@bongos/core 1.17.0 → 1.17.2

package/tests/onboard.mjs

@@ -37,12 +37,30 @@ test('onboardPlan(adopt): same sequence + human steps, but the scaffold-leg labe
   assert.doesNotMatch(label(green, 'init'), /--adopt/);
 });
 
+test('onboardPlan lists seed-first-version as an explicit AUTO step right after provision (task 2119 anti-drift)', () => {
+  // The first-version seed used to be an unlisted afterthought bolted to the local
+  // `bongos init` leg (run --no-seed in every hosted flow, so it never fired). Making
+  // it a named step in the ONE canonical sequence is what stops it silently drifting.
+  const plan = ob.onboardPlan();
+  const keys = plan.map((s) => s.key);
+  const seed = plan.find((s) => s.key === 'seed-version');
+  assert.ok(seed, 'the plan carries a seed-version step');
+  assert.equal(seed.kind, 'auto', 'seeding is automated (the runner does it, no owner action)');
+  assert.equal(keys.indexOf('seed-version'), keys.indexOf('provision') + 1, 'seed immediately follows provision (the DB now exists)');
+  assert.ok(keys.indexOf('seed-version') < keys.indexOf('first-sign-in'), 'a version exists before the owner ever signs in');
+  // present in BOTH modes (not a greenfield/adopt branch).
+  assert.ok(ob.onboardPlan('adopt').some((s) => s.key === 'seed-version'), 'adopt gets it too');
+});
+
 test('oauthAppInstructions pins the apex callback + homepage and points at ACCOUNT Developer settings', () => {
   const oa = ob.oauthAppInstructions('mercury.example.com');
   assert.equal(oa.homepageUrl, 'https://mercury.example.com');
   assert.equal(oa.callbackUrl, 'https://mercury.example.com/api/gds/auth/web/callback');
   assert.match(oa.location, /ACCOUNT/);
   assert.match(oa.location, /Developer settings/);
+  // task 2127 — must tell the owner to enable Device Flow (off by default; the CLI login
+  // uses it). Its absence was the 2026-07-08 demo login-500 root cause.
+  assert.match(oa.enableDeviceFlow, /Device Flow/i);
 });
 
 test('buildInitSpec maps answers to a STANDALONE init spec (domain → origin + provisioning shape)', () => {
@@ -68,3 +86,47 @@ test('buildInitSpec without a domain still defaults a standalone provisioning sh
 test('healthzUrl', () => {
   assert.equal(ob.healthzUrl('mercury.example.com'), 'https://mercury.example.com/healthz');
 });
+
+// ── task 2085: ONE source for the onboarding sequence (anti-drift) ────────────
+
+test('onboardPlan is the SAME function the provisioning module owns (single source, not a copy)', () => {
+  // The CLI must CONSUME modules/provisioning/onboard-plan.js, not carry its own copy —
+  // that is the whole point of task 2085. A re-declared duplicate would pass every other
+  // test yet silently drift; identity of the function reference proves there is one source.
+  const canonical = require('../modules/provisioning/onboard-plan.js').onboardPlan;
+  assert.equal(ob.onboardPlan, canonical, 'scripts/gds/onboard.js must re-export the module’s onboardPlan');
+});
+
+test('the web forms (/create + hall wizard) declare EXACTLY the canonical human steps — drift guard', () => {
+  // goal 35 / criterion 165: "the canonical step sequence is the source of truth;
+  // skill/CLI/hall are forms over it." Each web form tags its human-step <li>s with
+  // data-onboard-step="<key>"; this asserts that set equals the plan's human-step keys,
+  // so adding/removing/renaming a human step in the single source fails CI until every
+  // form is updated (and vice-versa) — the sequence can no longer drift between forms.
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const humanKeys = ob.onboardPlan().filter((s) => s.kind === 'human').map((s) => s.key).sort();
+  const surfaces = {
+    '/create landing page': 'public-landing/create.html',
+    'hall new-project wizard': 'modules/hall-ui/public/new-project-wizard.js',
+  };
+  for (const [name, rel] of Object.entries(surfaces)) {
+    const src = readFileSync(path.join(import.meta.dirname, '..', rel), 'utf8');
+    const found = [...src.matchAll(/data-onboard-step="([^"]+)"/g)].map((m) => m[1]);
+    const uniq = [...new Set(found)].sort();
+    assert.deepEqual(uniq, humanKeys, `${name} (${rel}) must tag exactly the canonical human steps [${humanKeys}], found [${uniq}]`);
+  }
+});
+
+test('the one-click GitHub-App manifest path surfaces the CLI-only Enable-Device-Flow step (task 2129)', () => {
+  // GitHub defaults Device Flow OFF and the manifest can't enable it, but `bongos login` needs
+  // it — so BOTH manifest surfaces must tell the owner to enable it after the one-click approval.
+  // Assert on a phrase DISTINCT to the one-click caveat: the manual OAuth path already mentions
+  // Device Flow (task 2127), so a bare "Device Flow" match wouldn't prove the manifest path carries it.
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const onboardSrc = readFileSync(path.join(import.meta.dirname, '..', 'scripts/gds/onboard.js'), 'utf8');
+  const wizardSrc = readFileSync(path.join(import.meta.dirname, '..', 'modules/hall-ui/public/new-project-wizard.js'), 'utf8');
+  assert.match(onboardSrc, /cannot enable Device Flow via the manifest/i, 'bongos onboard one-click caveat missing');
+  assert.match(wizardSrc, /Terminal CLI only: after approving, enable/i, 'hall wizard one-click caveat missing');
+});

package/tests/package_core.mjs

@@ -25,6 +25,8 @@ const {
   ARTIFACT_NAME, MANIFEST_SCHEMA, TAR_ROOT,
   // task 1824 — the consumer-core file-classification layer
   isDocPath, functionalSecretLeaks, processCoreFile,
+  // task 2121 — agent-doc (CLAUDE.md/AGENTS.md) stub
+  isAgentDoc, CORE_AGENT_DOC_STUB,
   // task 1882 (ADR 0108 §2) — the real installable npm package
   CORE_DEP_NAMES, buildPackageJson, resolveLockDep, lockfileClosure, prunePackageLock,
   // task 2089 (ADR 0134) — private-by-default npm publish
@@ -141,27 +143,27 @@ t('withTarballInfo adds the exact-bytes coordinate for the side-car pin', () =>
     version: '1.13.0', coreContract: '1.13.0', sourceCommit: 'abc', sourceRef: 'HEAD',
     builtAtIso: '2026-07-01T00:00:00.000Z', files: [], treeHash: 'x', redaction: null,
   });
-  const side = withTarballInfo(inner, { name: 'cloudbongos-core-1.13.0.tgz', sha256: 'cafe', bytes: 42 });
+  const side = withTarballInfo(inner, { name: 'bongos-core-1.13.0.tgz', sha256: 'cafe', bytes: 42 });
   assert.equal(side.tarball.sha256, 'cafe');
   assert.equal(side.tarball.bytes, 42);
   assert.equal(inner.tarball, undefined); // withTarballInfo does not mutate the inner
 });
 
 t('artifact filenames', () => {
-  assert.equal(tarballName('1.13.0'), 'cloudbongos-core-1.13.0.tgz');
-  assert.equal(manifestName('1.13.0'), 'cloudbongos-core-1.13.0.manifest.json');
-  assert.equal(stageDirName('1.13.0'), 'cloudbongos-core-1.13.0');
+  assert.equal(tarballName('1.13.0'), 'bongos-core-1.13.0.tgz');
+  assert.equal(manifestName('1.13.0'), 'bongos-core-1.13.0.manifest.json');
+  assert.equal(stageDirName('1.13.0'), 'bongos-core-1.13.0');
 });
 
 // ── ustar name/prefix split ──────────────────────────────────────────────────────────
 t('splitUstarName: short path → name only', () => {
-  const r = splitUstarName('cloudbongos-core/a.js');
+  const r = splitUstarName('bongos-core/a.js');
   assert.equal(r.prefix, '');
-  assert.equal(r.name, 'cloudbongos-core/a.js');
+  assert.equal(r.name, 'bongos-core/a.js');
 });
 
 t('splitUstarName: long path splits at a / into name<=100 + prefix<=155', () => {
-  const long = 'cloudbongos-core/' + 'dir/'.repeat(20) + 'file.js'; // > 100 bytes
+  const long = 'bongos-core/' + 'dir/'.repeat(24) + 'file.js'; // > 100 bytes → forces a name/prefix split
   const r = splitUstarName(long);
   assert.ok(r, 'expected a split');
   assert.ok(Buffer.byteLength(r.name) <= 100);
@@ -177,18 +179,18 @@ t('splitUstarName: unsplittable (>100-byte tail) → null (longlink fallback)',
 // ── buildTar — produces a real, readable, deterministic archive ──────────────────────
 t('buildTar round-trips a small set (content + mode preserved)', () => {
   const entries = [
-    { name: 'cloudbongos-core/a.txt', mode: 0o644, buf: Buffer.from('hello\n') },
-    { name: 'cloudbongos-core/bin/run.sh', mode: 0o755, buf: Buffer.from('#!/bin/sh\necho hi\n') },
+    { name: 'bongos-core/a.txt', mode: 0o644, buf: Buffer.from('hello\n') },
+    { name: 'bongos-core/bin/run.sh', mode: 0o755, buf: Buffer.from('#!/bin/sh\necho hi\n') },
   ];
   const files = readTar(buildTar(entries));
-  assert.equal(files.get('cloudbongos-core/a.txt').content.toString(), 'hello\n');
-  assert.equal(files.get('cloudbongos-core/bin/run.sh').content.toString(), '#!/bin/sh\necho hi\n');
-  assert.equal(files.get('cloudbongos-core/bin/run.sh').mode & 0o777, 0o755);
-  assert.equal(files.get('cloudbongos-core/a.txt').mode & 0o777, 0o644);
+  assert.equal(files.get('bongos-core/a.txt').content.toString(), 'hello\n');
+  assert.equal(files.get('bongos-core/bin/run.sh').content.toString(), '#!/bin/sh\necho hi\n');
+  assert.equal(files.get('bongos-core/bin/run.sh').mode & 0o777, 0o755);
+  assert.equal(files.get('bongos-core/a.txt').mode & 0o777, 0o644);
 });
 
 t('buildTar round-trips a >100-byte path via the GNU longlink path', () => {
-  const longName = 'cloudbongos-core/' + 'deep/'.repeat(25) + 'leaf.js'; // ~150 bytes, but splittable
+  const longName = 'bongos-core/' + 'deep/'.repeat(25) + 'leaf.js'; // ~150 bytes, but splittable
   const unsplittable = 'z'.repeat(130); // forces the longlink branch (no valid split)
   const entries = [
     { name: longName, mode: 0o644, buf: Buffer.from('deep\n') },
@@ -201,15 +203,15 @@ t('buildTar round-trips a >100-byte path via the GNU longlink path', () => {
 
 t('buildTar is byte-deterministic (same input → identical bytes; entry order irrelevant)', () => {
   const e1 = [
-    { name: 'cloudbongos-core/b.txt', mode: 0o644, buf: Buffer.from('B') },
-    { name: 'cloudbongos-core/a.txt', mode: 0o644, buf: Buffer.from('A') },
+    { name: 'bongos-core/b.txt', mode: 0o644, buf: Buffer.from('B') },
+    { name: 'bongos-core/a.txt', mode: 0o644, buf: Buffer.from('A') },
   ];
   const e2 = [...e1].reverse();
   assert.equal(sha256hex(buildTar(e1)), sha256hex(buildTar(e2)));
 });
 
 t('buildTar output gunzips and ends with two zero blocks', () => {
-  const gz = buildTar([{ name: 'cloudbongos-core/a', mode: 0o644, buf: Buffer.from('x') }]);
+  const gz = buildTar([{ name: 'bongos-core/a', mode: 0o644, buf: Buffer.from('x') }]);
   const tar = zlib.gunzipSync(gz);
   assert.equal(tar.length % 512, 0);
   const tail = tar.subarray(tar.length - 1024);
@@ -298,6 +300,50 @@ t('DOCS are genericized: instance brand/owner redacted, output is clean', () =>
   assert.equal(r.leaks.length, 0);        // clean after redaction → no abort
 });
 
+// ── task 2121 — CLAUDE.md/AGENTS.md ship as a brand-free stub (demo-audit fix) ──────
+t('isAgentDoc: matches CLAUDE.md/AGENTS.md at root + any depth, nothing else', () => {
+  assert.equal(isAgentDoc('CLAUDE.md'), true);
+  assert.equal(isAgentDoc('scripts/gds/CLAUDE.md'), true);
+  assert.equal(isAgentDoc('src/bongos/routes/CLAUDE.md'), true);
+  assert.equal(isAgentDoc('modules/lifecycle/CLAUDE.md'), true);
+  assert.equal(isAgentDoc('AGENTS.md'), true);
+  assert.equal(isAgentDoc('docs/CLAUDE.md'), true);
+  // NOT an agent doc: other markdown, or a filename that merely contains the word
+  assert.equal(isAgentDoc('README.md'), false);
+  assert.equal(isAgentDoc('docs/adr/0100.md'), false);
+  assert.equal(isAgentDoc('docs/CLAUDE-notes.md'), false);
+  assert.equal(isAgentDoc('src/claude.js'), false);
+});
+
+t('processCoreFile STUBS a CLAUDE.md — the core memory never ships (no auto-load pollution)', () => {
+  // A realistic core CLAUDE.md: the wrong project title + instance brand + a long body.
+  const coreClaude = '# Off the Boats — Project Memory\n' +
+    'Visit https://acme.example (world Xanadu), owner zoltan. ' + 'lorem ipsum '.repeat(200);
+  const r = proc('CLAUDE.md', coreClaude);
+  assert.equal(r.kind, 'stub');                               // classified as a stub, not a doc
+  assert.equal(r.leaks.length, 0);                            // brand-free by construction → never a leak
+  const out = r.buf.toString();
+  assert.equal(out, CORE_AGENT_DOC_STUB);                     // exactly the stub, verbatim
+  assert.ok(!/Off the Boats/i.test(out), 'wrong project title gone');
+  assert.ok(!/acme/i.test(out) && !/zoltan/i.test(out) && !/Xanadu/i.test(out), 'no instance brand');
+  assert.ok(!/lorem ipsum/.test(out), 'original 200-line body gone');
+  assert.ok(out.length < coreClaude.length, 'stub is far shorter than the real memory');
+});
+
+t('processCoreFile STUBS nested + module CLAUDE.md too (all auto-load sites)', () => {
+  for (const p of ['scripts/gds/CLAUDE.md', 'src/bongos/CLAUDE.md', 'modules/economy/CLAUDE.md']) {
+    const r = proc(p, '# nested map\nsecret https://acme.example detail');
+    assert.equal(r.kind, 'stub', `${p} stubbed`);
+    assert.equal(r.buf.toString(), CORE_AGENT_DOC_STUB, `${p} → stub body`);
+  }
+});
+
+t('the stub itself carries no instance brand and states it does not govern', () => {
+  assert.ok(!/acme|zoltan|Xanadu|Off the Boats/i.test(CORE_AGENT_DOC_STUB));
+  assert.ok(/does not govern/i.test(CORE_AGENT_DOC_STUB));
+  assert.ok(/@bongos\/core/.test(CORE_AGENT_DOC_STUB));
+});
+
 // ── task 1882 (ADR 0108 §2) — the real installable npm package ─────────────────────
 t('TAR_ROOT is the npm-required "package/" (not the ARTIFACT_NAME dir)', () => {
   assert.equal(TAR_ROOT, 'package/');
@@ -309,7 +355,7 @@ t('buildPackageJson: prunes to express+pg, keeps the source ranges + the undici
     sourceDeps: { express: '^4.21.2', pg: '^8.20.0', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
     sourceOverrides: { undici: '^6.27.0' },
   });
-  assert.equal(pkg.name, '@cloudbongos/core');
+  assert.equal(pkg.name, '@bongos/core');
   assert.equal(pkg.version, '1.14.0');
   assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0' });
   assert.equal(pkg.dependencies.phaser, undefined);
@@ -320,12 +366,20 @@ t('buildPackageJson: prunes to express+pg, keeps the source ranges + the undici
   assert.equal(pkg.exports['.'], './src/platform-server.js');
   assert.equal(pkg.exports['./serve-internal'], './src/bongos/serve-internal.js');
   assert.equal(pkg.exports['./module-api'], './src/module-api.js');
+  // rehearsal F3 / task 2161 — the game-host kit: the core internals a game-bearing
+  // instance's own entrypoint (server.js) wires. The cutover codemod rewrites server.js's
+  // relative ./src/* requires to exactly these subpaths, so they MUST be exported.
+  assert.equal(pkg.exports['./bongos/api-path-404'], './src/bongos/api-path-404.js');
+  assert.equal(pkg.exports['./bongos/uptime-poller'], './src/bongos/uptime-poller.js');
+  assert.equal(pkg.exports['./module-loader/loader'], './src/module-loader/loader.js');
+  assert.equal(pkg.exports['./modules'], './src/modules.js');
+  assert.equal(pkg.exports['./module-seams'], './src/module-seams.js');
   // task 2089 / ADR 0134 — the synthesized package publishes PRIVATE by default.
   assert.deepEqual(pkg.publishConfig, { access: 'restricted' });
 });
 
 t('publishArgs: private (restricted) publish, dry-run unless live (task 2089 / ADR 0134)', () => {
-  const tgz = 'dist/cloudbongos-core-1.14.0.tgz';
+  const tgz = 'dist/bongos-core-1.14.0.tgz';
   // Default: dry-run, restricted (never public, never a real upload).
   assert.deepEqual(publishArgs(tgz, false), ['publish', tgz, '--access', 'restricted', '--dry-run']);
   // Live: still restricted (private) — the permanent publish is never public here.
@@ -408,8 +462,8 @@ t('lockfileClosure: matches the real repo lockfile — express+pg close over the
 });
 
 t('prunePackageLock: emits a self-consistent pruned lockfile (root ranges + only the kept packages)', () => {
-  const pruned = prunePackageLock(FIXTURE_LOCK, { name: '@cloudbongos/core', version: '1.14.0', rootRanges: { a: '^1.0.0' }, rootDepNames: ['a'] });
-  assert.equal(pruned.name, '@cloudbongos/core');
+  const pruned = prunePackageLock(FIXTURE_LOCK, { name: '@bongos/core', version: '1.14.0', rootRanges: { a: '^1.0.0' }, rootDepNames: ['a'] });
+  assert.equal(pruned.name, '@bongos/core');
   assert.equal(pruned.version, '1.14.0');
   assert.equal(pruned.lockfileVersion, 3);
   assert.equal(pruned.requires, true);
@@ -423,7 +477,7 @@ t('prunePackageLock: emits a self-consistent pruned lockfile (root ranges + only
 t('prunePackageLock: on the real repo lockfile, drops the vast majority of packages', () => {
   const realLock = require('../package-lock.json');
   const pruned = prunePackageLock(realLock, {
-    name: '@cloudbongos/core', version: '1.14.0', rootRanges: { express: '^4.21.2', pg: '^8.20.0' },
+    name: '@bongos/core', version: '1.14.0', rootRanges: { express: '^4.21.2', pg: '^8.20.0' },
   });
   const keptCount = Object.keys(pruned.packages).length - 1; // exclude the root '' entry
   const sourceCount = Object.keys(realLock.packages).length - 1;

package/tests/platform_boot.mjs

@@ -107,8 +107,11 @@ test('the apex host serves the landing page — not the game — on a game-less
   // it IS the landing, with the branding pack injected (look + identity from config)
   assert.match(res.body, /window\.__BRANDING__=/);
   assert.match(res.body, /Enter the Hall/);
-  // the platform-level create door (goal 35, task 2084) — gated by sign-in client-side
-  assert.match(res.body, /Create a project/);
+  // the per-project landing carries the top-right identity chip + hall entry
+  // (goal 35, task 2094). "Create a project" is an ORG-level action that lives
+  // only on the gate now — it must NOT appear on a project's own landing.
+  assert.match(res.body, /id="who"/);
+  assert.doesNotMatch(res.body, /Create a project/);
 });
 
 test('the apex host serves the branded /create page (goal 35, task 2081)', async () => {

package/tests/provision.mjs

@@ -46,6 +46,33 @@ t('dbCreateCmd / migrateCmd use the slug db + GDS-only migrate', () => {
   assert.match(P.migrateCmd(coTenant), /PGDATABASE=mercury MEDUSA_GDS_ONLY=1 \.\/scripts\/migrate\.sh/);
 });
 
+t('seedFirstVersionCmd: idempotent (only-if-empty) V1 seed against the slug db, track explicit, one criterion — the fix for the empty-versions bug (task 2119)', () => {
+  const cmd = P.seedFirstVersionCmd(coTenant);
+  // targets the instance's OWN db, matching createdb/migrate
+  assert.match(cmd, /psql .*-d mercury /, 'seeds the instance db');
+  assert.match(cmd, /ON_ERROR_STOP=1/, 'aborts on any error (atomic, no half-seed)');
+  // the version the greenfield init spec defines — ONE source of truth
+  const v = P.instanceInitSpec(coTenant).version;
+  assert.match(cmd, /INSERT INTO versions \(id, name, track, status, done_when\)/);
+  assert.match(cmd, new RegExp(`\\$v\\$${reEsc(v.id)}\\$v\\$`), 'seeds the spec version id (V1)');
+  assert.match(cmd, /\$v\$product\$v\$/, 'track is set EXPLICITLY (versions.track is NOT NULL, no default since mig 112)');
+  assert.match(cmd, /\$v\$building\$v\$/, 'status building, mirroring seedViaApi');
+  assert.ok(cmd.includes(v.done_when), 'carries the spec done_when verbatim (incl. the → arrows)');
+  // the IDEMPOTENT guard — only seeds when there is NO version yet, so it never disturbs an existing project
+  assert.match(cmd, /WHERE NOT EXISTS \(SELECT 1 FROM versions\)/, 'only-if-empty guard');
+  // one done-when criterion so /status has a finish line (matches seedViaApi's 'first-goal')
+  assert.match(cmd, /INSERT INTO done_when_criteria/);
+  assert.match(cmd, /\$v\$first-goal\$v\$/);
+  // dollar-quoted literals ⇒ the whole -c arg is single-quoted (safe inline / SSH / cloud-init)
+  assert.match(cmd, /-c '.*'/, 'the SQL is a single-quoted -c argument');
+  assert.doesNotMatch(cmd, /-c ".*"/, 'never double-quoted (would break cloud-init bash -lc "…")');
+});
+
+t('seedFirstVersionCmd: privileged runs psql as the postgres role; default is bare (peer auth) — mirrors createdb/migrate', () => {
+  assert.match(P.seedFirstVersionCmd(coTenant, { privileged: false }), /^psql /);
+  assert.match(P.seedFirstVersionCmd(coTenant, { privileged: true }), /^sudo -u postgres psql /);
+});
+
 t('serviceUnit binds the instance port + DB + per-instance env file, runs platform-server', () => {
   const u = P.serviceUnit(coTenant, { etcBase: '/etc' });
   assert.match(u, /Environment=PORT=3003/);
@@ -60,7 +87,7 @@ t('serviceUnit(standalone) runs the CORE PACKAGE server from the instance\'s OWN
   const u = P.serviceUnit(inst, { etcBase: '/etc' });
   const root = P.standaloneRoot(inst);
   assert.match(u, new RegExp('WorkingDirectory=' + reEsc(root)), 'runs from the instance\'s own repo dir');
-  assert.match(u, /ExecStart=\/usr\/bin\/node node_modules\/@cloudbongos\/core\/src\/platform-server\.js/, 'runs the pinned core package server');
+  assert.match(u, /ExecStart=\/usr\/bin\/node node_modules\/@bongos\/core\/src\/platform-server\.js/, 'runs the pinned core package server');
   assert.match(u, /Environment=PORT=3003/);
   assert.match(u, /EnvironmentFile=\/etc\/mercury\/web\.env/);
 });
@@ -70,7 +97,7 @@ t('standalone step generators: root under standaloneBase + pull / npm-ci / insta
   assert.match(P.standaloneRoot(inst), /\/mercury$/);
   assert.equal(P.standalonePullCmd(), 'git pull --ff-only origin main');
   assert.equal(P.standaloneInstallCmd(), 'npm ci --omit=dev');
-  assert.match(P.standaloneMigrateCmd(inst), /PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules\/@cloudbongos\/core\/scripts\/migrate\.sh/);
+  assert.match(P.standaloneMigrateCmd(inst), /PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules\/@bongos\/core\/scripts\/migrate\.sh/);
 });
 
 t('webEnvBody: OAuth creds use the LOADED pack\'s envPrefix (not the slug) + brand/port/db', () => {
@@ -98,6 +125,18 @@ t('webEnvBody: a domain writes the single-host origin overrides so the hall load
   assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_OAUTH_ORIGIN=${O}`));
 });
 
+t('webEnvBody: the repo target_ref seats the founding owner via <prefix>_FIRST_ADMIN (goal 35 / criterion 165)', () => {
+  // Regression (caught live on demo.cloudbongos.com, 2026-07-07): a provisioned instance
+  // MUST convey its founding owner, or src/bongos/auth.js maybeSeatFirstAdmin can never
+  // seat an Archon on first sign-in and the owner can't claim their own instance. Derived
+  // from the repo owner in target_ref — the SAME source instanceInitSpec uses for the
+  // scaffold's branding.firstAdmin, so the env override and config/branding.json agree.
+  const b = P.webEnvBody({ ...coTenant, hosting_shape: 'standalone', domain: 'mercury.example.com', target_ref: 'octocat/mercury' });
+  assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_FIRST_ADMIN=octocat`));
+  // No target_ref ⇒ the line is omitted (org-owned or unknown owner sets it by hand).
+  assert.doesNotMatch(P.webEnvBody(coTenant), /_FIRST_ADMIN=/);
+});
+
 t('caddyBlock: a domain → on-demand-TLS reverse_proxy to the local port; no domain → a comment', () => {
   const withDomain = P.caddyBlock({ ...coTenant, domain: 'mercury.example.com' });
   assert.match(withDomain, /mercury\.example\.com \{/);
@@ -142,11 +181,22 @@ t('healthzCmd hits the instance port /healthz', () => {
   assert.match(P.healthzCmd(coTenant), /127\.0\.0\.1:3003\/healthz/);
 });
 
-t('dedicatedUserData bakes createdb + migrate into cloud-init', () => {
+t('dedicatedUserData bakes createdb + migrate + first-version seed into cloud-init (task 2119: dedicated must not diverge)', () => {
   const ud = P.dedicatedUserData(coTenant);
   assert.match(ud, /^#cloud-config/);
   assert.match(ud, /createdb mercury/);
   assert.match(ud, /MEDUSA_GDS_ONLY=1/);
+  // the seed rides cloud-init too, so a dedicated droplet also comes up able to take tasks
+  assert.match(ud, /INSERT INTO versions/, 'seed baked into cloud-init');
+  // it must be its OWN runcmd line AFTER migrate (the schema must exist first)
+  const lines = ud.split('\n');
+  const iMig = lines.findIndex((l) => /migrate\.sh/.test(l));
+  const iSeed = lines.findIndex((l) => /INSERT INTO versions/.test(l));
+  assert.ok(iMig >= 0 && iSeed > iMig, 'seed line comes after the migrate line');
+  // the seed line is a valid bash -lc "…" item: single-quoted -c arg, NO double quotes to break the YAML scalar
+  const seedLine = lines[iSeed];
+  assert.match(seedLine, /- \[ bash, -lc, "psql .*" \]/, 'well-formed cloud-init runcmd item');
+  assert.doesNotMatch(seedLine.replace(/^.*-lc, "/, '').replace(/" \]$/, ''), /"/, 'the seed command carries no inner double quotes');
 });
 
 console.log('\nport allocation:');
@@ -215,12 +265,15 @@ await ta('provisionInstance(co-tenant) composes db → migrate → service → h
   const joined = cmds.join('\n');
   assert.match(joined, /createdb mercury/);
   assert.match(joined, /MEDUSA_GDS_ONLY=1/);
+  assert.match(joined, /INSERT INTO versions/, 'seeds the first version (task 2119)');
   assert.match(joined, /systemctl daemon-reload/);
   assert.match(joined, /systemctl enable --now mercury/);
   assert.match(joined, /healthz/);
-  // ordering: createdb before migrate before enable before healthz
+  // ordering: createdb before migrate before SEED before enable before healthz
   const idx = (re) => cmds.findIndex((c) => re.test(c));
   assert.ok(idx(/createdb/) < idx(/migrate\.sh/), 'createdb before migrate');
+  assert.ok(idx(/migrate\.sh/) < idx(/INSERT INTO versions/), 'migrate before the version seed (schema must exist)');
+  assert.ok(idx(/INSERT INTO versions/) < idx(/enable --now/), 'seed before service enable');
   assert.ok(idx(/migrate\.sh/) < idx(/enable --now/), 'migrate before service enable');
   assert.ok(idx(/enable --now/) < idx(/healthz/), 'service before healthz');
   // writes: the per-instance env file + the systemd unit
@@ -243,8 +296,9 @@ await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + n
   assert.match(joined, /git pull --ff-only origin main/, 'pulls the instance repo');
   assert.match(joined, /npm ci --omit=dev/, 'installs the pinned core');
   assert.match(joined, /createdb mercury/);
-  assert.match(joined, /node_modules\/@cloudbongos\/core\/scripts\/migrate\.sh/, 'migrates from the INSTANCE root\'s core');
+  assert.match(joined, /node_modules\/@bongos\/core\/scripts\/migrate\.sh/, 'migrates from the INSTANCE root\'s core');
   assert.ok(!cmds.some((c) => /\.\/scripts\/migrate\.sh/.test(c)), 'standalone does NOT use the control-plane checkout migrate');
+  assert.match(joined, /INSERT INTO versions/, 'standalone seeds its first version too (task 2119)');
   // ordering: clone → package-core → init → push → pull → npm ci → migrate → service
   const idx = (re) => cmds.findIndex((c) => re.test(c));
   assert.ok(idx(/git clone/) < idx(/package-core/), 'clone before tarball build');
@@ -253,6 +307,8 @@ await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + n
   assert.ok(idx(/push -u origin main/) < idx(/git pull/), 'scaffold push before the deploy pull');
   assert.ok(idx(/git pull/) < idx(/npm ci/), 'pull before npm ci');
   assert.ok(idx(/npm ci/) < idx(/migrate\.sh/), 'npm ci before migrate');
+  assert.ok(idx(/migrate\.sh/) < idx(/INSERT INTO versions/), 'migrate before the version seed');
+  assert.ok(idx(/INSERT INTO versions/) < idx(/enable --now/), 'seed before service enable');
   assert.ok(idx(/migrate\.sh/) < idx(/enable --now/), 'migrate before service enable');
   assert.ok(writes.some((w) => /\/mercury\.service$/.test(w)), 'wrote the (standalone) systemd unit');
 });
@@ -316,6 +372,47 @@ await ta('scaffoldStandaloneRepo: idempotent — a repo that already carries pac
   }
 });
 
+// ── ADR 0134 (task 2090): registry core-install path + fail-soft to vendored ──
+// Runs the scaffold against a FRESH standaloneBase (no package.json → it proceeds) with
+// an injected env, and asserts which core-resolution shape it chose from the commands.
+async function scaffoldWithEnv(env) {
+  const tmp = mkdtempSync(join(tmpdir(), 'scaffold-'));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = tmp;
+  try {
+    const { deps, cmds } = recorder({ apply: true });
+    await P.scaffoldStandaloneRepo(
+      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo' },
+      { ...deps, env },
+    );
+    return cmds.join('\n');
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+await ta('scaffoldStandaloneRepo: PROVISION_CORE_FROM_REGISTRY=1 + NPM_TOKEN → registry path (init --registry-core, no tarball build)', async () => {
+  const joined = await scaffoldWithEnv({ PROVISION_CORE_FROM_REGISTRY: '1', NPM_TOKEN: 'npm_readonly' });
+  assert.match(joined, /init\.js --from .* --dir .* --no-seed --force --registry-core/, 'materializes via --registry-core');
+  assert.ok(!/package-core\.js/.test(joined), 'does NOT build a core tarball on the registry path');
+  assert.ok(!/--vendor-core/.test(joined), 'does NOT vendor a tarball on the registry path');
+});
+
+await ta('scaffoldStandaloneRepo: registry requested but NO NPM_TOKEN → FAILS SOFT to the vendored tarball', async () => {
+  const joined = await scaffoldWithEnv({ PROVISION_CORE_FROM_REGISTRY: '1' });
+  assert.match(joined, /node scripts\/gds\/package-core\.js/, 'builds the core tarball (vendored fallback)');
+  assert.match(joined, /init\.js --from .* --dir .* --no-seed --force --vendor-core /, 'file:-pins the vendored tarball');
+  assert.ok(!/--registry-core/.test(joined), 'does NOT take the registry path without a token');
+});
+
+await ta('scaffoldStandaloneRepo: default (no registry env) stays on the vendored tarball path', async () => {
+  const joined = await scaffoldWithEnv({});
+  assert.match(joined, /node scripts\/gds\/package-core\.js/, 'vendored is the default');
+  assert.match(joined, /--vendor-core /);
+  assert.ok(!/--registry-core/.test(joined));
+});
+
 await ta('provisionInstance is idempotent: an already-active instance is a no-op', async () => {
   const { deps, cmds } = recorder();
   const r = await P.provisionInstance({ ...coTenant, status: 'active' }, deps);
@@ -323,10 +420,11 @@ await ta('provisionInstance is idempotent: an already-active instance is a no-op
   assert.equal(cmds.length, 0, 'no commands run for an active instance');
 });
 
-await ta('provisionInstance(dedicated) does NOT run local createdb/migrate (they ride cloud-init)', async () => {
+await ta('provisionInstance(dedicated) does NOT run local createdb/migrate/seed (they ride cloud-init)', async () => {
   const { deps, cmds } = recorder();
   await P.provisionInstance({ ...coTenant, hosting_shape: 'dedicated', tier: 's-2vcpu-4gb' }, deps);
   assert.ok(!cmds.some((c) => /createdb/.test(c)), 'dedicated does not run createdb locally');
+  assert.ok(!cmds.some((c) => /INSERT INTO versions/.test(c)), 'dedicated does not run the version seed locally (it rides cloud-init)');
 });
 
 console.log('\nDNS UPSERT composition (P4, CONFIG override):');
@@ -552,8 +650,8 @@ t('migrateCmd: privileged runs migrate as postgres via env+bash (survives sudo e
 
 t('standaloneMigrateCmd: privileged runs the instance-root migrate as postgres; default unchanged', () => {
   const inst = { ...coTenant, hosting_shape: 'standalone' };
-  assert.equal(P.standaloneMigrateCmd(inst), 'PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules/@cloudbongos/core/scripts/migrate.sh');
-  assert.equal(P.standaloneMigrateCmd(inst, { privileged: true }), 'sudo -u postgres env PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules/@cloudbongos/core/scripts/migrate.sh');
+  assert.equal(P.standaloneMigrateCmd(inst), 'PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules/@bongos/core/scripts/migrate.sh');
+  assert.equal(P.standaloneMigrateCmd(inst, { privileged: true }), 'sudo -u postgres env PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash node_modules/@bongos/core/scripts/migrate.sh');
 });
 
 t('makeWriteFile(privileged): a { sudo:true } write stages a temp file + `sudo install -D -m <mode>` (never writes /etc directly)', () => {
@@ -615,6 +713,7 @@ await ta('provisionInstance(co-tenant, privileged): createdb/migrate run as post
   const joined = cmds.join('\n');
   assert.match(joined, /sudo -u postgres createdb mercury/, 'createdb as postgres');
   assert.match(joined, /sudo -u postgres env PGDATABASE=mercury MEDUSA_GDS_ONLY=1 bash \.\/scripts\/migrate\.sh/, 'migrate as postgres');
+  assert.match(joined, /sudo -u postgres psql .*INSERT INTO versions/, 'first-version seed runs as postgres too (task 2119)');
   assert.match(joined, /sudo systemctl daemon-reload/, 'daemon-reload sudo-prefixed');
   assert.match(joined, /sudo systemctl enable --now mercury/, 'enable sudo-prefixed');
   assert.match(joined, /sudo systemctl reload caddy/, 'reload caddy sudo-prefixed');

package/tests/provisioning_github_app_routes.mjs

@@ -30,7 +30,7 @@ provisioning.attachManifestCode = async (_db, id, code) => ({ id, status: 'code_
 // A branding with a known publicOrigin so mothershipOrigin() resolves deterministically.
 const branding = require(`${ROOT}/src/branding.js`);
 const realBranding = branding.branding;
-branding.branding = () => ({ ...realBranding(), domains: { publicOrigin: 'https://cloudbongos.com' } });
+branding.branding = () => ({ ...realBranding(), identity: { ...(realBranding().identity || {}), productName: 'Cloud Bongos' }, domains: { publicOrigin: 'https://cloudbongos.com' } });
 
 // Inject the signed-in owner (the real requireBuilder needs a session).
 const api = require(`${ROOT}/src/module-api.js`);
@@ -66,15 +66,31 @@ console.log('POST /provisioning/instances/:id/github-app (mint the one-click lin
   t('post_url targets GitHub personal apps/new carrying the state', j.post_url === `https://github.com/settings/apps/new?state=${j.state}`, j.post_url);
   t('manifest.redirect_url is the MOTHERSHIP callback', j.manifest && j.manifest.redirect_url === 'https://cloudbongos.com/api/bongos/provisioning/github-app/callback', j.manifest && j.manifest.redirect_url);
   t('manifest.callback_urls are the INSTANCE sign-in (both prefixes)', j.manifest && j.manifest.callback_urls[0] === 'https://mercury.example.com/api/gds/auth/web/callback' && j.manifest.callback_urls[1] === 'https://mercury.example.com/api/bongos/auth/web/callback');
+  t('manifest.name is the instance domain (unique + matches the consent-screen redirect) within 34 chars', j.manifest && j.manifest.name === 'mercury.example.com' && j.manifest.name.length <= 34, j.manifest && j.manifest.name);
   t('org_url derived from the target_ref owner (acme)', j.org_url === `https://github.com/organizations/acme/settings/apps/new?state=${j.state}`, j.org_url);
   t('the attempt row was persisted with the minted state', !!(stored && stored.instanceId === 42 && stored.state === j.state && stored.requestedBy === 7));
 }
 
+console.log('\nprovisioningOrigin override (task 2101 — customer App carries the PLATFORM brand, not the game domain):');
+{
+  // A control plane that co-hosts a game (OTB = customer 0) has a GAME-branded publicOrigin.
+  // provisioningOrigin is the dedicated front door the customer's GitHub App must point at,
+  // so mothershipOrigin() must prefer it over publicOrigin. mothershipOrigin() calls
+  // api.branding() (module-api captured the fn ref at require-time), so override THAT.
+  const prevBranding = api.branding;
+  api.branding = () => ({ ...realBranding(), identity: { productName: 'Cloud Bongos' }, domains: { publicOrigin: 'https://amazonprimea.com', provisioningOrigin: 'https://get.cloudbongos.com' } });
+  const res = await fetch(`${base}/provisioning/instances/42/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });
+  const j = await res.json();
+  t('redirect_url uses provisioningOrigin, not the game publicOrigin', j.manifest && j.manifest.redirect_url === 'https://get.cloudbongos.com/api/bongos/provisioning/github-app/callback', j.manifest && j.manifest.redirect_url);
+  t('webhook hook_attributes.url also uses provisioningOrigin', j.manifest && j.manifest.hook_attributes && j.manifest.hook_attributes.url === 'https://get.cloudbongos.com/api/bongos/provisioning/github-app/webhook', j.manifest && j.manifest.hook_attributes && j.manifest.hook_attributes.url);
+  api.branding = prevBranding;
+}
+
 console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect):');
 {
   const res = await fetch(`${base}/provisioning/github-app/callback?code=GHCODE123&state=GOODSTATE`);
   const html = await res.text();
-  t('good state → 200 text/html finishing-setup page', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /GitHub App created/.test(html) && /no secret/i.test(html), `status=${res.status}`);
+  t('good state → 200 text/html progress page wired to auto-open', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /Setting up your instance/.test(html) && /Placing credentials/.test(html) && /__CB_SETUP__/.test(html) && html.includes('GOODSTATE'), `status=${res.status}`);
   t('the page names the instance host', /mercury\.example\.com/.test(html));
 }
 {
@@ -87,6 +103,32 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
   t('missing code/state → 400', res.status === 400, `status=${res.status}`);
 }
 
+console.log('\nGET /provisioning/github-app/status (the page poll → auto-open signal):');
+{
+  const res = await fetch(`${base}/provisioning/github-app/status?state=GOODSTATE`);
+  const j = await res.json();
+  t('pending → 200 ok, not ready, names the domain', res.status === 200 && j.ok === true && j.status === 'pending' && j.ready === false && j.domain === 'mercury.example.com', `status=${res.status} ${JSON.stringify(j)}`);
+}
+{
+  // Swap the stub to a placed-credentials ('done') attempt to prove ready flips true.
+  const prev = provisioning.getOAuthManifestByState;
+  provisioning.getOAuthManifestByState = async (_db, state) => (state === 'GOODSTATE'
+    ? { id: 99, instance_id: 42, requested_by: 7, status: 'done', expires_at: new Date(Date.now() + 600000).toISOString() }
+    : null);
+  const res = await fetch(`${base}/provisioning/github-app/status?state=GOODSTATE`);
+  const j = await res.json();
+  t("status 'done' → ready:true + terminal:true", res.status === 200 && j.ready === true && j.terminal === true, JSON.stringify(j));
+  provisioning.getOAuthManifestByState = prev;
+}
+{
+  const res = await fetch(`${base}/provisioning/github-app/status?state=NOPE`);
+  t('unknown state → 404 (no oracle)', res.status === 404, `status=${res.status}`);
+}
+{
+  const res = await fetch(`${base}/provisioning/github-app/status`);
+  t('missing state → 400', res.status === 400, `status=${res.status}`);
+}
+
 console.log('\nparseId contract (the (req,res) signature — a bad id is a clean 400, not a 500):');
 {
   const res = await fetch(`${base}/provisioning/instances/not-a-number/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });