@bongos/core 1.18.0 → 1.18.3

package/scripts/gds/provision.js

@@ -47,6 +47,7 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const cp = require('node:child_process');
+const crypto = require('node:crypto');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
@@ -180,7 +181,23 @@ function loadDeps() {
   const provisioning = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning'));
   // eslint-disable-next-line global-require
   const { DoApi } = require(path.join(REPO_ROOT, 'scripts/gds/do-api'));
-  _deps = { pool, provisioning, DoApi };
+  // Cross-site identity (ADR 0141 §4, task #1002109). Resolve the hub-side module by a
+  // VARIABLE key, gated on isModuleEnabled — the module-loader's own dynamic-dispatch
+  // pattern (the run-unit-tests.js precedent), NOT a static 'modules/platform-identity/'
+  // literal that would couple this publishable core file to an instance-EXCLUDED module
+  // (fitness Check 16b / task 2135). A vanilla core that neither ships nor enables the
+  // module never resolves it → no MODULE_NOT_FOUND on a fresh boot. Null here → federation
+  // dormant (shouldFederate skips) → the instance owns its auth, byte-identical to today.
+  let platformIdentity = null, hubKeys = null;
+  const PI_KEY = 'platform-identity';
+  let piEnabled = false;
+  try { piEnabled = require(path.join(REPO_ROOT, 'src/modules')).isModuleEnabled(PI_KEY); } catch { piEnabled = false; }
+  if (piEnabled) {
+    const piBase = path.join(REPO_ROOT, 'modules', PI_KEY);
+    try { platformIdentity = require(path.join(piBase, 'platform-identity')); hubKeys = require(path.join(piBase, 'hub-keys')); }
+    catch { platformIdentity = null; hubKeys = null; }
+  }
+  _deps = { pool, provisioning, DoApi, platformIdentity, hubKeys };
   return _deps;
 }
 
@@ -562,7 +579,7 @@ function provisionedEnvPrefix() {
 // the hall on this host + OAuth uses the real callback origin — without them the pack
 // stays at neutral localhost and the hall never loads (task 1972). No domain yet
 // (bring-your-own deferred, ADR 0111 §4) ⇒ origins stay neutral until one is set.
-function webEnvBody(inst, { clientId = '', clientSecret = '' } = {}) {
+function webEnvBody(inst, { clientId = '', clientSecret = '', federation = null } = {}) {
   const prefix = provisionedEnvPrefix();
   const origin = inst.domain ? `https://${inst.domain}` : '';
   const originLines = origin
@@ -583,7 +600,11 @@ ${prefix}_OAUTH_ORIGIN=${origin}
   // Manifest flow (placeManifestCreds fetches them control-plane-side + re-writes this
   // file with clientId/clientSecret set), or the manual oauth-secret.js placement. On
   // the first provision write they are blank placeholders the flow fills later.
-  const credComment = clientId || clientSecret
+  const credComment = federation
+    ? `# Provisioned by scripts/gds/provision.js (ADR 0111). This instance FEDERATES sign-in
+# through the Cloud Bongos hub (ADR 0141 §4) — it needs no GitHub app of its own, so the
+# GitHub client id/secret below stay blank; the ${prefix}_HUB_* block drives sign-in.`
+    : clientId || clientSecret
     ? `# Provisioned by scripts/gds/provision.js (ADR 0111). OAuth app creds placed via the
 # GitHub App Manifest flow (ADR 0133) — the owner clicked one link; no secret was pasted.`
     : `# Provisioned by scripts/gds/provision.js (ADR 0111). Fill the OAuth app creds via the
@@ -602,6 +623,20 @@ ${prefix}_OAUTH_ORIGIN=${origin}
   const firstAdminLine = ownerRepo && ownerRepo.owner
     ? `${prefix}_FIRST_ADMIN=${ownerRepo.owner}\n`
     : '';
+  // Cross-site identity federation block (ADR 0141 §4, task #1002109). Present only for
+  // a HOSTED (federated) instance: flips auth.idp ON via the env override branding.js
+  // reads (idpEnabled), and carries the hub origin, this instance's per-client secret
+  // (authenticates it TO the hub, server-to-server), and the hub's PUBLIC key (verifies
+  // the CLI's hub-signed assertion offline). All written straight to this chmod-600
+  // file — never through a browser or chat (the ADR 0133 secret-placement posture).
+  const fedLines = federation
+    ? `${prefix}_AUTH_IDP=true
+${prefix}_HUB_ORIGIN=${federation.hubOrigin}
+${prefix}_HUB_CLIENT_ID=${federation.clientId}
+${prefix}_HUB_CLIENT_SECRET=${federation.clientSecret}
+${prefix}_HUB_PUBLIC_KEY=${federation.hubPublicKey}
+`
+    : '';
   return `# /etc/${inst.slug}/web.env — per-instance secrets (chmod 600, OUTSIDE the repo).
 ${credComment}
 ${prefix}_GITHUB_CLIENT_ID=${clientId || ''}
@@ -609,12 +644,88 @@ ${prefix}_GITHUB_CLIENT_SECRET=${clientSecret || ''}
 ${firstAdminLine}GDS_BRANDING_FILE=${PROVISIONED_BRANDING_FILE}
 ${originLines}PORT=${inst.port}
 PGDATABASE=${dbName(inst)}
-`;
+${fedLines}`;
 }
 function webEnvPath(inst, { etcBase = CONFIG.etcBase } = {}) {
   return path.posix.join(etcBase, inst.slug, 'web.env');
 }
 
+// ── Cross-site identity: federate a hosted instance's sign-in through the hub ───
+// (ADR 0141 §4, task #1002109). The control plane IS the hub (cloudbongos.com), so
+// registration is a direct in-process call against the hub pool — no HTTP hop.
+
+// The hub's own public origin, written into each federated instance as
+// <PREFIX>_HUB_ORIGIN (what auth.js loadIdpConfig reads). Explicit PROVISION_HUB_ORIGIN
+// wins; otherwise the control plane's OWN public origin (<PREFIX>_PUBLIC_ORIGIN, the
+// env the hub already runs under). Null → not hub-configured → shouldFederate is false.
+function federationHubOrigin() {
+  const explicit = process.env.PROVISION_HUB_ORIGIN;
+  if (explicit) return String(explicit).replace(/\/+$/, '');
+  const own = process.env[`${provisionedEnvPrefix()}_PUBLIC_ORIGIN`];
+  return own ? String(own).replace(/\/+$/, '') : null;
+}
+
+// Whether provisioning should federate this instance's sign-in through the hub.
+// Dormant-by-default: true ONLY when the control plane is hub-configured (the
+// platform-identity module is present, a signing key is loadable, AND a hub origin
+// resolves), the instance is a CO-TENANT (the mothership-hosted shape whose web.env is
+// written locally — a `standalone` is owner-hosted and keeps its own GitHub app, the
+// self-hosted path; a `dedicated` droplet has no local web.env write yet, same gap the
+// ADR 0133 manifest flow leaves — see placeManifestCreds), and it has a public domain
+// (the origin the hub binds the CLI mint audience to — the #1002108 account-takeover
+// fix). Returns { federate, reason } so the caller can log WHY it skipped. PURE-ish
+// (reads env + the injected module handles; no DB, no I/O).
+function shouldFederate(inst, deps) {
+  const { platformIdentity, hubKeys } = deps;
+  if (!platformIdentity || !hubKeys) return { federate: false, reason: 'platform-identity module not present (control plane is not the hub)' };
+  if (!hubKeys.hubSigningConfigured()) return { federate: false, reason: 'hub signing key not configured (<PREFIX>_HUB_SIGNING_KEY unset)' };
+  if (!federationHubOrigin()) return { federate: false, reason: 'hub origin not resolvable (set PROVISION_HUB_ORIGIN or <PREFIX>_PUBLIC_ORIGIN)' };
+  if (inst.hosting_shape !== 'co-tenant') return { federate: false, reason: `${inst.hosting_shape} keeps its own GitHub app (not the co-tenant hosted path)` };
+  if (!inst.domain) return { federate: false, reason: 'no domain yet — federation needs the instance public origin' };
+  return { federate: true, reason: null };
+}
+
+// Register this hosted instance as an sso_clients row on the HUB (fresh per-client
+// secret) and return the federation block to bake into its web.env (ADR 0141 §4).
+// SECURITY: `origin` MUST be the instance's EXACT public origin — the hub binds the
+// CLI-federation mint audience to it (the #1002108 fix), so a mismatch would break
+// device sign-in (and a wrong origin would be a takeover vector). client_id is the
+// (unique, DNS-safe) slug, so a re-provision rotates the SAME row's secret via
+// registerClient's ON CONFLICT rather than orphaning a client. redirect_uri lists both
+// callback prefixes the core may emit (/api/gds is what auth.js builds today) so the
+// hub's exact-match allow-list accepts the browser leg. --apply gates the real hub
+// write; dry-run returns a placeholder block (so webEnvBody can still be composed) + logs.
+async function federateInstance(inst, deps) {
+  const { db, platformIdentity, hubKeys, log, apply } = deps;
+  const origin = `https://${inst.domain}`;
+  const clientId = inst.slug;
+  const hubOrigin = federationHubOrigin();
+  const hubPublicKey = hubKeys.hubPublicKeyB64();
+  if (!hubPublicKey) throw new Error('hub signing key is set but unreadable — cannot derive HUB_PUBLIC_KEY');
+  const redirectUris = [
+    `${origin}/api/gds/auth/web/callback`,
+    `${origin}/api/bongos/auth/web/callback`,
+  ];
+  if (!apply) {
+    log(`  [federate] would register client '${clientId}' on the hub (origin ${origin}) + write ${provisionedEnvPrefix()}_HUB_* + AUTH_IDP into web.env`);
+    return { hubOrigin, clientId, clientSecret: '0'.repeat(43), hubPublicKey };
+  }
+  const clientSecret = crypto.randomBytes(32).toString('base64url');
+  // Best-effort owner github_id — nice for the hub catalog's ownership link, but
+  // nullable in registerClient, so a lookup miss must never fail the provision.
+  let ownerGithubId = null;
+  try {
+    const { rows } = await db.query('SELECT github_id FROM builders WHERE id = $1', [inst.owner_builder_id]);
+    ownerGithubId = rows[0] ? rows[0].github_id : null;
+  } catch { /* non-fatal */ }
+  await platformIdentity.registerClient(
+    { clientId, secret: clientSecret, name: inst.slug, redirectUris, origin, ownerGithubId },
+    { pool: db },
+  );
+  log(`  [federate] registered client '${clientId}' on the hub (origin ${origin})`);
+  return { hubOrigin, clientId, clientSecret, hubPublicKey };
+}
+
 // The Cloudflare zone a hostname's A record lives in. Cloudflare zones are
 // registrable domains, which for the common case is the last two DNS labels
 // (mercury.example.com → example.com; apex example.com → example.com). Multi-part
@@ -925,6 +1036,28 @@ async function provisionInstance(inst, deps) {
   if (apply) await provisioning.setInstanceStatus(db, inst.id, 'provisioning');
   const patch = {};
 
+  // ── cross-site identity: register hub federation (ADR 0141 §4, task #1002109) ──
+  // Computed BEFORE the shape steps so the co-tenant web.env write (step 3) bakes it
+  // in — the instance comes up already federated, no post-hoc restart. Dormant unless
+  // the control plane is hub-configured AND the shape/domain qualify (shouldFederate);
+  // otherwise the instance owns its auth (direct GitHub), byte-identically to today.
+  let federation = null;
+  {
+    const fed = shouldFederate(inst, deps);
+    if (fed.federate) {
+      federation = await federateInstance(inst, deps);
+      log(`  [federate] ${inst.slug} → hub sign-in (auth.idp on) — no GitHub app of its own`);
+      if (apply) {
+        await provisioning.recordEvent(db, {
+          instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'federated',
+          detail: `sign-in federated to the hub (client ${inst.slug}, origin https://${inst.domain})`, actor: 'runner',
+        }).catch(() => {});
+      }
+    } else {
+      log(`  [federate] skipped (${fed.reason}) — instance owns its auth (direct GitHub)`);
+    }
+  }
+
   // ── step 1: server ───────────────────────────────────────────────────────
   // The A-record target for step 5's DNS UPSERT:
   //   • co-tenant  → PROVISION_PUBLIC_IP (the box it runs on — under remote-exec that
@@ -1022,7 +1155,7 @@ async function provisionInstance(inst, deps) {
 
   // ── step 3: config + per-instance secrets ─────────────────────────────────
   log('  [config] per-instance web.env');
-  if (local) boxWriteFile(webEnvPath(inst), webEnvBody(inst), { mode: 0o600, sudo: true });
+  if (local) boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation }), { mode: 0o600, sudo: true });
   else log('    (baked into cloud-init)');
 
   // ── step 4: systemd unit + enable ─────────────────────────────────────────
@@ -1476,8 +1609,8 @@ async function main() {
   const slug = args[1] && !args[1].startsWith('--') ? args[1] : null;
   if ((cmd === 'provision' || cmd === 'teardown') && !slug) { console.error(`${cmd} needs a <slug>`); process.exit(2); }
 
-  let pool, provisioning, DoApi;
-  try { ({ pool, provisioning, DoApi } = loadDeps()); }
+  let pool, provisioning, DoApi, platformIdentity, hubKeys;
+  try { ({ pool, provisioning, DoApi, platformIdentity, hubKeys } = loadDeps()); }
   catch (e) { console.error(`cannot load DB layer (run this on the control plane): ${e.message}`); process.exit(1); }
 
   // Box-target executor (remote over SSH when PROVISION_REMOTE_HOST is set, else
@@ -1492,6 +1625,9 @@ async function main() {
     writeFile: makeWriteFile({ apply, privileged: CONFIG.privileged, exec, remoteHost: CONFIG.remoteHost }),
     controlWriteFile: makeWriteFile({ apply, privileged: CONFIG.privileged, exec: controlExec }),
     doApi: DoApi ? new DoApi({ dryRun: !apply, token: CONFIG.doToken, log: (m) => console.log('    ' + m) }) : null,
+    // Cross-site identity (ADR 0141 §4). Null on a non-hub control plane → federation
+    // dormant; shouldFederate() then skips and the instance owns its auth (as today).
+    platformIdentity, hubKeys,
   };
 
   let result;
@@ -1527,4 +1663,6 @@ module.exports = {
   cmdRunIntents, cmdReconcile, cmdStatus,
   // GitHub App Manifest flow (task 2080, ADR 0133)
   convertManifestCode, placeManifestCreds, drainOAuthManifests, MANIFEST_UA,
+  // cross-site identity federation (ADR 0141 §4, task #1002109)
+  federationHubOrigin, shouldFederate, federateInstance,
 };

package/scripts/gds/publish-manifest.js

@@ -250,6 +250,21 @@ const INSTANCE_EXCLUDE = [
   'docs/design/container-exterior-tiles.md',
   'docs/design/container-interior.md',
   'docs/design/world-map-scroll.md',
+  // instance-HISTORY ADRs (task 1002219 / audit H5). These record THIS platform-family's own
+  // migration + identity history (the amazonprimea→cloudbongos lift, the standalone reprovision,
+  // the cloudbongos identity hub) — they are inherently full of the prior instance's name/owner and
+  // genericize to nothing (unlike a portable methodology ADR). docs/adr/ is allowlisted wholesale for
+  // the portable decision records; these three stay in this repo and never ship in the core, mirroring
+  // the instance-recipe / game-design carve-outs above. (The portable ADRs + the README index still publish.)
+  'docs/adr/0139-platform-history-migration-to-cloudbongos.md',
+  'docs/adr/0140-cloudbongos-standalone-reprovision.md',
+  'docs/adr/0141-cross-site-identity-federated-hub-idp.md',
+  // hall-preview FIXTURES (task 1002219 / audit H5) — the local hall-UI preview harness's sample
+  // data is a snapshot of THIS instance's builders/goals/tasks (owner login, world name, prior
+  // instance name), pure instance identity. The harness code stays portable; only the OTB data is
+  // carved out, so a consumer core never ships customer-zero's directory. (Fixtures remain in-repo
+  // for local dev — this only affects what package-core publishes.)
+  'scripts/hall-preview/fixtures/',
   'blockers/',
   'limitations/',
   'generative-ideas.md',

package/scripts/gds/run-unit-tests.js

@@ -31,6 +31,10 @@ const { isModuleEnabled } = require('../../src/modules');
 const TESTS_DIR = path.resolve(__dirname, '..', '..', 'tests');
 const MODULES_DIR = path.resolve(__dirname, '..', '..', 'modules');
 const PER_TEST_TIMEOUT_MS = 90_000;
+// Integration tests (package build + `npm install` + a spawned server) are far heavier than a
+// DB-free unit file, so the `--integration` gate (task 1002221 / audit H1) gives each one a much
+// longer budget than the 90s unit cap.
+const INTEGRATION_TIMEOUT_MS = 300_000;
 
 // Feature-module test sets (R59 / task 1198). A test that exercises a feature
 // MODULE runs only when this instance enables that module — a vanilla Cloud
@@ -128,31 +132,50 @@ function discoverModuleTests({ modulesDir = MODULES_DIR, isEnabled = isModuleEna
 }
 
 function main() {
+  // Two gates from one runner (task 1002221 / audit H1):
+  //   default        — the DB-free UNIT gate: every test file MINUS the integration set (+ known-
+  //                     failing / support / disabled-module). Fast, runs in a clean checkout / per PR.
+  //   --integration  — the standing INTEGRATION-SMOKE gate: ONLY the integration set (package build +
+  //                     `npm install` + live boot etc.). Heavier, longer per-test budget; run per
+  //                     release / on a schedule in an env that provides the services (DB/network). This
+  //                     is what promotes tests/consumer_layout_boot.mjs from "excluded + ad-hoc" to a
+  //                     first-class gate a release step can invoke with one command.
+  const integrationMode = process.argv.includes('--integration');
+  const perTestTimeout = integrationMode ? INTEGRATION_TIMEOUT_MS : PER_TEST_TIMEOUT_MS;
+
   const files = fs
     .readdirSync(TESTS_DIR)
     .filter((f) => f.endsWith('.mjs'))
     .map((f) => f.replace(/\.mjs$/, ''))
-    .filter((name) => !INTEGRATION.has(name) && !KNOWN_FAILING.has(name)
-      && !SUPPORT_MODULES.has(name) && !MODULE_DISABLED.has(name))
+    .filter((name) => integrationMode
+      ? (INTEGRATION.has(name) && !KNOWN_FAILING.has(name) && !SUPPORT_MODULES.has(name))
+      : (!INTEGRATION.has(name) && !KNOWN_FAILING.has(name) && !SUPPORT_MODULES.has(name) && !MODULE_DISABLED.has(name)))
     .sort();
 
-  const { included: moduleTests, skippedDisabled: moduleTestsSkipped } = discoverModuleTests();
-
-  const moduleNote = MODULE_DISABLED.size
-    ? ` + ${MODULE_DISABLED.size} disabled-module (${[...MODULE_DISABLED].sort().join(', ')})`
-    : '';
-  const modOwnedSkipNote = moduleTestsSkipped.length
-    ? ` + ${moduleTestsSkipped.length} module-owned test(s) skipped (module disabled: ${[...new Set(moduleTestsSkipped.map((t) => t.key))].sort().join(', ')})`
-    : '';
+  // Module-owned tests are DB-free unit tests — only the default gate runs them.
+  const { included: moduleTests, skippedDisabled: moduleTestsSkipped } = integrationMode
+    ? { included: [], skippedDisabled: [] }
+    : discoverModuleTests();
+
+  if (integrationMode) {
+    console.log(`run-unit-tests --integration: ${files.length} integration-smoke test file(s) (${files.join(', ') || 'none found'}); per-test budget ${INTEGRATION_TIMEOUT_MS / 1000}s`);
+  } else {
+    const moduleNote = MODULE_DISABLED.size
+      ? ` + ${MODULE_DISABLED.size} disabled-module (${[...MODULE_DISABLED].sort().join(', ')})`
+      : '';
+    const modOwnedSkipNote = moduleTestsSkipped.length
+      ? ` + ${moduleTestsSkipped.length} module-owned test(s) skipped (module disabled: ${[...new Set(moduleTestsSkipped.map((t) => t.key))].sort().join(', ')})`
+      : '';
+    console.log(`run-unit-tests: ${files.length + moduleTests.length} DB-free unit test file(s) (${files.length} core + ${moduleTests.length} module-owned; excluded ${INTEGRATION.size} integration + ${KNOWN_FAILING.size} known-failing${moduleNote}${modOwnedSkipNote})`);
+  }
   const total = files.length + moduleTests.length;
-  console.log(`run-unit-tests: ${total} DB-free unit test file(s) (${files.length} core + ${moduleTests.length} module-owned; excluded ${INTEGRATION.size} integration + ${KNOWN_FAILING.size} known-failing${moduleNote}${modOwnedSkipNote})`);
 
   const failures = [];
   const runOne = (displayName, filePath) => {
     try {
       execFileSync(process.execPath, [filePath], {
         stdio: ['ignore', 'ignore', 'pipe'],
-        timeout: PER_TEST_TIMEOUT_MS,
+        timeout: perTestTimeout,
         env: { ...process.env, NODE_ENV: 'test' },
       });
       console.log(`  ok    ${displayName}`);
@@ -168,12 +191,13 @@ function main() {
   for (const name of files) runOne(name, path.join(TESTS_DIR, `${name}.mjs`));
   for (const { key, name, file } of moduleTests) runOne(`${key}/${name}`, file);
 
+  const label = integrationMode ? 'run-unit-tests --integration' : 'run-unit-tests';
   console.log('');
   if (failures.length === 0) {
-    console.log(`run-unit-tests: all ${total} passed.`);
+    console.log(`${label}: all ${total} passed.`);
     process.exit(0);
   }
-  console.log(`run-unit-tests: ${failures.length} FAILED — ${failures.join(', ')}`);
+  console.log(`${label}: ${failures.length} FAILED — ${failures.join(', ')}`);
   process.exit(1);
 }
 

package/scripts/gds/setup.js

@@ -378,6 +378,47 @@ async function promptOnboardingConsent() {
     }
   }
 
+  // Federation (ADR 0141 §1, task #1002108): a HOSTED instance has no GitHub app of
+  // its own — it federates sign-in through the Cloud Bongos hub. If the instance
+  // manifest advertises auth.idp, run the hub device flow + assertion exchange via
+  // the shared login.js runDeviceFlow, then the SAME onboarding prompts. The direct
+  // GitHub device flow below (auth.idp unset) is untouched — the self-hosted default.
+  let idpCfg = null;
+  try {
+    const m = await fetch(`${API_BASE}/api/gds/instance`);
+    const mj = m.ok ? await m.json() : null;
+    idpCfg = (mj && mj.auth && mj.auth.idp) || null;
+  } catch (_) { /* manifest unreachable → fall through to the direct flow */ }
+  if (idpCfg) {
+    console.log('Signing in via the Cloud Bongos platform (hub)...');
+    const { runDeviceFlow } = require('./login');
+    const flow = await runDeviceFlow(API_BASE, { log: console.log, idp: idpCfg });
+    if (flow.state === 'not_approved') {
+      console.error('');
+      console.error('This GitHub account has not been approved yet.');
+      console.error('An Archon must approve your access request before you can enroll.');
+      console.error('  → Ask an Archon to invite you, then re-run /builder-setup.');
+      process.exit(1);
+    }
+    if (flow.state !== 'ok') {
+      console.error(`\nSign-in did not complete (${flow.state}). Re-run /builder-setup.`);
+      process.exit(1);
+    }
+    const { token, builder } = flow;
+    await saveSession({ token, builder, api_base: API_BASE });
+    console.log('');
+    console.log(`Authenticated as ${builder.github_login} (#${builder.id}). Session saved to ${SESSION_PATH}.`);
+    try {
+      const { activate } = require('./install-git-hooks');
+      activate();
+    } catch (_) { /* hook activation is best-effort */ }
+    await promptGeminiKey();
+    await promptAnthropicLink();
+    await promptDisciplines();
+    await promptOnboardingConsent();
+    process.exit(0);
+  }
+
   console.log('Starting GitHub Device Flow...');
   const start = await (await cliClient()).auth.postAuthDeviceStart();
   if (!start.ok) {

package/scripts/gds/ship.js

@@ -95,7 +95,11 @@ const { playSound } = (() => {
     return { playSound: () => {} };
   }
 })();
-const DROPLET = 'lars@104.236.254.243';
+// The laptop-mode SSH deploy target is resolved at land time from config/deploy.json
+// ("sshTarget") or <PREFIX>_DEPLOY_SSH_TARGET — see resolveDeployTarget(). There is NO
+// hardcoded default: the core carries no deploy target of its own. The founder
+// instance's old game-box SSH target used to be baked in here, which post-migration
+// meant a laptop-mode ship deployed to the WRONG server (task 1002202).
 const BEHIND_MAIN_LIMIT = 5;
 
 // arg() — the =-aware flag-value parser now lives in cli-lib (the canonical
@@ -762,9 +766,13 @@ function buildMergeArgv(branch, valueSummary) {
 // Two ways the confirmed→shipped land can run, chosen by a SINGLE committed
 // switch (config/deploy.json `mode`, env OTB_DEPLOY_MODE overrides):
 //
-//   'laptop' (default) — the operator's machine merges to main locally and
-//      SSHes `~/deploy.sh` on the droplet. Today's behavior, byte-for-byte.
-//      Requires the droplet SSH key, so only the operator can land.
+//   'laptop' (default) — the operator's machine merges to main locally and, IFF a
+//      deploy target is configured (config/deploy.json "sshTarget" or
+//      <PREFIX>_DEPLOY_SSH_TARGET, resolveDeployTarget()), SSHes `~/deploy.sh` on it.
+//      The core carries NO target of its own, so by default this is a merge-to-main
+//      with no SSH deploy — a change reaches a live instance via package-core +
+//      `bongos upgrade` (pin-bump), NOT an SSH deploy (ADR 0108). When a target IS
+//      set it requires that host's SSH key, so only the operator can land.
 //
 //   'ci' — NO builder box holds the prod key. ship pushes the branch, opens a
 //      PR, and enables GitHub auto-merge; once required checks pass, GitHub
@@ -815,12 +823,7 @@ function effectiveDeployMode(mode, { canPushLocally, envForced } = {}) {
 }
 
 function resolveDeployMode() {
-  let configRaw = null;
-  try {
-    configRaw = fs.readFileSync(path.join(REPO_ROOT, 'config', 'deploy.json'), 'utf8');
-  } catch (_) {
-    /* no config file → safe default */
-  }
+  const configRaw = readDeployConfigRaw();
   const mode = parseDeployMode(process.env.OTB_DEPLOY_MODE, configRaw);
   const envForced = ['ci', 'laptop'].includes(
     String(process.env.OTB_DEPLOY_MODE || '').trim().toLowerCase()
@@ -834,6 +837,63 @@ function resolveDeployMode() {
   return mode;
 }
 
+// readDeployConfigRaw — raw contents of config/deploy.json (or null if absent /
+// unreadable). One reader shared by resolveDeployMode (the mode switch) and
+// resolveDeployTarget (the SSH target) so they never diverge on where the file is.
+function readDeployConfigRaw() {
+  try {
+    return fs.readFileSync(path.join(REPO_ROOT, 'config', 'deploy.json'), 'utf8');
+  } catch (_) {
+    return null; // no config file → callers apply their safe default
+  }
+}
+
+// safeBranding — the instance brand pack, or null if it can't be read. Guarded the
+// same way ship.js guards the sound player (line ~91): a deploy must never crash
+// because the brand file is missing on a fresh / re-seeded checkout.
+function safeBranding() {
+  try {
+    return require('../../src/branding').branding();
+  } catch (_) {
+    return null;
+  }
+}
+
+// resolveDeployTarget — WHERE a laptop-mode ship SSHes `~/deploy.sh`, and which
+// /healthz it re-probes when deploy.sh's own health check races the restart window.
+// Pure (env + raw config + branding → target) and exported so the precedence and the
+// safe "no target" default are unit-tested without touching fs/env/network.
+//
+// There is deliberately NO hardcoded default. The founder instance's old game-box
+// SSH target was baked in here, so a laptop-mode ship from a migrated
+// checkout SSHed the WRONG server (task 1002202). The core carries no deploy target
+// of its own — under the standalone model a core change reaches a live instance via
+// package-core + `bongos upgrade` (pin-bump), not an SSH deploy (ADR 0108). An
+// instance whose OWN checkout is its live server opts back into laptop-SSH deploy by
+// setting the target:
+//   config/deploy.json  → { "sshTarget": "user@host", "healthzUrl": "https://…/healthz" }
+//   env                 → <PREFIX>_DEPLOY_SSH_TARGET, <PREFIX>_DEPLOY_HEALTHZ_URL
+// healthzUrl, when unset, falls back to the instance's own publicOrigin + /healthz
+// (never a hardcoded host); null when even that is unknown (re-probe then skipped).
+function resolveDeployTarget({ env = process.env, configRaw = null, branding = null } = {}) {
+  const ic = require('../../src/instance-config');
+  let cfg = {};
+  if (configRaw) {
+    try { cfg = JSON.parse(configRaw) || {}; } catch (_) { cfg = {}; }
+  }
+  const str = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null);
+
+  const sshTarget = ic.resolveEnv('DEPLOY_SSH_TARGET', { env }) || str(cfg.sshTarget) || null;
+
+  let healthzUrl = ic.resolveEnv('DEPLOY_HEALTHZ_URL', { env }) || str(cfg.healthzUrl) || null;
+  const publicOrigin = branding && branding.domains && branding.domains.publicOrigin;
+  if (!healthzUrl && str(publicOrigin)) {
+    try { healthzUrl = new URL('/healthz', publicOrigin).toString(); }
+    catch (_) { /* malformed origin → leave healthzUrl null */ }
+  }
+  return { sshTarget, healthzUrl };
+}
+
 // gh runners — mirror gitArgvOk/gitOk but for the GitHub CLI. No shell, ever:
 // branch names + DB-sourced value_summary reach `gh` as literal argv elements
 // (same injection discipline as #681). ghArgvOk = boolean side-effect; ghJson =
@@ -2129,26 +2189,48 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
       return false;
     }
 
-    console.log('  triggering deploy on droplet...');
-    // Quote ~/deploy.sh so the LOCAL shell doesn't tilde-expand it to
-    // /Users/<mac-user>/deploy.sh before ssh transmits the command. With
-    // the quotes, ssh sends the literal `~/deploy.sh` and the REMOTE shell
-    // expands it to /home/lars/deploy.sh. (Matches /merge-mode SKILL.md:81.)
-    if (!shellOk(`ssh -o ConnectTimeout=10 ${DROPLET} "~/deploy.sh"`)) {
-      // task 984 / idea 180: ~/deploy.sh's internal /healthz curl can race the
-      // service-restart window (Node not yet bound) and exit non-zero even though
-      // the deploy succeeded — which used to false-fail the ship and force a
-      // needless /merge-mode. Before concluding failure, re-probe the public
-      // /healthz with backoff (curl's own --retry; cross-platform, no sleep).
-      // --retry-all-errors retries connection-refused during the bind window;
-      // -f makes a non-200 an error so a 502/503 also retries. If it comes up
-      // within the window the deploy really succeeded; only then-still-down fails.
-      console.log('  auto-merge: ~/deploy.sh returned non-zero — re-probing /healthz with backoff before concluding...');
-      if (shellOk('curl -fsS --max-time 10 --retry 5 --retry-delay 3 --retry-all-errors https://amazonprimea.com/healthz -o /dev/null')) {
-        console.log('  auto-merge: /healthz 200 on re-probe — deploy actually succeeded (deploy.sh raced the restart window). Proceeding.');
-      } else {
-        console.log('  auto-merge: deploy failed (/healthz never returned 200 after retries); task stays at confirmed');
-        return false;
+    // Deploy step. The core carries NO deploy target of its own — under the
+    // standalone model a core change reaches a live instance via package-core +
+    // `bongos upgrade` (pin-bump), NOT an SSH deploy (ADR 0108). So unless an
+    // instance whose own checkout IS its live server has configured a target
+    // (config/deploy.json "sshTarget" or <PREFIX>_DEPLOY_SSH_TARGET), the land is
+    // complete at "merged + pushed to main" and the SSH deploy is skipped. (This
+    // used to SSH a hardcoded target — the founder instance's old game box, i.e. the
+    // WRONG server post-migration. task 1002202.)
+    const { sshTarget, healthzUrl } = resolveDeployTarget({
+      configRaw: readDeployConfigRaw(),
+      branding: safeBranding(),
+    });
+    if (!sshTarget) {
+      console.log('  merged + pushed to main. No deploy target configured, so no SSH deploy —');
+      console.log('  expected for the core. To publish to a live instance run the standalone release');
+      console.log('  flow: package-core → bongos upgrade (pin-bump), per ADR 0108. (Not an SSH deploy.)');
+    } else {
+      console.log(`  triggering deploy on ${sshTarget}...`);
+      // Quote ~/deploy.sh so the LOCAL shell doesn't tilde-expand it before ssh
+      // transmits the command; with the quotes ssh sends the literal `~/deploy.sh`
+      // and the REMOTE shell expands it. (Matches /merge-mode SKILL.md:81.)
+      if (!shellOk(`ssh -o ConnectTimeout=10 ${sshTarget} "~/deploy.sh"`)) {
+        // task 984 / idea 180: ~/deploy.sh's internal /healthz curl can race the
+        // service-restart window (Node not yet bound) and exit non-zero even though
+        // the deploy succeeded — which used to false-fail the ship and force a
+        // needless /merge-mode. Before concluding failure, re-probe the CONFIGURED
+        // /healthz with backoff (curl's own --retry; cross-platform, no sleep) —
+        // never a hardcoded host. --retry-all-errors retries connection-refused
+        // during the bind window; -f makes a non-200 an error so a 502/503 also
+        // retries. If it comes up within the window the deploy really succeeded.
+        if (healthzUrl) {
+          console.log('  auto-merge: ~/deploy.sh returned non-zero — re-probing /healthz with backoff before concluding...');
+          if (shellOk(`curl -fsS --max-time 10 --retry 5 --retry-delay 3 --retry-all-errors ${JSON.stringify(healthzUrl)} -o /dev/null`)) {
+            console.log('  auto-merge: /healthz 200 on re-probe — deploy actually succeeded (deploy.sh raced the restart window). Proceeding.');
+          } else {
+            console.log('  auto-merge: deploy failed (/healthz never returned 200 after retries); task stays at confirmed');
+            return false;
+          }
+        } else {
+          console.log('  auto-merge: ~/deploy.sh returned non-zero and no healthzUrl configured to re-probe; task stays at confirmed');
+          return false;
+        }
       }
     }
 
@@ -3548,7 +3630,9 @@ module.exports = {
   gitArgvOk, buildMergeArgv, sanitizeGitHubRefs,
   // #679 / ADR 0042: CI deploy mode — pure helpers exported for the regression
   // test (mode precedence/safe-default, no-shell PR argv, deploy-run match).
-  parseDeployMode, buildPrCreateArgv, buildPrMergeArgv, deployRunSucceeded,
+  // task 1002202: resolveDeployTarget — SSH target / healthz precedence + the safe
+  // "no target" default (the core has none), exported for the same reason.
+  parseDeployMode, resolveDeployTarget, buildPrCreateArgv, buildPrMergeArgv, deployRunSucceeded,
   // task 1049 (B): pure CI-land outcome classifier — a timed-out-but-armed PR is
   // 'pending' (success), not failure. Exported so the semantics are unit-tested.
   classifyLandOutcome,