature it serves so a core file never requires an excluded module (task 2135)
   'scripts/tile-add.js',
   'scripts/tile-find.js',
   'scripts/tile-recommend.js',
+  // The art pipeline's operational RECIPE — belongs to the excluded art module; exclude it
+  // with the feature it serves (mirrors scripts/art/ above). docs/recipes/ is allowlisted
+  // wholesale, so this deny is what keeps the game-art recipe out of a non-art core. (task 2153)
+  'docs/recipes/pixel-art-pipeline.md',
+  // Host-feature TESTS that statically import an EXCLUDED module's source. tests/ is
+  // allowlisted (the platform/methodology suite is core), but these cover the game/art
+  // HOST modules and import their source directly — so package-core (which selects via
+  // isPublishable) would ship them WITHOUT the module they need → MODULE_NOT_FOUND when a
+  // core CI/consumer runs them, and the R89 cutover would DELETE OTB's own game/art tests
+  // (they cover kept host modules; they cannot live in core). Exclude each with the feature
+  // it serves — mirrors scripts/gds/art-stage.js above. The guard in tests/publish_manifest.mjs
+  // derives this set from disk and fails if a new host-module test is added but not listed. (task 2147)
+  'tests/walkability.mjs',     // → modules/game/world
+  'tests/terrain_picker.mjs',  // → modules/game/public/game/world
+  'tests/snapshot_picker.mjs', // → modules/game/public/game/world
+  'tests/sprite_facing.mjs',   // → modules/game/public/game/player
+  'tests/turn_in_place.mjs',   // → modules/game/public/game/player
+  'tests/day_cycle.mjs',       // → modules/game/public/game/fx
+  'tests/art_key.mjs',         // → modules/art-pipeline
 ];
 
 // (4) INSTANCE IDENTITY + HISTORY — this host's literals, ops config, build history, and
@@ -178,6 +207,11 @@ const INSTANCE_EXCLUDE = [
   'config/devbox-app.json',
   'config/hierarchy.json',
   'CODEOWNERS',              // names the owner (a protected surface, excluded as identity)
+  // instance SEED migrations — this host's scope-truth SQL (planning seeds, world data).
+  // ADR 0105: a consumer's core must not carry them; migrate.sh reads instance seeds from
+  // resolveInstanceRoot() (SEED_INSTANCE), so the consumer repo owns them. Core migrations
+  // (migrations/core_NNN_*.sql + bare legacy migrations/NNN_*.sql) still publish. (task 2140)
+  'migrations/instance/',
   // instance-specific docs + project history
   'docs/project-context.md',
   'docs/lore/',
@@ -192,6 +226,30 @@ const INSTANCE_EXCLUDE = [
   'docs/graphics-stress-test-plan.md',
   'docs/security-baseline.md',
   'docs/routes-permissions.md',
+  // instance-specific OPERATIONAL recipes — this host's staging + load-test artifacts, its
+  // specific control-plane / vanity-door standups, and its one-time monolith-decouple runbook.
+  // docs/recipes/ is allowlisted wholesale for the PORTABLE methodology recipes; these teach
+  // nothing a different instance would use, so they stay in this repo and never ship in the
+  // core (mirrors migrations/instance above). Redaction only de-brands them — this stops the
+  // irrelevant-noise at the source. The module-owned RECIPE redesign is deferred (idea 536). (task 2153)
+  'docs/recipes/staging-data.md',
+  'docs/recipes/parallel-load-test.md',
+  'docs/recipes/parallel-load-results-2026-05-30.md',
+  'docs/recipes/claude-gemini-bongos-doors.md',
+  'docs/recipes/cloudbongos-standup.md',
+  'docs/recipes/cloudbongos-staging-gate.md',
+  'docs/recipes/amazonprimea-decouple-r89.md',
+  'docs/recipes/amazonprimea-decouple-rollback-r89.md',
+  // instance-specific GAME-DESIGN specs — this host's pixel-art / level briefs (the container
+  // buildings, its palette, the world-map scroll). docs/design/ is allowlisted wholesale for the
+  // PORTABLE design docs (modular-architecture/*, the vanilla-hall-ui redesign scope); these four
+  // describe THIS instance's game and genericize to nothing, so they stay in this repo and never
+  // ship in the core. Redaction only de-brands NAMES — the world-narrative prose in them is not a
+  // name and survives redaction, so exclude at the source (mirrors the recipe carve-out above). (task 2155)
+  'docs/design/container-exterior.md',
+  'docs/design/container-exterior-tiles.md',
+  'docs/design/container-interior.md',
+  'docs/design/world-map-scroll.md',
   'blockers/',
   'limitations/',
   'generative-ideas.md',