@bongos/core 1.18.18 → 1.19.2

package/modules/lifecycle/routes/versions.js

@@ -11,6 +11,11 @@ const { asyncHandler, validateOrRespond } = api;
 // 'building'; 'shipped'/'frozen' are end states reached via the close flow.
 const VALID_VERSION_STATUSES = new Set(['planning', 'building', 'shipped', 'frozen']);
 
+// versions.track CHECK (migration 003) — NOT NULL with no DB default, so the
+// create path must always supply one. 'product' is the caller-facing default:
+// an instance seeding its first version is seeding its product track.
+const VALID_VERSION_TRACKS = new Set(['product', 'internal']);
+
 module.exports = function buildVersionsRouter() {
   const router = express.Router();
 
@@ -62,11 +67,12 @@ module.exports = function buildVersionsRouter() {
   // no hand-written seed-*.js script. Archon-only: creating a version is a
   // plan/scope mutation, same gate as POST /tasks (ADR 0016).
   // rank: archon — creates a version + its done-when criteria.
-  router.post('/versions', auth.requireBuilder, auth.requireRank('archon'), asyncHandler('POST /versions', async (req, res) => {
+  router.post('/versions', auth.requireBuilder, auth.requirePermission('version.create'), asyncHandler('POST /versions', async (req, res) => {
     if (validateOrRespond(req, res, {
       id: { required: true, type: 'string', maxLength: 64, minLength: 1 },
       name: { required: true, type: 'string', maxLength: 200, minLength: 1 },
       status: { type: 'string', maxLength: 32 },
+      track: { type: 'string', maxLength: 16 },
       done_when: { type: 'string', maxLength: 8000 },
       scope_doc_path: { type: 'string', maxLength: 256 },
       criteria: { type: 'array', maxItems: 100 },
@@ -81,6 +87,11 @@ module.exports = function buildVersionsRouter() {
       return res.fail('bad_status', 400, { valid: Array.from(VALID_VERSION_STATUSES) });
     }
 
+    const track = body.track || 'product';
+    if (!VALID_VERSION_TRACKS.has(track)) {
+      return res.fail('bad_track', 400, { valid: Array.from(VALID_VERSION_TRACKS) });
+    }
+
     if (await db.getVersion(id)) {
       return res.fail('version_exists', { status: 409, message: `Version '${id}' already exists.` });
     }
@@ -104,7 +115,7 @@ module.exports = function buildVersionsRouter() {
     let version, created;
     try {
       ({ version, criteria: created } = await db.createVersion({
-        id, name, status,
+        id, name, status, track,
         doneWhen: body.done_when ?? null,
         scopeDocPath: body.scope_doc_path ?? null,
         criteria,

package/modules/lifecycle/ship-card.js

@@ -195,7 +195,21 @@ function safeBrand() {
 // Stage-specific field selection lives HERE; the renderers are generic.
 function buildCardModel(input = {}) {
   const stage = input.stage || stageFor(input.postGradeStatus);
-  const cfg = STAGES[stage] || STAGES.failed;
+  const baseCfg = STAGES[stage] || STAGES.failed;
+  // task 1002541: did the land actually bail? `input.land` is the ship chain's
+  // outcome ({ ok, pending, reason, nextStep }). A task sits at 'confirmed' both
+  // when it IS landing on its own (pending — CI/the reconciler will finish it)
+  // and when the merge gave up. Only the second is a lie worth shouting about,
+  // so this needs an explicit reason — never a bare "not ok".
+  // ABSENT `land` (every pre-existing caller, and breadcrumbs written by older
+  // versions) ⇒ false ⇒ the card renders exactly as it did before.
+  const land = input.land || null;
+  const landBailed = !!(stage === 'confirmed' && land && land.ok === false && !land.pending && land.reason);
+  // A bailed land is not "confirmed — landing". Recolor the banner to match the
+  // truth; the underlying STAGES entry is left untouched (it's frozen + shared).
+  const cfg = landBailed
+    ? { ...baseCfg, tone: 'warning', icon: 'ti-alert-triangle', statusWord: 'Not landed', headline: (id) => `Task #${id} confirmed — NOT landed` }
+    : baseCfg;
   const brand = input.brand || safeBrand();
   const taskId = input.taskId;
   const grade = input.grade || {};
@@ -285,11 +299,20 @@ function buildCardModel(input = {}) {
       deployCommit = input.deploy && input.deploy.commit ? String(input.deploy.commit) : null;
       deployText = deployCommit ? `live · ${deployCommit}` : 'live';
     } else if (stage === 'confirmed') {
-      // The server lands confirmed tasks automatically (publish-reconciler +
-      // merge driver + ADR 0082 resolver); /merge-mode is a rare manual
-      // fallback, kept as the card's optional 'Land it' override — so the fact
-      // states the automatic reality rather than implying a required command.
-      deployText = 'landing automatically';
+      // task 1002541: this line used to be unconditional, driven by the STATUS
+      // alone — so a merge that bailed still reported "landing automatically".
+      // Nothing was landing, no PR existed, and under ADR 0120 (pay on land) the
+      // builder was unpaid: the failure announced itself as success, which is
+      // why these strands survived for days. Say what actually happened.
+      if (landBailed) {
+        deployText = `NOT landed — ${land.reason}`;
+      } else {
+        // The server lands confirmed tasks automatically (publish-reconciler +
+        // merge driver + ADR 0082 resolver); /merge-mode is a rare manual
+        // fallback, kept as the card's optional 'Land it' override — so the fact
+        // states the automatic reality rather than implying a required command.
+        deployText = 'landing automatically';
+      }
     } else {
       deployText = 'not deployed';
     }
@@ -300,12 +323,20 @@ function buildCardModel(input = {}) {
     addFact('', changed);
     if (gradeText) addFact('grade', gradeText, { cls: gradeCls });
     if (stage === 'shipped') addFact('live', deployCommit, { mono: true });
+    // The reason can be a full sentence — too long for a fact chip, so the chip
+    // carries the alarm and the reason rides in its tooltip (the Deploy row above
+    // always shows it in full).
+    else if (landBailed) addFact('', 'NOT landed', { cls: 'cc-bad', title: land.reason });
     else addFact('', deployText);
     addFact('', usageText, usageTitle ? { title: usageTitle } : {});
     if (creditsText) addFact('', creditsText);
   }
 
-  const action = nextActionFor(stage, { taskId, discipline: input.discipline, sandboxUrl: input.sandboxUrl });
+  // task 1002541: a bail knows the precise recovery command (re-run the ship,
+  // re-auth, pass --db-only…), which beats the stage's generic '/merge-mode'.
+  const action = (landBailed && land.nextStep)
+    ? { kind: 'prompt', label: 'Land it', cmd: land.nextStep }
+    : nextActionFor(stage, { taskId, discipline: input.discipline, sandboxUrl: input.sandboxUrl });
 
   return {
     stage, cfg, brand, taskId,

package/modules/memory/routes/memory.js

@@ -556,7 +556,7 @@ module.exports = function buildMemoryRouter() {
   router.get(
     '/memory/builders/:builderId/files',
     auth.requireBuilder,
-    auth.requireRank('archon'),
+    auth.requirePermission('memory.read.any'),
     readRateLimit,
     async (req, res) => {
       const targetId = Number(req.params.builderId);
@@ -607,7 +607,7 @@ module.exports = function buildMemoryRouter() {
   router.get(
     '/memory/builders/:builderId/file',
     auth.requireBuilder,
-    auth.requireRank('archon'),
+    auth.requirePermission('memory.read.any'),
     readRateLimit,
     async (req, res) => {
       const targetId = Number(req.params.builderId);

package/modules/onboarding/routes/access-requests.js

@@ -26,7 +26,7 @@ const express = require('express');
 // core file a module may require, ADR 0083); approval-broadcast travels WITH this
 // admission route (its sole consumer) and is an intra-module require.
 const api = require('../../../src/module-api');
-const auth = { requireBuilder: api.requireBuilder, requireRank: api.requireRank };
+const auth = { requireBuilder: api.requireBuilder, requirePermission: api.requirePermission };
 const { pool } = api;
 const { validateOrRespond, parseId } = api;
 const approvalBroadcast = require('../approval-broadcast');
@@ -145,7 +145,7 @@ module.exports = function buildAccessRequestsRouter() {
   // GET /access-requests?status=pending — Archon queue. Defaults to pending;
   // pass ?status=invited|dismissed for the resolved history.
   // rank: archon — the queue exposes would-be builders' usernames.
-  router.get('/access-requests', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.get('/access-requests', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
     const status = req.query.status || 'pending';
     if (!['pending', 'invited', 'dismissed'].includes(status)) {
       return res.fail('bad_status', 400);
@@ -174,7 +174,7 @@ module.exports = function buildAccessRequestsRouter() {
   // (the only sign-in gate — no repo access needed); 'dismissed' = declined /
   // spam / dup. The row stays as the audit trail either way.
   // rank: archon — same gate as the rest of the roster management surface.
-  router.patch('/access-requests/:id', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.patch('/access-requests/:id', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_request_id' });
     if (id === null) return;
     if (validateOrRespond(req, res, {

package/modules/platform-identity/routes/projects.js

@@ -14,13 +14,17 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 
-const { pool, requireBuilder, requireRank, validateOrRespond, parseId, corsPublicGet } = api;
+const { pool, requireBuilder, requirePermission, validateOrRespond, parseId, corsPublicGet } = api;
 
 module.exports = function projectsRoutes() {
   const router = express.Router();
 
-  // rank: archon — the full curation list (includes unfeatured + owner attribution).
-  router.get('/projects', requireBuilder, requireRank('archon'), async (_req, res) => {
+  // rank: metic+archon — the full curation list (includes unfeatured + owner attribution).
+  // BV1.R105 left this on requireRank because `project.curate` was declared over the
+  // writes + GET /scouting, not over this read. ADR 0157 extends that atom's guards to
+  // name GET /projects and lowers its floor archon→metic, so the mapping now exists and
+  // the audience is the working rank.
+  router.get('/projects', requireBuilder, requirePermission('project.curate'), async (_req, res) => {
     try {
       res.json({ projects: await pi.listAllProjects({ pool }) });
     } catch (err) {
@@ -31,7 +35,7 @@ module.exports = function projectsRoutes() {
 
   // rank: archon — create / update a catalog entry (manual seed for hand-wired
   // instances; federated projects auto-catalogue at registration).
-  router.post('/projects', requireBuilder, requireRank('archon'), async (req, res) => {
+  router.post('/projects', requireBuilder, requirePermission('project.curate'), async (req, res) => {
     if (validateOrRespond(req, res, {
       origin: { required: true, type: 'string', maxLength: 512 },
       name: { required: true, type: 'string', maxLength: 200 },
@@ -57,7 +61,7 @@ module.exports = function projectsRoutes() {
   // by github_login and requires the invitee to already have a platform account (they
   // build on some project); inviting someone entirely new to the platform (GitHub-id
   // resolution) is a follow-up.
-  router.post('/projects/invite', requireBuilder, requireRank('archon'), async (req, res) => {
+  router.post('/projects/invite', requireBuilder, requirePermission('project.curate'), async (req, res) => {
     if (validateOrRespond(req, res, {
       client_id: { required: true, type: 'string', maxLength: 200 },
       github_login: { required: true, type: 'string', maxLength: 200 },
@@ -76,7 +80,7 @@ module.exports = function projectsRoutes() {
   });
 
   // rank: archon — the feature / unfeature control (the ADR 0141 §5 curation gate).
-  router.patch('/projects/:id/featured', requireBuilder, requireRank('archon'), async (req, res) => {
+  router.patch('/projects/:id/featured', requireBuilder, requirePermission('project.curate'), async (req, res) => {
     const id = parseId(req, res, { code: 'bad_project_id', positiveInt: true });
     if (id === null) return;
     if (validateOrRespond(req, res, { featured: { required: true, type: 'boolean' } })) return;

package/modules/platform-identity/routes/scouting.js

@@ -12,7 +12,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 
-const { pool, requireBuilder, requireRank, parsePagination } = api;
+const { pool, requireBuilder, requirePermission, parsePagination } = api;
 
 module.exports = function scoutingRoutes() {
   const router = express.Router();
@@ -20,7 +20,7 @@ module.exports = function scoutingRoutes() {
   // rank: archon — the internal talent directory across every project. The Archon
   // gate here is the load-bearing protection ("NOT shown to builders"): a non-Archon
   // is 403'd before any cross-builder data is read.
-  router.get('/scouting', requireBuilder, requireRank('archon'), async (req, res) => {
+  router.get('/scouting', requireBuilder, requirePermission('project.curate'), async (req, res) => {
     const { limit } = parsePagination(req, { defaultLimit: 100, maxLimit: 500 });
     try {
       const builders = await pi.listScoutingRollup({ limit, pool });

package/modules/provisioning/migrations/provisioning_004_onboard_mode.sql

@@ -0,0 +1,30 @@
+-- provisioning_004_onboard_mode.sql — record HOW an instance was onboarded:
+-- greenfield (a fresh empty repo) vs adopt (layer onto a repo the owner already has).
+-- ADR 0121 / task 1002562, BONGOS-V1 goal 32.
+--
+-- WHY THIS COLUMN EXISTS. `bongos init --adopt` (ADR 0121, tasks 2042-2046) built the
+-- LOCAL half of brownfield onboarding, and `GET /provisioning/onboard-plan?mode=…`
+-- branches the checklist TEXT the user is shown — but the mode was never PERSISTED, so
+-- the control-plane runner had no way to know. scripts/gds/provision.js therefore ran
+-- the greenfield scaffold unconditionally: `git init` a fresh tree, commit, and push
+-- `HEAD:main`. Against a repo that already has history that is an unrelated-history
+-- non-fast-forward and git rejects it, so adopting an existing repo could never
+-- succeed. This column is what lets the runner take the layering path instead.
+--
+-- DEFAULT 'greenfield' is the correct backfill: every instance provisioned before this
+-- migration went through the greenfield scaffold by construction (there was no other
+-- path), so no existing row is mislabelled.
+--
+-- Widening/adding is ADDITIVE — a new nullable-with-default column plus a CHECK that
+-- only constrains the new column. No existing row changes and no data is lost, so this
+-- is safe under the module-owned-migration rule (ADR 0083 §Decision #5). Idempotent:
+-- safe to re-run.
+ALTER TABLE provisioning_instances
+  ADD COLUMN IF NOT EXISTS onboard_mode text NOT NULL DEFAULT 'greenfield';
+
+ALTER TABLE provisioning_instances DROP CONSTRAINT IF EXISTS provisioning_instances_onboard_mode_check;
+ALTER TABLE provisioning_instances ADD CONSTRAINT provisioning_instances_onboard_mode_check
+  CHECK (onboard_mode IN ('greenfield', 'adopt'));
+
+INSERT INTO schema_migrations (version) VALUES ('provisioning_004_onboard_mode')
+  ON CONFLICT (version) DO NOTHING;

package/modules/provisioning/provisioning.js

@@ -21,6 +21,14 @@ const INSTANCE_STATES = ['requested', 'provisioning', 'active', 'tearing_down',
 // standalone — its OWN repo checkout + pinned @cloudbongos/core npm dep, co-located on
 //              the box (ADR 0108 destination model; owner-hosted, $0). See provision.js.
 const HOSTING_SHAPES = ['co-tenant', 'dedicated', 'standalone'];
+// How the instance's repo was onboarded (migration provisioning_004, ADR 0121):
+//   greenfield — a fresh EMPTY repo; the runner scaffolds it and pushes the first commit
+//   adopt      — a repo the owner ALREADY has; the runner must LAYER onto it, preserving
+//                its history and never overwriting a pre-existing file
+// Load-bearing, not cosmetic: the runner's scaffold branches on it. Before this existed
+// provision.js ran the greenfield path unconditionally and adopting an existing repo
+// always failed as an unrelated-history non-fast-forward (task 1002562).
+const ONBOARD_MODES = ['greenfield', 'adopt'];
 // 'oauth-manifest' (task 2080) is queueable too — the GitHub-App-Manifest onboarding
 // conversion. Today the runner drains it by scanning provisioning_oauth_manifests
 // (drainOAuthManifests), not the intent queue, but it stays a valid action so the
@@ -119,6 +127,11 @@ function publicInstance(row) {
     port: row.port,
     tier: row.tier,
     target_ref: row.target_ref,
+    // Surfaced so a reader can tell WHICH scaffold path a row took — the difference
+    // between "we created this repo" and "we layered onto the owner's" is the first
+    // thing you need when diagnosing a standup (task 1002562). Coalesced for rows read
+    // before provisioning_004 added the column.
+    onboard_mode: row.onboard_mode || 'greenfield',
     cost_estimate_usd: Number(row.cost_estimate_usd || 0),
     error_note: row.error_note || null,
     created_at: row.created_at,
@@ -268,17 +281,22 @@ async function listAllInstances(db, { status } = {}) {
 // re-fetches the existing row and returns { created:false } so the ROUTE can
 // decide (same owner → idempotent re-request; different owner → 409). Never
 // silently reassigns ownership.
-async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShape, domain, dbName, port, tier }) {
+async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShape, domain, dbName, port, tier, onboardMode }) {
   const shape = HOSTING_SHAPES.includes(hostingShape) ? hostingShape : 'co-tenant';
+  // Unknown/absent → 'greenfield', matching the column default. Falling back to the
+  // SAFE mode matters: greenfield refuses to push over existing history (no --force
+  // anywhere), whereas defaulting an unknown value to 'adopt' would put the layering
+  // path on a repo nobody said was pre-existing.
+  const mode = ONBOARD_MODES.includes(onboardMode) ? onboardMode : 'greenfield';
   const cost = costEstimateUsd({ hostingShape: shape, tier });
   try {
     const { rows } = await db.query(
       `INSERT INTO provisioning_instances
-         (owner_builder_id, slug, target_ref, hosting_shape, domain, db_name, port, tier, cost_estimate_usd)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+         (owner_builder_id, slug, target_ref, hosting_shape, domain, db_name, port, tier, cost_estimate_usd, onboard_mode)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
        RETURNING *`,
       [ownerBuilderId, slug, targetRef ?? null, shape, domain ?? null,
-       dbName ?? null, port ?? null, tier ?? null, cost]
+       dbName ?? null, port ?? null, tier ?? null, cost, mode]
     );
     return { instance: rows[0], created: true };
   } catch (e) {
@@ -521,8 +539,8 @@ async function costLedger(db, { limit = 500 } = {}) {
 
 module.exports = {
   // constants
-  INSTANCE_STATES, HOSTING_SHAPES, INTENT_ACTIONS, TEARDOWN_FROM, TIER_MONTHLY_USD,
-  CERT_ELIGIBLE_STATES,
+  INSTANCE_STATES, HOSTING_SHAPES, ONBOARD_MODES, INTENT_ACTIONS, TEARDOWN_FROM,
+  TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
   // pure
   isValidSlug, costEstimateUsd, publicInstance, normalizeHostname,
   // pure — GitHub App Manifest flow (task 2080)

package/modules/provisioning/routes/provisioning.js

@@ -231,7 +231,7 @@ module.exports = function provisioningRoutes() {
 
   // GET /provisioning/fleet — the full instance roster across all owners.
   // rank: archon (exposes every owner's instance + cost; the /boxes precedent).
-  router.get('/provisioning/fleet', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.get('/provisioning/fleet', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     try {
       const status = req.query.status || undefined;
       const rows = await provisioning.listAllInstances(pool, { status });
@@ -245,7 +245,7 @@ module.exports = function provisioningRoutes() {
   // GET /provisioning/fleet/cost-ledger — per-instance monthly estimate + total.
   // rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent).
   // Declared among the archon routes (archon-first) for correct auditor classification.
-  router.get('/provisioning/fleet/cost-ledger', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.get('/provisioning/fleet/cost-ledger', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     try {
       // R14 (#2001 / ADR 0119): shared helper; per-endpoint cap preserved (default 500, max 2000).
       const { limit } = api.parsePagination(req, { defaultLimit: 500, maxLimit: 2000 });
@@ -262,7 +262,7 @@ module.exports = function provisioningRoutes() {
   // ENQUEUES a 'teardown' intent for the control-plane runner; the web tier never
   // holds cloud tokens. rank: archon (acts on another owner's infrastructure).
   // Declared among the archon routes (archon-first).
-  router.post('/provisioning/instances/:id/force-teardown', auth.requireBuilder, auth.requireRank('archon'), async (req, res) => {
+  router.post('/provisioning/instances/:id/force-teardown', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     try {
@@ -292,7 +292,13 @@ module.exports = function provisioningRoutes() {
   // the runner (task P3) does the real standup. Idempotent on slug for the SAME
   // owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409.
   // Body: { slug (required), target_ref?, hosting_shape? (co-tenant|dedicated),
-  //         domain?, tier? }.
+  //         domain?, tier?, onboard_mode? (greenfield|adopt) }.
+  //
+  // onboard_mode is LOAD-BEARING, not a label (task 1002562): the control-plane runner
+  // branches its repo scaffold on it. 'adopt' means target_ref is a repo the owner
+  // ALREADY has, so the runner must clone + layer onto its history instead of pushing a
+  // fresh tree at `main` (which an existing repo rejects as unrelated history). Absent →
+  // 'greenfield', the safe default.
   router.post('/provisioning/instances', auth.requireBuilder, async (req, res) => {
     if (validateOrRespond(req, res, {
       slug: { required: true, type: 'string', maxLength: 40 },
@@ -300,6 +306,7 @@ module.exports = function provisioningRoutes() {
       hosting_shape: { type: 'string', maxLength: 20 },
       domain: { type: 'string', maxLength: 253 },
       tier: { type: 'string', maxLength: 40 },
+      onboard_mode: { type: 'string', maxLength: 20 },
     })) return;
     const body = req.body || {};
     const slug = String(body.slug || '').trim().toLowerCase();
@@ -310,11 +317,22 @@ module.exports = function provisioningRoutes() {
     if (!provisioning.HOSTING_SHAPES.includes(shape)) {
       return res.fail('bad_hosting_shape', 400, { valid: provisioning.HOSTING_SHAPES });
     }
+    const onboardMode = body.onboard_mode || 'greenfield';
+    if (!provisioning.ONBOARD_MODES.includes(onboardMode)) {
+      return res.fail('bad_onboard_mode', 400, { valid: provisioning.ONBOARD_MODES });
+    }
+    // Adopting is meaningless without knowing WHICH repo to layer onto, and the runner
+    // would fall back to greenfield behavior — so refuse here rather than mislabel the row.
+    if (onboardMode === 'adopt' && !String(body.target_ref || '').trim()) {
+      return res.fail('target_ref_required_for_adopt', 400, {
+        reason: 'adopt layers onto an existing repo, so target_ref (owner/repo) is required',
+      });
+    }
     try {
       const { instance, created } = await provisioning.createInstance(pool, {
         ownerBuilderId: req.builder.id, slug,
         targetRef: body.target_ref, hostingShape: shape,
-        domain: body.domain, tier: body.tier,
+        domain: body.domain, tier: body.tier, onboardMode,
       });
       // Slug already taken by ANOTHER builder — refuse (never reassign ownership).
       if (!created && String(instance.owner_builder_id) !== String(req.builder.id)) {
@@ -325,7 +343,7 @@ module.exports = function provisioningRoutes() {
       if (created) {
         await provisioning.recordEvent(pool, {
           instanceId: instance.id, ownerBuilderId: req.builder.id, event: 'request',
-          detail: `provision requested (shape=${shape}${body.domain ? `, domain=${body.domain}` : ''})`,
+          detail: `provision requested (shape=${shape}, mode=${onboardMode}${body.domain ? `, domain=${body.domain}` : ''})`,
           actor: 'api:self',
         }).catch(() => {});
       }

package/modules/security/artifact-scan/aggregate.js

@@ -0,0 +1,133 @@
+// modules/security/artifact-scan/aggregate.js — the verdict reducer
+// (task 1002545, goal 1000055).
+//
+// THE LINE THAT MAKES THE VERDICT ARITHMETIC RATHER THAN AN OPINION. No model
+// ever writes a verdict: this reducer takes the MAXIMUM of the floor's floor,
+// the panel's outcome, the tier clamp, and the coverage cap — each computed in
+// code from evidence — and any verdict-shaped field a lens returns is ignored
+// by construction (the reducer never reads one). An artifact whose whole
+// purpose is to talk the scanner into saying "clean" cannot succeed here,
+// because there is no sentence it could produce that this arithmetic reads.
+//
+// Monotone by design: every input can only RAISE the verdict, never lower it.
+
+'use strict';
+
+// Same rank floor.js exports — duplicated as the module's shared source of
+// truth is floor.js; requiring it here keeps the two in lockstep.
+const { VERDICT_RANK } = require('./floor');
+
+const VERDICTS = Object.freeze(['clean', 'caution', 'dangerous']);
+
+// Tiers mirror scan-store.js TIERS. 'low' is the cheapest tier: floor + one
+// triage read, no full panel — static analysis that shallow can never clear an
+// artifact, so 'low' clamps to caution and can NEVER reach clean.
+const TIER_CLAMP = Object.freeze({
+  low: 'caution',
+  default: 'clean',
+  high: 'clean',
+  xhigh: 'clean',
+  max: 'clean',
+});
+
+// A lens that did not finish cleanly contributes caution, never silence: an
+// errored/timed-out/budget-exhausted lens means its surface went UNREVIEWED.
+const LENS_OK = 'ok';
+const LENS_PROBLEM_STATUSES = Object.freeze(['error', 'timeout', 'budget_exhausted']);
+
+const rank = (v) => VERDICT_RANK[v] ?? VERDICT_RANK.dangerous; // unknown → worst
+const maxVerdict = (a, b) => (rank(a) >= rank(b) ? a : b);
+
+// Panel outcome — computed from FINDINGS ONLY. The severity arithmetic is the
+// same as the floor's: any critical → dangerous, any finding → caution, none →
+// clean. A lens's own `verdict` field (or any other model-authored summary
+// judgment) is deliberately never read.
+function panelOutcome(lenses = []) {
+  let out = 'clean';
+  for (const lens of lenses) {
+    const findings = Array.isArray(lens && lens.findings) ? lens.findings : [];
+    for (const f of findings) {
+      out = maxVerdict(out, f && f.severity === 'critical' ? 'dangerous' : 'caution');
+    }
+  }
+  return out;
+}
+
+// Lens health — 'clean' only when a real panel ran to completion. Fails
+// closed on every degenerate shape:
+//   - any lens missing, errored, timed out, or budget-exhausted → caution;
+//   - a status-ok lens whose findings is not an array (malformed payload —
+//     its findings were LOST, not absent) → caution;
+//   - `panelRequired` (a tier whose clamp permits clean) with ZERO ok lenses →
+//     caution. An absent panel is the maximal case of "silence", and without
+//     this the one input that means "the deep review never happened at all"
+//     was the only input in this file that failed open (review finding).
+function lensHealth(lenses = [], { panelRequired = false } = {}) {
+  let okLenses = 0;
+  for (const lens of lenses) {
+    if (!lens || lens.status !== LENS_OK || !Array.isArray(lens.findings)) return 'caution';
+    okLenses++;
+  }
+  if (panelRequired && okLenses === 0) return 'caution';
+  return 'clean';
+}
+
+// Coverage cap — static text analysis cannot clear what it never read.
+// Anything unread or unreadable holds the verdict at caution or above:
+// skipped files/bytes, findings flagged unscannable (MCP commands, remote
+// servers), and declared dependencies the install would fetch.
+function coverageCap({ floorReport = {}, declaredDependencies = null } = {}) {
+  const cov = floorReport.coverage || {};
+  const skipped = Array.isArray(cov.files_skipped) ? cov.files_skipped.length : 0;
+  const findings = Array.isArray(floorReport.findings) ? floorReport.findings : [];
+  const unscannable = findings.filter((f) => f && f.detail && f.detail.unscannable === true).length;
+  const deps = declaredDependencies != null
+    ? Number(declaredDependencies) || 0
+    : findings.filter((f) => f && f.code === 'dependencies_unfetched').length;
+  const reasons = [];
+  if (skipped > 0) reasons.push(`${skipped} file(s) skipped unread`);
+  if (unscannable > 0) reasons.push(`${unscannable} unscannable surface(s) (off-box code)`);
+  if (deps > 0) reasons.push('declared dependencies never fetched');
+  return { verdict: reasons.length > 0 ? 'caution' : 'clean', reasons };
+}
+
+// The reducer. Returns the computed verdict plus each component, so the report
+// can show its arithmetic — an auditable max(), not a narrative.
+function reduceVerdict({ floorReport = {}, lenses = [], tier = 'low', declaredDependencies = null } = {}) {
+  const floor = VERDICTS.includes(floorReport.floor_verdict) ? floorReport.floor_verdict : 'caution';
+  const panel = panelOutcome(lenses);
+  // Own-property lookup so a hostile tier string can never reach the clamp
+  // through the prototype chain; unknown tier → caution, fail closed.
+  const clamp = Object.prototype.hasOwnProperty.call(TIER_CLAMP, tier) ? TIER_CLAMP[tier] : 'caution';
+  // A tier whose clamp permits 'clean' is a tier that RUNS a panel — so on
+  // those tiers an empty panel is a failure, not a pass.
+  const health = lensHealth(lenses, { panelRequired: clamp === 'clean' });
+  const coverage = coverageCap({ floorReport, declaredDependencies });
+
+  let verdict = 'clean';
+  for (const component of [floor, panel, health, clamp, coverage.verdict]) {
+    verdict = maxVerdict(verdict, component);
+  }
+  return {
+    verdict,
+    components: {
+      floor,
+      panel,
+      lens_health: health,
+      tier_clamp: clamp,
+      coverage_cap: coverage.verdict,
+    },
+    coverage_reasons: coverage.reasons,
+  };
+}
+
+module.exports = {
+  VERDICTS,
+  TIER_CLAMP,
+  LENS_OK,
+  LENS_PROBLEM_STATUSES,
+  panelOutcome,
+  lensHealth,
+  coverageCap,
+  reduceVerdict,
+};

package/modules/security/artifact-scan/detectors/capabilities.js

@@ -0,0 +1,53 @@
+// modules/security/artifact-scan/detectors/capabilities.js — the plain
+// capability inventory (task 1002544).
+//
+// PRINTED, NEVER SCORED. The inventory answers "what CAN this artifact do"
+// (spawn processes, touch the filesystem, read env, eval code…) so the human
+// and the panel read the report against an accurate power budget. It emits no
+// findings and never contributes to the verdict floor: capability is not
+// guilt, and scoring it here would double-count the detectors that DO grade
+// specific behaviors.
+
+'use strict';
+
+const CAPABILITY_PATTERNS = Object.freeze([
+  ['process-spawn', /\bchild_process\b|\bexecSync?\s*\(|\bspawnSync?\s*\(|\bexecFile\s*\(|Start-Process|\bsubprocess\b/],
+  ['filesystem', /\brequire\s*\(\s*['"](?:node:)?fs['"]|\bfrom\s+['"](?:node:)?fs['"]|\breadFileSync?\s*\(|\bwriteFileSync?\s*\(/],
+  ['env-read', /\bprocess\.env\b|\bos\.environ\b|\$env:/],
+  ['dynamic-code', /\beval\s*\(|new\s+Function\s*\(|\bvm\.(?:runInContext|runInNewContext|Script)\b/],
+  ['native-addon', /\.node['"]|\bnode-gyp\b|binding\.gyp|\bffi\b/],
+  ['network', /\bfetch\s*\(|\bhttps?\.(?:request|get)\s*\(|\bnet\.connect|XMLHttpRequest|WebSocket|\baxios\b|\bcurl\s+|\bwget\s+/],
+  ['crypto', /\brequire\s*\(\s*['"](?:node:)?crypto['"]|\bfrom\s+['"](?:node:)?crypto['"]/],
+]);
+
+const SCRIPT_EXTENSIONS = Object.freeze(['.sh', '.bash', '.ps1', '.psm1', '.cmd', '.bat']);
+
+const MAX_EXAMPLE_FILES = 5;
+
+// Returns the inventory: [{ capability, count, files: first-5 paths }].
+// Shell/batch scripts are inventoried by extension — their presence means
+// "there is code here meant to be executed by a shell", whatever it says.
+function inventory(corpus) {
+  const byCapability = new Map();
+  const add = (capability, path) => {
+    if (!byCapability.has(capability)) byCapability.set(capability, []);
+    byCapability.get(capability).push(path);
+  };
+
+  for (const file of corpus.files) {
+    const lower = file.path.toLowerCase();
+    if (SCRIPT_EXTENSIONS.some((ext) => lower.endsWith(ext))) add('shell-scripts', file.path);
+    if (file.text === null) continue;
+    for (const [capability, re] of CAPABILITY_PATTERNS) {
+      if (re.test(file.text)) add(capability, file.path);
+    }
+  }
+
+  return [...byCapability.entries()]
+    .map(([capability, files]) => ({ capability, count: files.length, files: files.slice(0, MAX_EXAMPLE_FILES) }))
+    .sort((a, b) => a.capability.localeCompare(b.capability));
+}
+
+// Constants exported as the white-box surface: the reducer/report stages and
+// tests read them to stay in lockstep with what the inventory actually covers.
+module.exports = { inventory, CAPABILITY_PATTERNS, SCRIPT_EXTENSIONS };

package/modules/security/artifact-scan/detectors/config-obfuscation.js

@@ -0,0 +1,41 @@
+// modules/security/artifact-scan/detectors/config-obfuscation.js — obfuscation
+// aimed at a reader who skims the raw config bytes (task 1002544).
+//
+// Runs ONCE over every JSON config in the bundle (not per-key like the
+// individual detectors' parse/grep cross-checks), so an escaped-key finding is
+// emitted a single time per file rather than once per detector that touches it.
+//
+// A JSON config KEY written with backslash escapes (`"postinstall"`,
+// `"postinstall"`) has no legitimate purpose: npm and the harness decode
+// it to the real key and act on it, while a human — and a naive grep — sees
+// something else. That mismatch is the whole point of the trick, so its mere
+// presence is a finding. (The duplicate-key SHADOWING case is separately caught
+// by each detector's escape-decoding grepParseDisagreement.)
+
+'use strict';
+
+const { finding, basename, escapedConfigKeyCount } = require('./shared');
+
+function isJsonConfig(p) {
+  const name = basename(p);
+  if (!name.endsWith('.json')) return false;
+  return name === 'package.json' || name === '.claude.json' || name.startsWith('settings')
+    || name === '.mcp.json' || name === 'mcp.json' || name === 'claude_desktop_config.json'
+    || name === 'managed-settings.json' || p.includes('.claude/') || p.includes('.claude\\');
+}
+
+function detect(corpus) {
+  const findings = [];
+  for (const file of corpus.files) {
+    if (file.text === null || !isJsonConfig(file.path)) continue;
+    const escaped = escapedConfigKeyCount(file.text);
+    if (escaped > 0) {
+      findings.push(finding('obfuscated_config_key', 'high', file.path,
+        `${escaped} config key(s) use backslash escapes — the harness decodes them to real keys while a skim of the raw bytes reads something else.`,
+        { escaped_key_count: escaped }));
+    }
+  }
+  return findings;
+}
+
+module.exports = { detect, isJsonConfig };