@bongos/core 1.18.3 → 1.18.18

package/clients/bongos-client/index.mjs

@@ -111,8 +111,12 @@ export function createClient(opts = {}) {
       postAuthAppPairPoll: (args) => request("POST", "/auth/app-pair/poll", { hasBody: true }, args),
       // POST /auth/app-pair/start — rank: public — POST /auth/app-pair/start
       postAuthAppPairStart: (args) => request("POST", "/auth/app-pair/start", { hasBody: true }, args),
+      // POST /auth/backchannel-logout — rank: public — POST /auth/backchannel-logout
+      postAuthBackchannelLogout: (args) => request("POST", "/auth/backchannel-logout", { hasBody: true }, args),
       // POST /auth/cli-token/issue — rank: any-builder — POST /auth/cli-token/issue
       postAuthCliTokenIssue: (args) => request("POST", "/auth/cli-token/issue", { hasBody: true }, args),
+      // POST /auth/device/exchange — rank: public — POST /auth/device/exchange
+      postAuthDeviceExchange: (args) => request("POST", "/auth/device/exchange", { hasBody: true }, args),
       // POST /auth/device/poll — rank: public — POST /auth/device/poll
       postAuthDevicePoll: (args) => request("POST", "/auth/device/poll", { hasBody: true }, args),
       // POST /auth/device/start — rank: public — POST /auth/device/start
@@ -129,6 +133,8 @@ export function createClient(opts = {}) {
       postAuthRevoke: (args) => request("POST", "/auth/revoke", { hasBody: true }, args),
       // POST /auth/revoke-all — rank: archon — POST /auth/revoke-all
       postAuthRevokeAll: (args) => request("POST", "/auth/revoke-all", { hasBody: true }, args),
+      // GET /auth/web/admission-status — rank: public — GET /auth/web/admission-status
+      getAuthWebAdmissionStatus: (args) => request("GET", "/auth/web/admission-status", { hasBody: false }, args),
       // GET /auth/web/callback — rank: public — GET /auth/web/callback
       getAuthWebCallback: (args) => request("GET", "/auth/web/callback", { hasBody: false }, args),
       // GET /auth/web/start — rank: public — GET /auth/web/start
@@ -177,6 +183,8 @@ export function createClient(opts = {}) {
       getBoxManagedSettings: (args) => request("GET", "/box/managed-settings", { hasBody: false }, args),
       // GET /box/me — rank: any-builder — GET /box/me
       getBoxMe: (args) => request("GET", "/box/me", { hasBody: false }, args),
+      // GET /box/scope — rank: any-builder — GET /box/scope
+      getBoxScope: (args) => request("GET", "/box/scope", { hasBody: false }, args),
       // GET /box/source-access — rank: any-builder — GET /box/source-access
       getBoxSourceAccess: (args) => request("GET", "/box/source-access", { hasBody: false }, args),
       // GET /box/ssh-key — rank: any-builder — GET /box/ssh-key
@@ -244,12 +252,6 @@ export function createClient(opts = {}) {
       // POST /cost — rank: any-builder — POST /cost
       postCost: (args) => request("POST", "/cost", { hasBody: true }, args),
     },
-    "demo": {
-      // GET /demo/health — rank: public — GET /demo/health
-      getDemoHealth: (args) => request("GET", "/demo/health", { hasBody: false }, args),
-      // POST /demo/ping — rank: metic+archon — POST /demo/ping
-      postDemoPing: (args) => request("POST", "/demo/ping", { hasBody: true }, args),
-    },
     "dependencies": {
       // DELETE /dependencies — rank: archon — DELETE /dependencies
       deleteDependencies: (args) => request("DELETE", "/dependencies", { hasBody: false }, args),
@@ -276,6 +278,12 @@ export function createClient(opts = {}) {
       // POST /gate-approvals/{pr}/approve — rank: archon — POST /gate-approvals/:pr/approve
       postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
     },
+    "github": {
+      // GET /github/repos — rank: any-builder — GET /github/repos
+      getGithubRepos: (args) => request("GET", "/github/repos", { hasBody: false }, args),
+      // POST /github/repos — rank: any-builder — POST /github/repos
+      postGithubRepos: (args) => request("POST", "/github/repos", { hasBody: true }, args),
+    },
     "goals": {
       // GET /goals — rank: any-builder — GET /goals
       getGoals: (args) => request("GET", "/goals", { hasBody: false }, args),
@@ -343,6 +351,8 @@ export function createClient(opts = {}) {
       getInboxId: (args) => request("GET", "/inbox/{id}", { hasBody: false }, args),
       // PATCH /inbox/{id} — rank: metic+archon — PATCH /inbox/:id
       patchInboxId: (args) => request("PATCH", "/inbox/{id}", { hasBody: true }, args),
+      // POST /inbox/{id}/ratify — rank: archon — POST /inbox/:id/ratify
+      postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
     },
     "instance": {
       // GET /instance — rank: public — GET /instance
@@ -375,16 +385,6 @@ export function createClient(opts = {}) {
       getMeAchievements: (args) => request("GET", "/me/achievements", { hasBody: false }, args),
       // POST /me/anthropic-link — rank: any-builder — POST /me/anthropic-link
       postMeAnthropicLink: (args) => request("POST", "/me/anthropic-link", { hasBody: true }, args),
-      // GET /me/art-key — rank: any-builder — GET /me/art-key
-      getMeArtKey: (args) => request("GET", "/me/art-key", { hasBody: false }, args),
-      // DELETE /me/art-key/own — rank: any-builder — DELETE /me/art-key/own
-      deleteMeArtKeyOwn: (args) => request("DELETE", "/me/art-key/own", { hasBody: false }, args),
-      // GET /me/art-key/own — rank: any-builder — GET /me/art-key/own
-      getMeArtKeyOwn: (args) => request("GET", "/me/art-key/own", { hasBody: false }, args),
-      // PUT /me/art-key/own — rank: any-builder — PUT /me/art-key/own
-      putMeArtKeyOwn: (args) => request("PUT", "/me/art-key/own", { hasBody: true }, args),
-      // POST /me/art-key/storage-init — rank: archon — POST /me/art-key/storage-init
-      postMeArtKeyStorageInit: (args) => request("POST", "/me/art-key/storage-init", { hasBody: true }, args),
       // PATCH /me/disciplines — rank: any-builder — PATCH /me/disciplines
       patchMeDisciplines: (args) => request("PATCH", "/me/disciplines", { hasBody: true }, args),
       // GET /me/display-name — rank: any-builder — GET /me/display-name
@@ -429,6 +429,10 @@ export function createClient(opts = {}) {
       getMemoryBfgBuildersBuilderIdFiles: (args) => request("GET", "/memory/bfg/builders/{builderId}/files", { hasBody: false }, args),
       // POST /memory/builders/{builderId}/bfg-write — rank: bfg-principal — POST /memory/builders/:builderId/bfg-write
       postMemoryBuildersBuilderIdBfgWrite: (args) => request("POST", "/memory/builders/{builderId}/bfg-write", { hasBody: true }, args),
+      // GET /memory/builders/{builderId}/file — rank: archon — GET /memory/builders/:builderId/file
+      getMemoryBuildersBuilderIdFile: (args) => request("GET", "/memory/builders/{builderId}/file", { hasBody: false }, args),
+      // GET /memory/builders/{builderId}/files — rank: archon — GET /memory/builders/:builderId/files
+      getMemoryBuildersBuilderIdFiles: (args) => request("GET", "/memory/builders/{builderId}/files", { hasBody: false }, args),
       // DELETE /memory/file — rank: any-builder — DELETE /memory/file
       deleteMemoryFile: (args) => request("DELETE", "/memory/file", { hasBody: true }, args),
       // GET /memory/file — rank: any-builder — GET /memory/file
@@ -448,12 +452,38 @@ export function createClient(opts = {}) {
       // GET /modules/submissions — rank: metic+archon — GET /modules/submissions
       getModulesSubmissions: (args) => request("GET", "/modules/submissions", { hasBody: false }, args),
     },
+    "myProjects": {
+      // GET /my-projects — rank: any-builder — GET /my-projects
+      getMyProjects: (args) => request("GET", "/my-projects", { hasBody: false }, args),
+      // POST /my-projects/{clientId}/leave — rank: any-builder — POST /my-projects/:clientId/leave
+      postMyProjectsClientIdLeave: (args) => request("POST", "/my-projects/{clientId}/leave", { hasBody: true }, args),
+      // GET /my-projects/invites — rank: any-builder — GET /my-projects/invites
+      getMyProjectsInvites: (args) => request("GET", "/my-projects/invites", { hasBody: false }, args),
+      // POST /my-projects/invites/{clientId}/accept — rank: any-builder — POST /my-projects/invites/:clientId/accept
+      postMyProjectsInvitesClientIdAccept: (args) => request("POST", "/my-projects/invites/{clientId}/accept", { hasBody: true }, args),
+      // POST /my-projects/invites/{clientId}/decline — rank: any-builder — POST /my-projects/invites/:clientId/decline
+      postMyProjectsInvitesClientIdDecline: (args) => request("POST", "/my-projects/invites/{clientId}/decline", { hasBody: true }, args),
+      // POST /my-projects/join — rank: any-builder — POST /my-projects/join
+      postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
+    },
     "overrideRequests": {
       // GET /override-requests — rank: archon — GET /override-requests
       getOverrideRequests: (args) => request("GET", "/override-requests", { hasBody: false }, args),
       // POST /override-requests/{id}/decide — rank: archon — POST /override-requests/:id/decide
       postOverrideRequestsIdDecide: (args) => request("POST", "/override-requests/{id}/decide", { hasBody: true }, args),
     },
+    "projects": {
+      // GET /projects — rank: archon — GET /projects
+      getProjects: (args) => request("GET", "/projects", { hasBody: false }, args),
+      // POST /projects — rank: archon — POST /projects
+      postProjects: (args) => request("POST", "/projects", { hasBody: true }, args),
+      // PATCH /projects/{id}/featured — rank: archon — PATCH /projects/:id/featured
+      patchProjectsIdFeatured: (args) => request("PATCH", "/projects/{id}/featured", { hasBody: true }, args),
+      // GET /projects/featured — rank: public — GET /projects/featured
+      getProjectsFeatured: (args) => request("GET", "/projects/featured", { hasBody: false }, args),
+      // POST /projects/invite — rank: archon — POST /projects/invite
+      postProjectsInvite: (args) => request("POST", "/projects/invite", { hasBody: true }, args),
+    },
     "provisioning": {
       // GET /provisioning/fleet — rank: archon — GET /provisioning/fleet
       getProvisioningFleet: (args) => request("GET", "/provisioning/fleet", { hasBody: false }, args),
@@ -520,6 +550,10 @@ export function createClient(opts = {}) {
       // GET /public/versions — rank: public — GET /public/versions
       getPublicVersions: (args) => request("GET", "/public/versions", { hasBody: false }, args),
     },
+    "scouting": {
+      // GET /scouting — rank: archon — GET /scouting
+      getScouting: (args) => request("GET", "/scouting", { hasBody: false }, args),
+    },
     "search": {
       // POST /search — rank: any-builder — POST /search
       postSearch: (args) => request("POST", "/search", { hasBody: true }, args),
@@ -527,12 +561,26 @@ export function createClient(opts = {}) {
       postSearchMark: (args) => request("POST", "/search/mark", { hasBody: true }, args),
     },
     "security": {
+      // GET /security/adr — rank: metic+archon — GET /security/adr
+      getSecurityAdr: (args) => request("GET", "/security/adr", { hasBody: false }, args),
       // GET /security/docs — rank: archon — GET /security/docs
       getSecurityDocs: (args) => request("GET", "/security/docs", { hasBody: false }, args),
       // POST /security/docs — rank: archon — POST /security/docs
       postSecurityDocs: (args) => request("POST", "/security/docs", { hasBody: true }, args),
       // GET /security/docs/{slug} — rank: archon — GET /security/docs/:slug
       getSecurityDocsSlug: (args) => request("GET", "/security/docs/{slug}", { hasBody: false }, args),
+      // GET /security/reports — rank: archon — GET /security/reports
+      getSecurityReports: (args) => request("GET", "/security/reports", { hasBody: false }, args),
+      // POST /security/reports — rank: metic+archon — POST /security/reports
+      postSecurityReports: (args) => request("POST", "/security/reports", { hasBody: true }, args),
+      // POST /security/reports/{id}/confirm — rank: archon — POST /security/reports/:id/confirm
+      postSecurityReportsIdConfirm: (args) => request("POST", "/security/reports/{id}/confirm", { hasBody: true }, args),
+      // POST /security/reports/{id}/dispute — rank: archon — POST /security/reports/:id/dispute
+      postSecurityReportsIdDispute: (args) => request("POST", "/security/reports/{id}/dispute", { hasBody: true }, args),
+      // POST /security/reports/{id}/fix — rank: archon — POST /security/reports/:id/fix
+      postSecurityReportsIdFix: (args) => request("POST", "/security/reports/{id}/fix", { hasBody: true }, args),
+      // POST /security/reports/{id}/link-fix — rank: archon — POST /security/reports/:id/link-fix
+      postSecurityReportsIdLinkFix: (args) => request("POST", "/security/reports/{id}/link-fix", { hasBody: true }, args),
     },
     "session": {
       // POST /session/optimize — rank: any-builder — POST /session/optimize
@@ -548,6 +596,22 @@ export function createClient(opts = {}) {
       // GET /sessions/search — rank: archon — GET /sessions/search
       getSessionsSearch: (args) => request("GET", "/sessions/search", { hasBody: false }, args),
     },
+    "sso": {
+      // POST /sso/activity/rollup — rank: public — POST /sso/activity/rollup
+      postSsoActivityRollup: (args) => request("POST", "/sso/activity/rollup", { hasBody: true }, args),
+      // GET /sso/authorize — rank: public — GET /sso/authorize
+      getSsoAuthorize: (args) => request("GET", "/sso/authorize", { hasBody: false }, args),
+      // POST /sso/device/poll — rank: public — POST /sso/device/poll
+      postSsoDevicePoll: (args) => request("POST", "/sso/device/poll", { hasBody: true }, args),
+      // POST /sso/device/start — rank: public — POST /sso/device/start
+      postSsoDeviceStart: (args) => request("POST", "/sso/device/start", { hasBody: true }, args),
+      // POST /sso/membership/check-in — rank: public — POST /sso/membership/check-in
+      postSsoMembershipCheckIn: (args) => request("POST", "/sso/membership/check-in", { hasBody: true }, args),
+      // GET /sso/pubkey — rank: public — GET /sso/pubkey
+      getSsoPubkey: (args) => request("GET", "/sso/pubkey", { hasBody: false }, args),
+      // POST /sso/token — rank: public — POST /sso/token
+      postSsoToken: (args) => request("POST", "/sso/token", { hasBody: true }, args),
+    },
     "tasks": {
       // GET /tasks — rank: any-builder — GET /tasks
       getTasks: (args) => request("GET", "/tasks", { hasBody: false }, args),
@@ -557,7 +621,7 @@ export function createClient(opts = {}) {
       getTasksId: (args) => request("GET", "/tasks/{id}", { hasBody: false }, args),
       // PATCH /tasks/{id} — rank: metic+archon — PATCH /tasks/:id
       patchTasksId: (args) => request("PATCH", "/tasks/{id}", { hasBody: true }, args),
-      // POST /tasks/{id}/abandon — rank: archon — POST /tasks/:id/abandon
+      // POST /tasks/{id}/abandon — rank: metic+archon — POST /tasks/:id/abandon
       postTasksIdAbandon: (args) => request("POST", "/tasks/{id}/abandon", { hasBody: true }, args),
       // POST /tasks/{id}/attest-gate — rank: any-builder — POST /tasks/:id/attest-gate
       postTasksIdAttestGate: (args) => request("POST", "/tasks/{id}/attest-gate", { hasBody: true }, args),
@@ -611,7 +675,7 @@ export function createClient(opts = {}) {
       postVersions: (args) => request("POST", "/versions", { hasBody: true }, args),
       // GET /versions/{id}/done-when — rank: public — GET /versions/:id/done-when
       getVersionsIdDoneWhen: (args) => request("GET", "/versions/{id}/done-when", { hasBody: false }, args),
-      // POST /versions/{id}/done-when — rank: archon — POST /versions/:id/done-when
+      // POST /versions/{id}/done-when — rank: metic+archon — POST /versions/:id/done-when
       postVersionsIdDoneWhen: (args) => request("POST", "/versions/{id}/done-when", { hasBody: true }, args),
       // GET /versions/{id}/progress — rank: public — GET /versions/:id/progress
       getVersionsIdProgress: (args) => request("GET", "/versions/{id}/progress", { hasBody: false }, args),

package/config/branding.neutral.json

@@ -10,6 +10,7 @@
     "publicOrigin": "http://localhost:3000",
     "buildersOrigin": "http://localhost:3000",
     "statusOrigin": "http://localhost:3000",
+    "statusDataUrl": "",
     "cookieDomain": "",
     "oauthOrigin": "http://localhost:3000",
     "devBoxBase": "",
@@ -26,7 +27,7 @@
   "configDir": "cloudbongos",
   "firstAdmin": "",
   "currency": { "label": "credits", "symbol": "" },
-  "reward": { "marginPct": 20, "usdPeg": 1 },
+  "reward": { "marginPct": 20, "usdPeg": 1, "mode": "cost-plus-and-estimate" },
   "models": { "main": "opus", "subagentDefault": "opus", "subagentRoutine": "haiku" },
   "theme": {
     "palette": "",
@@ -60,5 +61,9 @@
       "ctaLabel": "Try signing in again"
     }
   },
+  "landing": {
+    "_note": "Where a successful sign-in lands when no explicit ?return= / same-apex Referer was carried (auth.js postLoginLanding). Portable default '/builders' — the hall always exists. A platform-home instance points this at its own front door (cloudbongos.com → '/gate/', the orbs). Validated through the open-redirect allowlist; env override <PREFIX>_POST_LOGIN_LANDING. Task 1002240.",
+    "postLogin": "/builders"
+  },
   "envPrefix": "CLOUDBONGOS"
 }

package/config/governance.neutral.json

@@ -0,0 +1,21 @@
+{
+  "_note": "Neutral governance starter — the role TEMPLATES a fresh instance inherits (BV1.R96, ADR 0151). Resolved by modules/governance/config.js with the branding precedence: env override -> config/governance.json (instance) -> this file. TEMPLATES AND DEFAULTS ONLY. Live roles, grants, and per-builder assignments are DB rows (governance_roles / governance_role_permissions / governance_builder_roles), resolved server-side per request by resolver.js — putting a live grant here would make config a second source of authority truth and break ADR 0016. The four seeded rank-roles carry label + description only: their grants derive from catalog.js floors and are materialised by governance_002, so config may relabel a seeded role, never re-grant it. A CUSTOM role template may propose a `permissions` array, but a `system: true` key or a key the catalog does not define is stripped fail-closed — a config file is editable by anyone who can write the checkout, so it is not a trust boundary. Carries NO host identity: a vanilla instance boots sane from this file alone (proved by R102). To customise, copy to config/governance.json and edit there.",
+  "roles": {
+    "xenos": {
+      "label": "Xenos",
+      "description": "Seeded rank-role — the sandboxed entry rank. Own-work + public read."
+    },
+    "thetes": {
+      "label": "Thetes",
+      "description": "Seeded rank-role — graduated newcomer. Adds the general claim queue."
+    },
+    "metic": {
+      "label": "Metic",
+      "description": "Seeded rank-role — the trusted working rank. Adds review/triage/authoring."
+    },
+    "archon": {
+      "label": "Archon",
+      "description": "Seeded rank-role — top authority. Adds the admin + system (non-grantable) powers."
+    }
+  }
+}

package/docs/adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md

@@ -69,6 +69,30 @@ After shipping, the fix was adversarially red-teamed (a 4-dimension panel + per-
 
 **Not yet done (finding `#7`, follow-up):** the permission-path pre-pass (layer 2) runs only client-side in `ship.js`; the server `/grade` and `/confirm` routes don't re-run it. Layer 3 is the server-side backstop today; re-running the pre-pass server-side (the server holds the live rank in `req.builder.rank`) would harden the cooperative path.
 
+## Branch-protection status: re-verified 2026-07-24 (task [#1001840](https://cloudbongos.com/builders#/task/1001840))
+
+The 2026-07-03 authority sweep reported that `main` had since gained live branch protection (required
+checks + code-owner review, direct push blocked), which would have demoted `main-audit.js` from
+*authoritative* to *defense-in-depth*. **That report was wrong.** Re-checked against the live GitHub
+API — every probe agrees there is no protection on `main`:
+
+| Probe | Result |
+|---|---|
+| `GET /repos/:o/:r/branches/main` | `protected: false` |
+| `GET /repos/:o/:r/branches/main/protection` | `404` (a *protected* branch returns `403` to a non-admin, not `404`) |
+| `GET /repos/:o/:r/rulesets` | `[]` |
+| `GET /repos/:o/:r/rules/branches/main` (effective rules; readable by non-admins) | `[]` |
+| `.github/CODEOWNERS` | absent |
+| PR #19, merged 2026-07-24 by a **non-admin** collaborator | `statusCheckRollup: []`, no review decision — a merge that required checks + code-owner review would forbid |
+
+So §"The gap" ¶1 and the layer table above stand **as written**: the repo is still a personal-account
+private repo with no protection available, and **layer 3 (`main-audit.js`) remains the authoritative
+enforcement**, not a redundant second net. Option B (blocker
+[#17](https://cloudbongos.com/builders#/blocker/17)) is still open and still the durable closure.
+
+Treat this as the freshness stamp: re-run the probes above before asserting the claim has changed —
+a plan upgrade or a new ruleset would flip it, and this section is what a future sweep should update.
+
 ## Notes
 
 We did **not** take immediate action against Builder 25 — Lars was overseeing the session and the change itself was a legitimate bug fix. The point of this ADR is the *mechanism*, not the person: the system must make the bypass hard and visible regardless of intent.

package/docs/adr/0090-metic-task-authoring.md

@@ -1,6 +1,6 @@
 # 0090 — Metic gains task authoring: create / promote / edit + dependency & criteria shaping
 
-- **Status:** Accepted
+- **Status:** Accepted — one line amended by [ADR 0152](<redacted>.md) (2026-07-27): `POST /tasks/:id/abandon`, listed below under "What stays Archon-only", moved to Metic+ alongside create/promote/edit, paired with an `abandoned → backlog` restore on `/promote`. The rest of this ADR stands.
 - **Date:** 2026-06-26
 - **Deciders:** Lars (Archon), Claude
 

package/docs/adr/0144-devbox-rehome-onto-cloudbongos-plane.md

@@ -0,0 +1,41 @@
+# 0144 — Re-home the dev-box fleet onto the cloudbongos.com plane (native runners, local DB, isolated fleet tag)
+
+- **Status:** Accepted — Phases 1–3 built in task 1002239. **Phase 4 part (a) (stop legacy `cohost-box-*` runners) done in task 1002248** (2026-07-15); part (b) (disable dev-box on example.com) flagged to owner — not reachable from the cloudbongos control plane.
+- **Date:** 2026-07-15
+- **Deciders:** Lars (owner/Archon) chose "re-home properly, not a legacy band-aid" + pre-approved box spend; Claude designed + executed autonomously.
+- **Task:** [#1002239](https://cloudbongos.com/builders#/task/1002239) · supersedes stale incident [#1002031](https://cloudbongos.com/builders#/task/1002031) · **Goal:** 1000025 (builder experience — hall, dev box, skills).
+
+## Context
+
+"Get the dev box up and running again for cloud bongos" surfaced a split that was invisible from the platform:
+
+- **The dev-box feature was disabled on cloudbongos.com** — `config/modules.json` listed only `provisioning` + `platform-identity`, so `/api/gds/box/*` 404'd. The instance note said dev-box stays off "until box infra is confirmed present."
+- **The live dev-box data plane was the *legacy* `example` Postgres** (on the co-hosting box), drained by the cloudbongos control plane's `cohost-box-*` systemd runners over an SSH DB tunnel ([ADR 0132](<redacted>.md)). Builder identities even diverged: `example-owner` is builder **1** in the example DB, **3** on cloudbongos.com.
+- **The fleet was dormant** — all 9 boxes `destroyed`, control-plane timers green but idle (`ran=0`). So nothing was *broken*; the box capability simply lived on the old plane and was never brought onto the platform after the [ADR 0139] work-history migration.
+
+The owner chose to **re-home the box feature onto the cloudbongos.com plane** (its own DB, its own domains) rather than revive a box on the legacy `example` infra. Feasibility was high: the box tables already exist in the cloudbongos DB, `cloudbongos.com` is a live Cloudflare zone on the same account the control plane already uses, the DO/CF tokens are already on the control plane, and box domains are branding-driven (`domains.devBoxBase`/`sshBoxBase`) — not hardcoded.
+
+## Decision
+
+Stand up a **cloudbongos-native box plane** alongside (not replacing) the legacy one, in four moves:
+
+1. **Enable the feature (persisted).** `config/modules.json` → `dev-box: true`; `config/branding.json` → `domains.devBoxBase=cloudbongos.com`, `sshBoxBase=dev.cloudbongos.com`. **Persistence is by pushing to the instance `origin/main`, not a local commit** — `deploy.sh` (the ~3-min pull-deploy, ADR 0129) does `git reset --hard origin/main`, which silently reverts any local-only change. (Learned the hard way: a local commit was reset away within one deploy cycle.)
+
+2. **Native lifecycle runners against the LOCAL DB.** Four systemd service+timer pairs (`cloudbongos-box-{intent-runner,idle-suspend,drift-reconcile,dormant-reclaim}`) modeled on the `cohost-box-*` units but pointed at the **local `cloudbongos` Postgres** (peer auth, `PGDATABASE=cloudbongos`, **no tunnel, no `DATABASE_URL`**). Box domain/zone come from env, not branding, for the CLI: `CLOUDFLARE_ZONE`, `BOX_TERMINAL_ZONE`, `BOX_DNS_ZONE`, `GDS_PUBLIC_ORIGIN` (all cloudbongos.com). Overrides live in `/etc/cloudbongos/cloudbongos-box.env`, layered over `/etc/cloudbongos/box.env` (which holds the tokens).
+
+3. **Fleet isolation by a DISTINCT tag — the load-bearing safety decision.** Both planes share one DigitalOcean + one Cloudflare account. `boxes.js planDropletDrift` treats any fleet-tagged droplet **not in its own DB as a "zombie" and force-deletes it** (30-min grace). With a shared `otb-builder-box` tag, the legacy plane's hourly drift-reconcile would reap a cloudbongos box within ~30–90 min. So the native plane uses **`BOX_TAG=cloudbongos-builder-box`**. This is watertight because `cmdReconcileDrift` lists droplets `{tag: CONFIG.tag}`, and the sweeps act only on their own DB's rows — so each plane manages exactly its own fleet.
+
+4. **Legacy plane untouched.** The `example` (cohost) plane keeps running, fully isolated by tag/DB. Retiring it (disable dev-box on example.com, stop the cohost tunnel/runners) is **Phase 4** — deferred to an explicit owner go-ahead because it is the one hard-to-reverse step and is unnecessary for the cloudbongos plane to work.
+
+## Consequences
+
+- cloudbongos.com now serves `/box/*` and provisions boxes on its own plane, at `term-<login>.cloudbongos.com` / `sandbox-<login>.cloudbongos.com`, tracked in the cloudbongos DB, isolated from the legacy fleet.
+- **Verified end-to-end (2026-07-15):** web `POST /box/ensure` → intent in the cloudbongos DB → native `cloudbongos-box-intent-runner` drained it (`ran=1 ok=1`) → droplet `584756519 @ REDACTED_IP`, tunnel + DNS on cloudbongos.com, box `active`. Drift-reconcile confirmed `fleet tag=cloudbongos-builder-box: 0 droplets` before provisioning — proving isolation.
+- Two planes now exist until Phase 4. That is intentional and safe (tag + DB isolation), but means dev-box is "on" in two places.
+
+## Follow-ups (open)
+
+1. **Box first-boot convergence — ROOT-CAUSED + fixed (workaround live; proper fix open, task 1002243).** Symptom: provisioned boxes reached `active` but `cloudflared`/terminal never came up (`term-…` = CF 530) and SSH keys weren't applied. Root cause: **`box.js` provisioned droplets with EMPTY user-data** (`/var/lib/cloud/instance/user-data.txt` = 0 bytes; cloud-init logged "No user-data found"). `box.js` renders the box cloud-init from `<REPO_ROOT>/infra/` (the 26 KB `builder-box-cloud-init.yaml` + ~12 gz+b64-inlined scripts), and `fileGzB64` **silently returns `''` on a missing file**, so a missing `infra/` yields empty user-data with no error. The R89 split moved `scripts/gds/` into the `@bongos/core` package but **kept `infra/` in the instance repo** — yet `box.js` still resolves `infra/` relative to *its own* location (the vendored core), where `infra/` **isn't shipped at all** (0 files). So every box on any vendored/installed instance booted with only DigitalOcean's default user-data. **Workaround applied (temporary):** populated the vendored core's `infra/` from the instance's `infra/` (`/home/lars/cloudbongos/node_modules/@bongos/core/infra/`); re-provision then rendered a 62 KB user-data and the box converged — `cloudflared` active, `term-example-owner.cloudbongos.com` → 200 (authed), builder SSH key baked + working. **Proper fix (task 1002243):** ship `infra/` in the core publish-manifest, OR make `box.js` resolve `infra/` from the instance root (like `core-node.sh`'s candidate-base search), AND make `fileGzB64`/the template render **fail loudly** instead of emitting empty user-data. The workaround is under `node_modules` and will be lost on the next `npm ci`/core reinstall until the proper fix lands.
+2. **Cloudflare token scope.** Provision warned the ADR 0053 cookie-strip Transform Rule was **not** applied — `CLOUDFLARE_API_TOKEN` lacks "Transform Rules" edit scope on the cloudbongos.com zone. Add the scope (or apply the rule once in the dashboard) **before** other builders get boxes on `*.cloudbongos.com`, so platform cookies (`cookieDomain=<redacted> aren't sent to box subdomains.
+3. **Cosmetic `otb-` prefix.** Tunnel names (`otb-term-<login>`) and the droplet name (`otb-box-<login>`) are still hardcoded in `box-onboard.js`/`box.js`. Harmless (fleet separation is by tag, and DNS is per-zone), but a branding leak worth parameterizing.
+4. **Phase 4 — retire the legacy example plane** (owner decision) — **part (a) DONE in task 1002248 (2026-07-15).** Pre-checked read-only that the legacy fleet was empty (0 `otb-builder-box` droplets on DigitalOcean; cohost intent queue `ran=0`), then `systemctl disable --now` on the four `cohost-box-*` timers (intent-runner / idle-suspend / drift-reconcile / dormant-reclaim) on the control-plane host — now `disabled`/`inactive`; the native `cloudbongos-box-*` timers were left `enabled`/`active`. **Part (b) — disabling the dev-box module on example.com itself — NOT reachable from the control plane, flagged to owner:** example's web app + instance checkout are not co-located on the cloudbongos droplet (no local checkout, no ssh alias) and the local example GDS token is expired, so a durable module-disable needs owner access to example's own config/host. Harmless meanwhile: with the runners stopped there is no cost/security impact — worst case is a box request on the legacy instance that now hangs unfulfilled.

package/docs/adr/0144-federated-single-logout-backchannel.md

@@ -0,0 +1,42 @@
+# 0144 — Federated single-logout: hub-initiated back-channel session revocation
+
+- **Status:** Accepted — built in task 1002238.
+- **Date:** 2026-07-15
+- **Deciders:** Lars (owner/Archon) chose the back-channel approach; Claude designed + built.
+- **Task:** [#1002238](https://cloudbongos.com/builders#/task/1002238) · **Goal:** 41 (cross-site identity). Follow-up to [ADR 0141](<redacted>.md).
+
+## Context
+
+Cross-site identity ([ADR 0141](<redacted>.md)) gave single sign-**on**: one hub login (cloudbongos.com) reaches every federated project's hall with no second GitHub sign-in. But sign-**off** stayed local. When a federated instance completes the SSO handshake it mints its **own** local session (`completeIdpFlow` → `createSession`) with its own cookie on its own domain. `POST /auth/logout` revokes only *that* instance's session + clears *that* apex cookie — so signing out of the hub left every federated project (e.g. demo) still signed in. Owner request (2026-07-14): make sign-out universal.
+
+Three approaches were weighed (the task's options):
+
+- **(a) Back-channel SLO** — on hub logout the hub server calls each entered instance's revoke endpoint (server-to-server).
+- **(b) Front-channel SLO** — the browser is bounced through each instance's logout URL (classic OIDC front-channel).
+- **(c) Soft sessions** — federated instances stop holding durable sessions and re-check the hub continuously.
+
+## Decision
+
+**Take (a) — back-channel single-logout — per the owner's explicit call.** It is the robust, browser-independent choice for a session-lifecycle security feature, and it reuses the federation machinery ADR 0141 already built.
+
+1. **A hub-signed, purpose-tagged EdDSA logout token.** The hub mints (`platform-identity/hub-keys.js` `mintHubLogoutToken`) a compact Ed25519 JWT — the **same envelope + asymmetric key + ~120s TTL + audience-binding** as the login assertion (`mintHubAssertion`), so a token minted for instance A can't be replayed against instance B, and a compromised instance (holding only the public key) can't forge one. The payload carries **only** `{ iss, aud:<client_id>, sub:<github_id>, purpose:"backchannel-logout", iat, exp, jti }` — never identity, a rank, or a session token. The **`purpose` marker is load-bearing**: a login assertion has no `purpose` (rejected by the logout verifier) and a logout token has no `github_login` (rejected by the login verifier `verifyHubAssertion`), so the two token types are **mutually non-interchangeable** — a captured login assertion can't trigger a logout, and a logout token can't mint a session. The instance verifier (`auth.js verifyHubLogoutToken`) is the boundary-mirrored sibling of `verifyHubAssertion` (ADR 0091 §2), alg **hardcoded to Ed25519** (no algorithm-confusion), signature verified **before** any claim is trusted.
+
+2. **Kernel-mediated seam event, so core stays module-agnostic.** `POST /auth/logout` (core) revokes the local session as before, then **emits** a `builder.logout` seam event (fire-and-forget). On a non-hub instance nothing listens → no-op. On the hub, the `platform-identity` module (enabled only there) reacts. Core never references the module (ADR 0083 one-way rule); the switchboard (`src/module-seams.js`) is the seam.
+
+3. **The hub fans out; the instance revokes.** The module's listener looks up the builder's entered projects and POSTs a per-project logout token to each `{origin}/api/gds/auth/backchannel-logout`. That endpoint (core `auth.js`/`routes/auth.js`, **dormant unless the instance federates** — `idpConfigured()`, else a plain 404) verifies the token against the hub public key it already trusts (`/sso/pubkey`), resolves the builder by `github_id`, and calls `revokeAllSessionsForBuilder` — killing **all** of that builder's local sessions (web + CLI).
+
+4. **Entered-instance list = memberships (ADR 0141 §3).** The hub uses `listMembershipsForAccount(github_id)` — the projects the builder is known to build on — as the fan-out target list, per the task's sanctioned V1 signal. **Over-notifying is safe:** an instance with no live session for that builder just revokes nothing (revoke is idempotent). A precise per-SSO-session entry ledger (notify *only* instances with a live federated session) is a deliberate follow-up, not V1.
+
+5. **Best-effort, bounded, isolated fan-out.** The user's hub session is revoked **synchronously** (the part they experience); the cross-instance sweep runs server-side off the fire-and-forget event, each POST bounded by a 4s timeout, all under `Promise.allSettled` — a slow or down project can never wedge the sweep or the logout, and the fan-out never throws. **Accepted limitation:** if an instance is unreachable at logout time, its local session survives until its own TTL; a retry/queue is out of scope for V1 (logged, not retried).
+
+6. **Anti-replay on the instance side.** A logout token's `jti` is honored **once** (`logoutTokenJtiSeenAndRecord`, symmetric with the CLI-assertion path): the first use revokes, a replay within the ~120s TTL is an idempotent no-op. Without this, a captured token would stay a repeatable "log this builder out" primitive for its whole life — it could keep killing sessions the builder legitimately creates *after* the token was minted (revoking already-dead sessions is otherwise harmless).
+
+## Consequences
+
+- **Trust boundary preserved (ADR 0016 / 0141).** The logout token, like every other hub→instance message, carries **identity only** (a subject to sign out) — never authority. The instance decides locally what "sign this github_id out" means (revoke its own sessions). Authority stays local.
+- **Deploys to both sides.** The instance half (`/auth/backchannel-logout`, `verifyHubLogoutToken`, the `builder.logout` emit) ships in **core** (dormant on non-federated instances); the hub fan-out ships in the **platform-identity** module. So this go-live re-vendors **both** the hub (cloudbongos.com) and every federated instance (demo). Core `1.18.5 → 1.18.7` (the `1.18.6` cut on `main` is the unrelated task 1002241 `?return=` fix, carried along).
+- **No new schema.** Reuses the existing `<redacted>` + `sso_clients` (origin) rows and the existing Ed25519 hub keypair. No migration.
+- **Not front-channel (b):** modern third-party-cookie / iframe restrictions (Safari ITP, Chrome's trajectory) make browser-driven cross-site logout unreliable, and it doesn't complete if the tab closes mid-chain. Rejected for a security guarantee.
+- **Not soft sessions (c):** re-checking the hub per-request adds latency to every request and makes a federated instance's sign-in fail whenever the hub is down (a hard runtime dependency) — too heavy for a bootstrapped setup.
+- **V1 scope:** hub-initiated logout only. A federated instance's own logout does **not** yet propagate back to the hub + siblings (it has no client registry); that's a follow-up if wanted.
+- **Known limitation — a membership-spoof presence oracle (security review, medium).** The fan-out targets a builder's `<redacted>`, and `POST /sso/membership/check-in` (ADR 0141 §3) trusts a caller-named `github_id` under any active `client_secret`. So a client-secret holder can assert a membership for an arbitrary `github_id` and thereafter receive a hub-signed logout callback naming that builder on each of their hub logouts — a cross-account presence/existence oracle. It is **contained** (the token is `aud`-bound to the attacker's own `client_id`, so it can't be replayed against the victim's real instances — no session compromise) and **gated** (an `sso_client` is registered only by the operator-run `provision.js`, never a public route, so today every secret-holder is an operator-provisioned, trusted instance — the only client is `demo`). The root cause predates this ADR; this feature newly turns it into an active signed callback. **The proper fix — bind the fan-out to evidence of a real federated session for that `github_id` (a per-SSO-session ledger), or prove user consent at check-in — is the deferred follow-up (task [#1002244](https://cloudbongos.com/builders#/task/1002244)); it must land before federation opens to untrusted third-party clients.**

package/docs/adr/0145-devbox-app-branding-driven-module.md

@@ -0,0 +1,44 @@
+# 0145 — The Dev Box app becomes a branding-driven module (one source, per-instance builds)
+
+- **Status:** Accepted — Phase 1 built in task [#1002255](https://cloudbongos.com/builders#/task/1002255). Downloads (1002257), CI + releases repo + signing (1002258), and end-to-end verify (1002256) follow.
+- **Date:** 2026-07-15
+- **Deciders:** Lars (owner) — "re-set up the dev box app so it's properly installable for cloudbongos; the design should not be linked to a specific project but to the Cloud Bongos design; it should live on cloudbongos and be maintained there as a module, and Example should borrow it."
+- **Extends:** ADR 0045 (the Dev Box desktop app), ADR 0072 (app signing posture), ADR 0083 (module system), ADR 0004/0062 (brand discipline — no hardcoded host identity), [branding contract](../branding-contract.md).
+
+## Context
+
+The Dev Box desktop app (ADR 0045 — an Electron menu-bar/tray switch that pairs sign-in, flips the box on/off, and wires the local SSH + Claude-Desktop last mile) was **built for Example and lived outside the Cloud Bongos core**:
+
+- Its source was only in the OTB monolith (`~/dev/Claude-OTB/devbox-app/`), never in the neutral core.
+- It was **hardcoded to Example/OTB**: `src/brand.js` (`CIV_NAME: 'Example'`, `PRODUCT_NAME: 'OTB Dev Box'`, `example.com` origins), `appId com.offtheboats.devbox`, artifact names `OTB-Dev-Box-*`, the renderer's parchment/ancient-Greek theme (Cinzel/EB Garamond, tan `#ece0c2`) and an archaic "thy/thee" voice ("a gift of Hermes").
+- cloudbongos already ships the *download-redirect server* (`src/devbox-downloads.js`) but with no `config/devbox-app.json` and no Cloud-Bongos app to point it at — so a cloudbongos builder had **no installable app**, only the browser terminal + manual SSH.
+
+## Decision
+
+Vendor the app into the dev-box module and make **every brand input a build-time value read from the instance branding**, so one source tree builds any instance's app.
+
+1. **House it in the module:** `modules/dev-box/app/` (40 files, ~600K; `node_modules`/`dist` excluded). The desktop app is not a formal module `contributes` type (the manifest schema has no "app" — routes/pollers/uiSections/webSurfaces only), so it lives as **source inside the module**; `module.json` is unchanged. The generic `src/devbox-downloads.js` stays in core and reads the instance's `config/devbox-app.json` (Phase 2).
+
+2. **Build-time brand generator** — `scripts/gen-brand.js` reads `config/branding.json` (→ `branding.neutral.json` fallback, the Cloud Bongos pack) and emits three generated, committed artifacts:
+   - `src/brand.generated.json` — `PRODUCT_NAME`, `APP_ID` (`com.<worldslug>.devbox`), `PRODUCT_SLUG` (artifact filenames), origins, `DESKTOP_ENV_NAME`, `COPYRIGHT`, `CONFIG_DIR`, `BG_COLOR`, `TAGLINE`. `src/brand.js` is now just `module.exports = require('./brand.generated.json')`.
+   - `renderer/theme.generated.css` — the `:root` design tokens (palette + fonts) from `theme.ui`; `styles.css` keeps only layout and consumes the vars, so the panel re-skins entirely from branding.
+   - `electron-builder.yml` — rendered from `electron-builder.tmpl.yml` (appId/productName/copyright/artifact slug substituted; electron-builder's own `${version}/${arch}` left literal).
+   It runs in `prep` (→ `prestart`/`pretest`/`predist:*`), so every build regenerates for the building instance. Same source → **"Cloud Bongos Dev Box" here, "Example Dev Box" there** — the ADR 0004 posture generalised to every instance, enforced by the `no hardcoded host identity` fitness gate (which this now passes).
+
+3. **Example borrows it as a module** — it enables `dev-box` and its build runs `gen-brand` against its own `config/branding.json`, producing the OTB-branded app from the shared source. No forked copy.
+
+4. **Functional cross-component constants stay** (not "design", so not rebranded): the ttyd terminal user `otb` and the SSH key filename `~/.ssh/otb_builder` are contracts with the box image (`box-terminal.service`, the authorized-keys fetch, `/builder-connect`); the `window.otb` renderer↔preload bridge is an internal namespace. The session file dir, however, **is** branding-driven now (`~/.config/<configDir>/gds-session.json`) so pairing the app still signs in the instance's own `/builder-*` CLI.
+
+## Consequences
+
+- The neutral core now carries a **Cloud-Bongos-branded** Dev Box app by default (warm palette, Baloo 2/Quicksand, plain modern voice, `com.cloudbongos.devbox`). Committed generated defaults come from `branding.neutral.json` (Cloud Bongos brand pack; `localhost` origins are the neutral dev default — a real instance build bakes its own origins + the runtime session/API base overrides them anyway).
+- Verified Phase 1: `gen-brand` renders cleanly; the app's 56 unit tests pass (the one OTB-hardcoded assertion is now brand-agnostic); `node --check` clean; the client-vendor path fixed for the two-levels-deeper location; **all architecture fitness checks pass** (module→doorway-only, no hardcoded host identity, repo-map fresh).
+- The **API/builders origins the distributed app pairs against must be baked from the instance branding at build time** — so the real cloudbongos installer must be built with the cloudbongos instance `config/branding.json` (`cloudbongos.com`), not the neutral core's `localhost`. This shapes Phase 3 (where the branded build runs).
+
+## Follow-ups (open)
+
+1. **Downloads (task 1002257) — DONE 2026-07-17.** `config/devbox-app.json` pushed to the instance repo → `cloudbongos.com/downloads/devbox/*` 302 to the v1.0.10 release assets (all targets verified through Caddy). ⚠ **Vendored-config quirk:** `serve-internal.js` reads the config via a naive `require('../../config/devbox-app.json')` that in a *vendored* instance resolves to `node_modules/@bongos/core/config/`, **not** the instance root where the file lives (unlike branding/modules). Workaround: copied the config there on the host + restarted `cloudbongos.service` — **lost on next core upgrade / `npm ci`**. Proper instance-root-resolve fix = **task 1002371** (same class as ADR 0144's `infra/`).
+2. **Distribution (task 1002258) — DONE 2026-07-17.** CI `.github/workflows/build-devbox-app.yml` builds **signed + notarized** mac (arm64+x64) + win (x64+arm64); public releases repo `example-owner/cloudbongos-devbox-releases` hosts them; **v1.0.10 published**. Release origins baked via CI repo variables `DEVBOX_PUBLIC_ORIGIN`/`_BUILDERS_ORIGIN` (= cloudbongos.com). Gotcha found live: notarization 403'd until the owner accepted a lapsed **Apple Developer Program License Agreement** — then the signed+notarized build went green. Publishing = download CI artifacts → `gh release create/upload` (manual, no cross-repo CI token; ADR 0045).
+3. **App icon still OTB art.** `scripts/gen-icons.js` draws the app/tray/DMG icons from **pixel grids in the script** (currently the OTB design); the committed PNGs are OTB. Regenerating them from the Cloud Bongos bongo motif (edit the grids + re-run `npm run icons`) is a distinct art follow-up — the app's *name/colors/voice* are Cloud Bongos, but the *icon* is not yet.
+4. **Dev/CI env-var names** (`OTB_DEVBOX_API_BASE`/`_SCREENSHOT_DIR`/`_AUTOFLOW`) keep the `OTB_` prefix — harmless dev hooks, not user-visible; prefix-neutralising them is optional polish.
+5. **ADR number collision:** `0144` is used twice on this branch (`devbox-rehome` + `federated-single-logout`, from a parallel merge). Cosmetic; a renumber is worth a follow-up.

package/docs/adr/0145-free-hosted-project-tier-isolation-and-domain-separation.md

@@ -0,0 +1,62 @@
+# 0145 — A free "own-repo" hosted project tier needs domain separation + per-project isolation (not a bare cloudbongos.com subdomain)
+
+- **Status:** Accepted — owner decided 2026-07-15: **keep `cloudbongos.com`** (no separate domain), **container** isolation, **all-free** for now. Choosing the literal same domain makes hardening core sign-in a required prerequisite (see "Decisions" + "Required build sequence"). Build unblocked ([task 1002251](https://cloudbongos.com/builders#/task/1002251)); blocker 1000080 resolved.
+- **Date:** 2026-07-15
+- **Deciders:** Lars (owner/Archon) chose the direction after a security review; Claude ran the review + designed.
+- **Task:** [task 1002249](https://cloudbongos.com/builders#/task/1002249) · **Follow-up to** [ADR 0141](<redacted>.md) (federated hub IdP) and [ADR 0143](<redacted>.md) (the `/create` wizard).
+
+## Context
+
+Owner design review of the `/create` wizard ([public-landing/create.html](../../public-landing/create.html)) asked that a new project be reachable at a **free `<handle>.<platform>` address that works out of the box** (sign-in included), with **bring-your-own-domain** as the optional upgrade — i.e. the handle becomes a real subdomain, not just an internal name.
+
+Today `/create` always provisions the **`standalone`** shape (the owner's own GitHub repo + a pinned `@bongos/core`, run **control-plane-local** on the hub box), and sign-in on a standalone requires the owner to hand-create their own GitHub OAuth app. The natural-looking implementation was: default the address to `<handle>.cloudbongos.com` and extend the hub federation ([ADR 0141](<redacted>.md)) — which already gives co-tenant instances zero-setup sign-in — to standalone instances on that subdomain. A pre-build security review found this **UNSAFE** on two independent counts.
+
+### Finding 1 — the hub session cookie is shared across all `*.cloudbongos.com` (account takeover)
+
+The hub's `gds_session` cookie is issued with `Domain=.cloudbongos.com` on the apex/`builders.`/`status.` hosts, by design, so one sign-in is shared across those subdomains ([src/bongos/auth.js](../../src/bongos/auth.js): `SESSION_COOKIE`, `configuredCookieApex`, `sessionCookieDomainOpts`, the `res.cookie(SESSION_COOKIE, …)` call). A cookie with `Domain=.cloudbongos.com` is sent by the browser to **every** `*.cloudbongos.com` host — including an owner's `mercury.cloudbongos.com`. `httpOnly` does not help (it blocks `document.cookie`, not a server reading its own `req.headers.cookie`); `sameSite:lax` does not help (apex and subdomain are the **same registrable domain** = same site). So a standalone instance running **the owner's code** on a cloudbongos.com subdomain would receive the live hub session token of any signed-in visitor and could replay it against the hub → full account takeover. The neutral core ships `cookieDomain: ""` (host-only, safe); the **live hub must** set `.cloudbongos.com` for its own cross-subdomain sign-in, so the risk is real in production.
+
+The co-tenant instances that federate on cloudbongos.com subdomains today (e.g. `demo.cloudbongos.com`) are safe **only because they run platform-controlled code** ([modules/provisioning/provisioning.js](../../modules/provisioning/provisioning.js): `co-tenant` = a process on THIS control-plane checkout; `standalone` = the owner's OWN repo checkout). The precedent does **not** extend to owner code — it relies on exactly the first-party-code-on-every-subdomain property that owner code breaks. This is why [ADR 0141](<redacted>.md) §4 scoped federation to co-tenant.
+
+### Finding 2 — control-plane-local standalone runs owner code on the hub box, sudo-capable (pre-existing)
+
+A `standalone` runs **on the hub box** ([scripts/gds/provision.js](../../scripts/gds/provision.js): `standaloneBase`, control-plane-local IP) as the **same UID as the hub** (`serviceUnit` hardcodes `User=lars`), and its deploy runs `npm ci` (not `--ignore-scripts`) in a **passwordless-sudo-capable** runner context. A malicious owner could ship a `postinstall` and get code execution as `lars` with sudo on the hub box → the hub's signing key, every instance's secrets, the hub DB. This is a pre-existing property of running owner code on the hub box at all, independent of federation, but any free "run your code for you" tier would expose it at scale.
+
+The federation protocol itself is sound: the hub binds the minted audience to the instance's exact origin (the `#1002108` fix; asymmetric Ed25519 so one instance can't forge for another). A leaked per-instance client secret is contained to its own origin. The weakness is **placement** (shared cookie domain) and **execution** (owner code on the hub box), not the protocol.
+
+## Decision
+
+**Do not** put an owner-code instance on a bare `cloudbongos.com` subdomain, and **do not** extend federation to `standalone` as it exists today. A free "your-own-repo, works-out-of-the-box" tier is delivered **only** once both conditions the review identified are met:
+
+1. **Domain separation.** Free owner instances live under a **different registrable domain** than the hub (e.g. a dedicated `*.<apps-domain>`), so they are cross-site from cloudbongos.com and **never receive the `gds_session` cookie**. (Alternative: make the hub session cookie host-only on a dedicated auth host — but that breaks today's `builders.`/`status.` shared sign-in and is a larger redesign.)
+2. **Per-project isolation.** Owner code must not run as a sudo-capable, same-UID-as-hub process on the hub box: isolate each instance (its own droplet — the existing `dedicated` shape — or a container with a distinct UID, `npm ci --ignore-scripts`, verified-pinned-core-only, and no passwordless sudo in the deploy path).
+
+Only after (1)+(2) is the origin-bound, asymmetric federation ([ADR 0141](<redacted>.md) §4) safe to extend to these instances, giving the zero-setup sign-in.
+
+Points 1 & 2 of the same design review (drop the redundant Home-step "create repo" button; collapse the repo picker on select) were **unrelated to this and already shipped** ([task 1002247](https://cloudbongos.com/builders#/task/1002247)).
+
+## Decisions (owner — resolved 2026-07-15)
+
+- **Domain: keep `cloudbongos.com`** (no separate domain). The owner accepts the "same-site" tradeoff: because tenants (`<handle>.cloudbongos.com`) share the registrable domain with the hub, the browser's same-site protections between them are off, so **Finding 1 is closed by hardening core sign-in** (below) rather than by domain separation. This is the fragile/expert path — it needs strict, permanent cookie/CSRF/CORS hygiene, and one lapse reopens the takeover hole. (Rejected: the separate cloudbongos-branded sibling domain, e.g. `cloudbongos.app`, which the browser would treat as a different site and isolate for free — the industry-standard approach, à la `github.io`.)
+- **Isolation: containers.** Each tenant runs in its own container (distinct UID, `npm ci --ignore-scripts`, no passwordless sudo, not as `lars` on the hub box) — closes Finding 2.
+- **Cost: all-free for now.** Containers make many-instances-per-box cheap; a spend cap is revisited at scale ([§4](../../CLAUDE.md)).
+
+## Required build sequence (task 1002251)
+
+Keeping `cloudbongos.com` makes the sign-in hardening a **hard, security-critical prerequisite** — it changes sign-in for *every* user of the hub, so it lands and is verified on its own before any tenant is placed on a subdomain:
+
+1. **Harden core sign-in (FIRST).** Make `gds_session` a host-only `__Host-` cookie so tenant subdomains never receive it (Finding 1) and cannot toss a parent-domain cookie at the hub; **rework the `builders.`/`status.` shared sign-in** that currently depends on the `.cloudbongos.com`-scoped cookie ([src/bongos/auth.js](../../src/bongos/auth.js) `APEX_COOKIE_HOSTS`); add **CSRF tokens** across all state-changing hub endpoints (SameSite no longer defends against same-site tenants). Audit every hub cookie + CORS rule for `.cloudbongos.com` scope.
+2. **Container isolation.** Provision tenant instances in per-instance containers (distinct UID, `--ignore-scripts`, no sudo in the deploy path) — closes Finding 2.
+3. **Extend federation.** With 1+2 done, extend the origin-bound Ed25519 federation ([ADR 0141](<redacted>.md) §4) to these isolated same-domain instances for zero-setup sign-in.
+4. **Frontend.** Rebuild the `/create` Address step (the stashed redesign is the starting point) + the summary + the federated done-panel.
+
+## Consequences
+
+- The `/create` "free `<handle>.cloudbongos.com`, out of the box" flow is **not built**; the frontend redesign that assumed it is stashed, not shipped. Until this tier exists, `/create` stays own-repo + bring-your-own-domain (safe today).
+- Finding 2 (owner code as sudo-capable `lars` on the hub box) is a **standing risk for the current control-plane-local `standalone` shape** and should be hardened regardless of this tier.
+- If the cost model lands as "platform-subsidized free," a hard spend cap + a cheaper fallback (container isolation, or the co-tenant tier below) is required per [§4](../../CLAUDE.md).
+
+## Alternatives considered
+
+- **(A) Free co-tenant tier (rejected by owner for this ask).** A free `<handle>.cloudbongos.com` running **platform** code on the shared box (like `demo.cloudbongos.com`) is safe + $0 + already federates — but gives the user no separate repo of their own. Closest safe match to "free + out of the box," at the cost of "your own repo."
+- **(C) Keep today's model, honest copy (deferred).** Own repo + bring-your-own-domain, with the `/create` copy clarified (handle = platform name; domain = the real address, needed for sign-in). Safe and shippable now; delivers no free address.
+- **(B) — chosen:** free address + own repo, made safe via domain separation + isolation, accepting the cost. This ADR records why B is required to be safe and what it depends on.

package/docs/adr/0146-configurable-reward-mode-cost-plus-only.md

@@ -0,0 +1,53 @@
+# ADR 0146 — Configurable reward mode: `cost-plus-only` (retire the per-task estimate payout per-instance)
+
+**Date:** 2026-07-16
+**Status:** Accepted
+**Discipline:** engineer (GDS / economy)
+**Task:** [#1002270](https://cloudbongos.com/builders#/task/1002270) (BONGOS-V1, under goal 1000037)
+
+## Context — the problem
+
+A shipped task pays a builder from **two reward streams that land on the same balance**:
+
+1. **The per-task ESTIMATE** — `credits_reward × kind multiplier` ([ADR 0023](<redacted>.md)). A **unitless author estimate** set when the task is authored (or auto-assigned by the no-zero-reward backstop, ADR 0096). It is what a builder sees advertised at claim time, and — since [ADR 0120](<redacted>.md) — it books at ship as `credit_log.reason = 'task.shipped'`, plus a 25% idea-promotion slice ([ADR 0023](<redacted>.md)) to the idea's original capturer.
+2. **The cost-plus SESSION reward** — `round(true_cost_usd × 1.20)`, 1 drachma = $1 ([ADR 0054](<redacted>.md)). Grounded in the session's **real API spend**, booked as `session.token_reward`.
+
+[ADR 0054](<redacted>.md) named this the **"two drachma conventions, one ledger"** tension and explicitly flagged reconciling them as a deferred future-review trigger: one stream is unitless bounty points, the other is dollars, and they are summed into one `total_credits`. Goal 1000037 changed only *when* both pay (on land), never *whether* both pay.
+
+The owner's stated intent for Cloud Bongos is that **a credit means one dollar of cost-plus value and nothing else**. Under the two-stream model that is not true — roughly half of a shipped task's payout is the arbitrary estimate. The owner asked to make the cost-plus reward the **sole** equity reward for Cloud Bongos, and for that choice to be **configurable in the economy module** (so other instances are unaffected and can choose differently).
+
+## Decision
+
+Add a per-instance reward **mode** to the existing reward policy, resolved by the economy module.
+
+- **Config:** `branding.reward.mode` — a new field beside the existing `{ marginPct, usdPeg }` ([the branding contract](../branding-contract.md)):
+  - `"cost-plus-and-estimate"` — **the default.** Pay both streams, exactly as before. Every existing instance keeps its current behavior on upgrade with no config change.
+  - `"cost-plus-only"` — the cost-plus session reward is the **sole equity reward**; the per-task estimate payout is withheld.
+- **Resolution + gate — entirely inside the economy module** (`modules/economy/credits.js`):
+  - a new **pure** `rewardPolicy(rawReward)` maps the raw branding object → `{ marginPct, usdPeg, mode, perTaskCredit }`, where `perTaskCredit = mode !== 'cost-plus-only'`. `rewardConfig()` delegates to it. (Mirrors the pure/impure split of `computeSessionTokenReward`, so the mapping is unit-testable without touching the memoized `branding()` cache.)
+  - `insertMultipliedConfirmCredit(...)` — the **single** writer of the per-task estimate credit — short-circuits to a zero return (**no `credit_log` INSERT**) when `perTaskCredit` is false. Its `config` argument defaults to the resolved `rewardConfig()`; the sole live caller (`lifecycle` `awardLandingCredit`) omits it and gets the resolved instance policy per call.
+- **The idea-promotion slice cascades automatically.** `awardLandingCredit` passes the (now `0`) `creditsAwarded` into `maybeAwardIdeaPromotionBonus`, which already no-ops on a non-positive base — so a fraction of an unpaid estimate is correctly `0`, with **zero lifecycle changes**.
+- **The estimate is preserved as an advertised guide, not a payout.** `tasks.credits_reward` still rides the row: it is shown at claim time and still drives the no-zero-reward claim gate (ADR 0096). Only the *payout* is suppressed.
+- **Fail-safe default.** An unknown / garbage `mode` resolves to the default (pay both). A config typo can never silently zero out every builder's per-task reward.
+
+**Cloud Bongos selects `cost-plus-only`.** Other instances (including the reference founder instance) keep the default and are untouched.
+
+## What this does NOT change
+
+- **The cost-plus session reward** — untouched. Same formula, same `marginPct`/`usdPeg`, same `session.token_reward` path. In `cost-plus-only` mode it is simply the only equity stream.
+- **Achievements and the net-negative (+1 simplification) ship bonus** — deliberately **out of scope**. They are a separate, small behavioral-nudge category (badges + a symbolic +1), not the per-task estimate. If a future owner wants literally *nothing but* cost-plus, gating those is a one-line follow-up; this ADR does not.
+- **The `KIND_MULTIPLIERS` table and `credits_reward` semantics** — unchanged. The multiplier is still computed (for the return shape / audit) even when the payout is withheld.
+
+## Consequences
+
+- **Backward-compatible by construction.** Absence of `mode` ⇒ default ⇒ current behavior. No migration, no data change.
+- **Reversible.** Flipping `mode` back to the default resumes per-task payouts from the next ship; nothing is destroyed. (Historical rows are untouched — this is not a clawback; see [ADR 0120](<redacted>.md) part 4 for the separate one-time backlog re-gate.)
+- **Builder-facing expectation gap (follow-up).** ~~In `cost-plus-only` mode the "Est." shown at claim time is a *guide*, not a promise — the builder is actually paid the cost-plus amount. Surfacing "this instance pays cost-plus only" in the hall / claim UI is a captured follow-up idea, not part of this task.~~ **Resolved by task [#1002469](https://cloudbongos.com/builders#/task/1002469).** The gap was not theoretical: it cost a real session on 2026-07-26, where a correct `Credits +0` was diagnosed as a broken reward gate. The resolved policy is now exposed on the `reward` port (`rewardConfig`), projected onto `clientBranding()` for the hall and returned on `GET /me` + `POST /claims` for the CLI — **the CLI must take it from the server**, since an instance's `config/branding.json` is not in a builder's checkout and a local read always reports the paying default. Claim, `/builder-start`, the ship card, and the hall now label the estimate as an estimate and name the real payer. The hall fix also closed a live misread: `taskCreditValue` falls back to the estimate when a settled task has `credits_awarded === 0` — which under `cost-plus-only` is *every* shipped task — so the plain label was presenting an unpaid estimate as the actual ledger payout.
+- **The two-conventions tension is resolved for `cost-plus-only` instances** (one dollar-denominated stream) and left intact for default instances — the ADR 0054 trigger is addressed by *config*, not by forcing one model on everyone.
+
+## Alternatives considered
+
+- **A boolean `reward.perTaskCredit`** instead of a `mode` enum. Rejected: `"cost-plus-only"` reads self-documentingly at the config site and in prose (it is the vocabulary the decision was made in), and the enum extends cleanly if a third policy is ever wanted. The code derives the boolean internally.
+- **Gate in the lifecycle (`awardLandingCredit`) via a port predicate.** Rejected: it would spread economy policy across the kernel↔module boundary. The knob belongs *inside the economy module* (the owner's explicit ask); gating the single credit writer keeps it there and needs no lifecycle change.
+- **Remove `credits_reward` / stop advertising an estimate entirely.** Rejected: the estimate is still useful as a claim-time guide and is load-bearing for the no-zero-reward claim gate. Suppress the *payout*, keep the *signal*.
+- **Make the cost-plus reward the only stream globally (no knob).** Rejected: the core ships to instances that may legitimately want the bounty-style per-task reward. A per-instance knob with a backward-compatible default respects the core ↔ host split (ADR 0062 §7).