@bongos/core 1.19.1032 → 1.19.1034

package/modules/lifecycle/dependency-advisory.js

@@ -21,7 +21,8 @@
 //      `node scripts/gds/audit-deps.js --min high` as one more housekeeping
 //      step (idea 1000276's half — see .claude/skills/goal-review/SKILL.md).
 //
-// HARD CONSTRAINT, same as goal-advisory.js and ADR 0162: advisory only. This
+// HARD CONSTRAINT, same as goal-advisory.js: advisory only (a finding addressed
+// to a human never acts by itself — ADR 0158 §2). This
 // must never refuse a POST, and `buildDependencyAdvisory` swallows its own
 // failures for the same reason goal-advisory.js's does — the task row is
 // ALREADY COMMITTED by the time this runs, so a throw here would turn a

package/modules/lifecycle/routes/tasks.js

@@ -53,6 +53,11 @@ const githubPush = require('../github-push');
 const prAssign = require('../pr-assign');
 const shipAssurance = require('../ship-assurance');
 const RECONCILE_PROOF = Object.freeze({ kind: 'proof', reason: 'publish-status reconcile: land proven' });
+// task 1003764: publish-status with no ?branch= and no PR titled for the task — the shape
+// getPublishStatus gives a branch with no PR, plus how to ask about one. Never a 400.
+const NO_PR_STATUS = Object.freeze({
+  pr_state: 'none', merged: false, merge_sha: null, deploy_status: 'none', pr_url: null, pr_number: null, pr_title: null, pr_body: null,
+  branch_hint: 'No pull request titled for this task is among the 100 most recent. Pass ?branch=<name> to ask about a specific branch.' });
 const seams = api;
 const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, VOTABLE_TASK_STATUSES, TASK_FIELD_BOUNDS } = require('../task-classifier');
 const { isModuleKey, moduleKeys } = api.moduleScopeMap;
@@ -1250,15 +1255,25 @@ module.exports = function buildTasksRouter() {
   // GET /tasks/:id/publish-status?branch=<branch> — poll the PR + prod-deploy
   // state for a server-mediated publish so ship.js can confirm the land WITHOUT
   // gh on the box. Ownership-gated like the POST. Derives state live from GitHub.
+  // `branch` is optional (task 1003764): without it the server finds the task's own PR
+  // (both publish paths title it "task <id>: …") and the answer names the `branch` it
+  // used and its `branch_source`, so the check agents are sent to instead of git probes
+  // never refuses a live publish for want of a branch name.
   router.get('/tasks/:id/publish-status', auth.requireBuilder, async (req, res) => {
     const id = parseId(req, res, { code: 'bad_task_id' });
     if (id === null) return;
     if (!(await gateTaskOwnership(req, res, id))) return;
     if (!githubPush.isConfigured()) return res.fail('push_unconfigured', { status: 503, message: PUSH_UNCONFIGURED_MSG });
-    const branch = req.query.branch;
-    if (!githubPush.isSafeBranch(branch)) return res.fail('bad_branch', 400);
+    // A fully-qualified ref names the same branch, so it is accepted rather than refused.
+    const asked = typeof req.query.branch === 'string' ? req.query.branch.replace(/^refs\/heads\//, '') : req.query.branch;
+    if (asked != null && asked !== '' && !githubPush.isSafeBranch(asked)) {
+      return res.fail('bad_branch', { status: 400, message: 'branch must be a plain branch name such as task-123, or left out so the server finds the task\'s own PR.' });
+    }
     try {
-      const status = await githubPush.getPublishStatus({ branch });
+      const found = asked ? null : await githubPush.findTaskPullRequest({ taskId: id });
+      const branch = asked || (found && found.branch) || null;
+      const branch_source = asked ? 'query' : (branch ? 'task_pr' : null);
+      const status = branch ? await githubPush.getPublishStatus({ branch }) : NO_PR_STATUS;
       // task 1049 (B — server-side reconcile-on-read): when GitHub shows the PR
       // MERGED and deploy-prod SUCCEEDED, finish the task right here so a
       // confirmed-but-unshipped task never strands waiting on a human to re-poll
@@ -1318,7 +1333,7 @@ module.exports = function buildTasksRouter() {
           log.error('[gds] publish-status merge-driver (non-blocking):', e && e.message);
         }
       }
-      return res.json({ ok: true, ...status, reconciled, reconcile_blocked, merge_driver });
+      return res.json({ ok: true, ...status, branch, branch_source, reconciled, reconcile_blocked, merge_driver });
     } catch (e) {
       if (e.code === 'NO_REPO_INFO') return res.fail('no_repo_info', 500);
       if (e.code === 'APP_NOT_INSTALLED') return res.fail('push_unconfigured', { status: 503, message: appNotInstalledMessage(e) });

package/modules/lifecycle/ship-preflight.js

@@ -15,6 +15,9 @@
 //      touches[] was empty, leaving empty-touches tasks unprotected — with this
 //      plain clean-tree check. Strictly stronger; untracked / .gitignored files
 //      are ignored so autonomous sessions with scratch files aren't refused.)
+//      Ignored, but no longer UNMENTIONED: untrackedLeftBehind +
+//      untrackedWarningLines (task 1001436) name the untracked files a ship
+//      with committed work is about to leave behind, as a warning only.
 //
 //   2. cleanupMacFinderDupRefs  — find + delete `.git/refs/.../FOO 2` files
 //      that macOS Finder / iCloud creates when it duplicates a regular file
@@ -96,6 +99,91 @@ function classifyEmptyShip(porcelainOut, { allowEmpty = false } = {}) {
   return { refuse: true, reason: 'nothing-to-ship', uncommitted: [] };
 }
 
+// ---- The RESIDUAL phantom ship (task 1001436) --------------------------------
+//
+// classifyEmptyShip closes the case where NOTHING is committed and the
+// deliverable sits uncommitted. It cannot see the weaker case beside it: the
+// builder commits real work, so the branch is ahead of main and the ship goes
+// ahead, but one more NEW file was never `git add`ed. The merge carries only
+// committed history, so that file silently does not ship — the task reads
+// "shipped" with part of its artifact missing, and nothing said so.
+//
+// The answer is a loud WARNING, never a refusal. trackedDirty ignores untracked
+// files on purpose: autonomous sessions leave scratch in the tree, and refusing
+// on it would false-refuse real ships. So this only names the files — before the
+// grade and the merge, while stopping is still free.
+//
+// SCOPE. The filing suggested narrowing the list to touches[] or to docs/ src/
+// scripts/. Neither is used, because each hides exactly the file this exists to
+// catch: touches[] is advisory and often empty, and a forgotten file is by
+// definition one nobody thought to declare; a directory allowlist misses tests/,
+// modules/ and migrations/, where a forgotten new file most often lives (a new
+// test beside a committed fix). The one SYSTEMATIC source of noise is the ship's
+// own input — the builder-ship skill writes notes.md + summary.txt into the tree
+// and passes them as --notes-file / --summary-file — so those are excluded
+// exactly, by path, via `inputs`. Surveyed before choosing (2026-09-25, 16 live
+// worktrees): 12 untracked entries, none of them root-level scratch, and 5 under
+// tests/ or modules/ — where a docs/ src/ scripts/ allowlist would have hidden them.
+
+// Pure: the untracked ('??') paths in raw `git status --porcelain` output, in
+// output order. .gitignored files never appear without --ignored, so this is
+// exactly "untracked and not ignored". Quoted paths are unquoted the same way
+// parsePorcelain does it.
+function untrackedPaths(porcelainOut) {
+  if (!porcelainOut) return [];
+  const files = [];
+  for (const raw of porcelainOut.split('\n')) {
+    if (raw.slice(0, 2) !== '??') continue;
+    const file = raw.slice(3).replace(/^"|"$/g, '');
+    if (file) files.push(file);
+  }
+  return files;
+}
+
+// One spelling for a repo-relative path, so an input given as `./notes.md` or
+// with Windows separators still matches porcelain's `notes.md`.
+function normalizeRelPath(p) {
+  return String(p || '').replace(/\\/g, '/').replace(/^(\.\/)+/, '');
+}
+
+// Pure: which untracked files will be LEFT BEHIND by this ship.
+//   committedFileCount — files in the branch's committed diff vs the grader
+//     baseline. Zero returns [] on purpose: with nothing committed,
+//     classifyEmptyShip already REFUSES and lists these same files, and a second
+//     message about them would only compete with the refusal.
+//   inputs — repo-relative paths the ship itself was handed (notes, summary,
+//     response, visual). They are inputs to the ship, not deliverables.
+function untrackedLeftBehind(porcelainOut, { committedFileCount = 0, inputs = [] } = {}) {
+  if (!(Number(committedFileCount) > 0)) return [];
+  const skip = new Set((inputs || []).map(normalizeRelPath).filter(Boolean));
+  return untrackedPaths(porcelainOut).filter((f) => !skip.has(normalizeRelPath(f)));
+}
+
+// Pure: the warning block for untrackedLeftBehind's result; [] when there is
+// nothing to say. `cap` bounds the listing so a tree full of scratch cannot bury
+// the rest of the ship output. The wording holds on all three preflight callers
+// (first ship, --regrade, the confirmed-task resume): each runs this before it
+// resolves, grades or merges anything.
+function untrackedWarningLines(files, { taskId = null, cap = 15 } = {}) {
+  if (!files || files.length === 0) return [];
+  const n = files.length;
+  const task = taskId != null && taskId !== '' ? ` with task ${taskId}` : '';
+  const lines = [
+    '',
+    `⚠ Untracked-file warning: ${n} untracked file(s) in this worktree will NOT ship${task}:`,
+  ];
+  for (const f of files.slice(0, cap)) lines.push(`    - ${f}`);
+  if (n > cap) lines.push(`    … and ${n - cap} more`);
+  lines.push(
+    '  The merge carries committed work only, so these stay behind.',
+    '  If one of them belongs to this task: stop now (Ctrl-C — nothing has been resolved at this step),',
+    '  commit it, and re-run. If they are scratch, ignore this.',
+    '  Warning only — not blocking; the ship proceeds.',
+    '',
+  );
+  return lines;
+}
+
 function gitDirFor(cwd) {
   // Resolve the *actual* refs directory for a given worktree. In a linked
   // worktree, `.git` is a file containing `gitdir: <path>` that points at
@@ -218,6 +306,9 @@ module.exports = {
   parsePorcelain,
   trackedDirty,
   classifyEmptyShip,
+  untrackedPaths,
+  untrackedLeftBehind,
+  untrackedWarningLines,
   cleanupMacFinderDupRefs,
   gitDirFor,
   findMainWorktree,

package/modules/provisioning/control-plane-guard.js

@@ -24,6 +24,8 @@
 // that file sits on the oversized-file ratchet; a guard whose whole value is being
 // read before it is edited should not be the thing that reds the build either.
 
+const { PublicRefusal } = require('./public-refusal');
+
 // The only acts that cannot destroy the box they run on.
 //
 //   core-upgrade — moves the pin, health-gated, auto-rollback on failure. This is
@@ -86,25 +88,24 @@ function intentAllowedForShape(action, hostingShape) {
  * @param {{query: Function}} db
  * @param {number|string} instanceId
  * @param {string} action  an INTENT_ACTIONS member
- * @throws {Error} code 'control_plane_protected'
+ * @throws {PublicRefusal} code 'control_plane_protected', status 409
  */
 async function assertIntentAllowed(db, instanceId, action) {
   const { rows } = await db.query(
     'SELECT hosting_shape FROM provisioning_instances WHERE id = $1', [instanceId]);
   const shape = rows[0] && rows[0].hosting_shape;
   if (!shape || intentAllowedForShape(action, shape)) return;
-  // It carries the { code, status, message } shape credential-preflight.js established,
-  // so a route that wants to answer 409 with the sentence can, without re-deriving it.
-  // NO ROUTE MAPS IT TODAY, and that is the honest state rather than an oversight: every
-  // action that can reach this throw has its own earlier refusal, so arriving here means
-  // a route forgot one — a bug in us, not a thing the caller did. A 500 plus a logged
-  // stack is the right loudness for that, and the fields are here so the day a route
-  // legitimately needs to say it to a person, the wording is already written.
-  const err = new Error(`'${action}' cannot be aimed at the control plane — only ${CONTROL_PLANE_ACTIONS.join(' and ')} may run against the box the platform itself runs on`);
-  err.code = 'control_plane_protected';
-  err.status = 409;
-  err.publicMessage = `That action cannot be aimed at the machine the platform itself runs on. Only ${CONTROL_PLANE_ACTIONS.join(' and ')} are allowed there.`;
-  throw err;
+  // A PublicRefusal, so every route answers it as a 409 in the owner's words (task
+  // 1004126). This used to rest on "every action that can reach this throw has its own
+  // earlier refusal", and that did not hold: teardown, force-teardown and disconnect reach
+  // it with none, and the owner read "internal error". Each route still logs the stack, so
+  // a route that forgot its own check stays as visible to us as it was.
+  throw new PublicRefusal({
+    code: 'control_plane_protected',
+    status: 409,
+    publicMessage: `That action cannot be aimed at the machine the platform itself runs on. Only ${CONTROL_PLANE_ACTIONS.join(' and ')} are allowed there.`,
+    message: `'${action}' cannot be aimed at the control plane — only ${CONTROL_PLANE_ACTIONS.join(' and ')} may run against the box the platform itself runs on`,
+  });
 }
 
 module.exports = { CONTROL_PLANE_ACTIONS, intentAllowedForShape, assertIntentAllowed };

package/modules/provisioning/core-upgrade.js

@@ -29,6 +29,7 @@
 // AT the 1500-line fitness ratchet, and at that ceiling a new function costs more
 // than the build will give back.
 
+const { failFrom } = require('./public-refusal');
 
 // Exactly the states in which there is a running instance whose pin can move.
 // Narrower than RESTART_FROM on purpose: an instance mid-standup has no settled pin
@@ -209,18 +210,10 @@ function makeCoreUpgradeHandler({ provisioning, pool, parseId, validateOrRespond
       });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/core-upgrade', err);
-      // A REFUSAL IS NOT AN OUTAGE. The control-plane guard throws an error carrying
-      // `code`, `status` and a `publicMessage` it wrote for exactly this moment — and
-      // this catch used to discard all three, so every guard refusal reached the owner
-      // as a 500 "internal error" while the real sentence sat in the journal. Nothing
-      // in the repo honoured `publicMessage`; it was assigned once and read never
-      // (task 1004125). Only an error that has already declared itself public is
-      // forwarded — anything else still gets the opaque 500, because an unexpected
-      // throw may carry anything.
-      if (err && err.publicMessage && err.code && err.status) {
-        return res.fail(err.code, { status: err.status, message: err.publicMessage });
-      }
-      return res.fail('core_upgrade_failed', { status: 500, message: 'internal error' });
+      // A REFUSAL IS NOT AN OUTAGE (task 1004125): a guard refusal reaches the owner as
+      // its own sentence, and an unexpected throw, which may carry anything, stays the
+      // opaque 500. The one definition of "public" is public-refusal.js (task 1004126).
+      return failFrom(res, err, 'core_upgrade_failed');
     }
   };
 }
@@ -256,6 +249,23 @@ function lastMoveSuperseded(target, served, recommended) {
   return !!(recommended && String(recommended) !== String(target));
 }
 
+/**
+ * The note a DONE move carries when the upgrade landed but its pin never reached the
+ * project's GitHub repo (task 1004065) — `{ code, text }`, or null. PURE.
+ *
+ * The runner writes it into the intent's last_error as `repo_not_updated:<code>: <text>`
+ * (scripts/gds/provision-core-upgrade.js repoNote; re-stated here because a module may
+ * not require a script, and round-tripped by tests/core_upgrade_runner.mjs). ONLY that
+ * shape is read: any other text on a done row is not turned into a warning, because
+ * inventing one would tell an owner their repo is stale on no evidence.
+ */
+const REPO_NOTE_RE = /^repo_not_updated:([a-z_]+): ([\s\S]+)$/;
+function parseRepoNote(text) {
+  const m = REPO_NOTE_RE.exec(String(text || ''));
+  // Bounded because it reaches a DOM, like the error beside it.
+  return m ? { code: m[1], text: m[2].slice(0, 600) } : null;
+}
+
 /**
  * The cached dry-run verdict, IF it is about the move now on offer. PURE (task 1004173).
  *
@@ -344,8 +354,11 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
       // versions, and this is a version question wearing a different hat.
       superseded: lastMoveSuperseded(lastMove.target_version, served, recommended),
       // Truncated because it reaches a DOM and upgrade.js's refusals can carry a whole
-      // `git status` (the dirty-tree one lists every file).
-      error: lastMove.last_error ? String(lastMove.last_error).slice(0, 600) : null,
+      // `git status` (the dirty-tree one lists every file). Never set on a DONE move:
+      // a done row's last_error is the note below, and a move that worked is not an error.
+      error: lastMove.state !== 'done' && lastMove.last_error ? String(lastMove.last_error).slice(0, 600) : null,
+      // It LANDED, but GitHub did not get the new pin (task 1004065) — parseRepoNote.
+      warning: lastMove.state === 'done' ? parseRepoNote(lastMove.last_error) : null,
     } : null,
   };
 }
@@ -379,7 +392,7 @@ function makeCoreUpgradePreviewHandler({ provisioning, pool, parseId, log }) {
       return res.json({ ok: true, preview: await loadPreview(pool, provisioning, inst) });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id/core-upgrade', err);
-      return res.fail('core_upgrade_preview_failed', { status: 500, message: 'internal error' });
+      return failFrom(res, err, 'core_upgrade_preview_failed');
     }
   };
 }
@@ -410,10 +423,10 @@ function makeControlPlaneHandler({ provisioning, pool, log }) {
       return res.json({ ok: true, preview: await loadPreview(pool, provisioning, rows[0]) });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/control-plane', err);
-      return res.fail('control_plane_read_failed', { status: 500, message: 'internal error' });
+      return failFrom(res, err, 'control_plane_read_failed');
     }
   };
 }
 
-module.exports = { CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+module.exports = { CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
 

package/modules/provisioning/public-refusal.js

@@ -0,0 +1,44 @@
+'use strict';
+// modules/provisioning/public-refusal.js — the one definition of an error written for the
+// person who asked, and the one way a catch in this module answers (task 1004126).
+//
+// WHY. A refusal such as the control-plane guard's carries a code, a 4xx and a sentence
+// written for the owner. Every catch in this module used to answer a blanket 500
+// "internal error" instead, so the owner never read that sentence; it went only to the
+// journal. Forwarding every thrown error would be worse, because a Postgres error names
+// tables. So an error has to DECLARE itself public by being a PublicRefusal, and
+// everything else still gets today's opaque 500.
+//
+// A CLASS, NOT A DUCK TYPE. Task 1004125 fixed one catch by testing
+// `code && status && publicMessage`, which anything can carry by accident. The class is
+// the single definition of "public"; failFrom is the single place that honours it.
+
+// A refusal a route may repeat to the person verbatim. `publicMessage` is theirs;
+// `message` stays in the journal (it defaults to the public sentence). A refusal is never
+// an outage, so the status must be a 4xx.
+class PublicRefusal extends Error {
+  constructor({ code, status, publicMessage, message } = {}) {
+    if (!(Number.isInteger(status) && status >= 400 && status < 500)) {
+      throw new TypeError(`a PublicRefusal is a 4xx, got ${status}: an outage is not a refusal`);
+    }
+    if (!code || !publicMessage) throw new TypeError('a PublicRefusal needs a code and a publicMessage');
+    super(message || publicMessage);
+    this.name = 'PublicRefusal';
+    this.code = code;
+    this.status = status;
+    this.publicMessage = publicMessage;
+  }
+}
+
+function isPublicRefusal(err) {
+  return err instanceof PublicRefusal;
+}
+
+// failFrom — answer a caught error: a PublicRefusal as its own code, status and public
+// sentence; anything else as the opaque 500 under the route's own fallbackCode.
+function failFrom(res, err, fallbackCode) {
+  if (isPublicRefusal(err)) return res.fail(err.code, { status: err.status, message: err.publicMessage });
+  return res.fail(fallbackCode, { status: 500, message: 'internal error' });
+}
+
+module.exports = { PublicRefusal, isPublicRefusal, failFrom };

package/modules/provisioning/routes/disconnect.js

@@ -11,6 +11,7 @@ const api = require('../../../src/module-api');
 const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const disconnect = require('../disconnect');
+const { failFrom } = require('../public-refusal');
 
 const log = api.logger('provisioning');
 
@@ -55,7 +56,7 @@ module.exports = function buildDisconnectRouter() {
           : 'A disconnect is already queued for this project.' });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/disconnect', err);
-      res.fail('disconnect_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'disconnect_failed');
     }
   });
 

package/modules/provisioning/routes/env-manifest.js

@@ -24,6 +24,7 @@ const api = require('../../../src/module-api');
 const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const envManifest = require('../env-manifest');
+const { failFrom } = require('../public-refusal');
 
 const log = api.logger('provisioning');
 
@@ -119,7 +120,7 @@ module.exports = function buildEnvManifestRouter() {
       });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id/env-manifest', err);
-      res.fail('env_manifest_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'env_manifest_failed');
     }
   });
 
@@ -147,7 +148,7 @@ module.exports = function buildEnvManifestRouter() {
       res.status(created ? 201 : 200).json({ ok: true, created, env_var: row, values_held: false });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/env-manifest', err);
-      res.fail('env_manifest_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'env_manifest_failed');
     }
   });
 
@@ -174,7 +175,7 @@ module.exports = function buildEnvManifestRouter() {
       res.json({ ok: true, env_var: row, values_held: false });
     } catch (err) {
       log.error('[provisioning] PATCH /provisioning/instances/:id/env-manifest/:varId', err);
-      res.fail('env_manifest_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'env_manifest_failed');
     }
   });
 
@@ -193,7 +194,7 @@ module.exports = function buildEnvManifestRouter() {
         message: 'Declaration removed. The variable\'s value, wherever you keep it, is untouched — this platform never had it.' });
     } catch (err) {
       log.error('[provisioning] DELETE /provisioning/instances/:id/env-manifest/:varId', err);
-      res.fail('env_manifest_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'env_manifest_failed');
     }
   });
 

package/modules/provisioning/routes/provisioning.js

@@ -62,6 +62,7 @@ const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285,
 const { callbackPage } = require('./callback-page');
 // the LOUD body validators (task 1003504) — lifted out when this file hit the size ratchet
 const { badProjectDetail, badModuleSelection, badProjectType } = require('./body-validators');
+const { failFrom } = require('../public-refusal');   // every catch: a declared refusal reaches the owner, anything else stays opaque (task 1004126)
 // the kernel ports this module provides (moved out at the size ratchet, task 1003578)
 const { registerProvisioningSeams } = require('../seams');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
@@ -211,7 +212,7 @@ module.exports = function provisioningRoutes() {
       res.json({ instances: rows.map(fleetInstance), capacity: await capacity.fleetCapacity(pool).catch(() => null) });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/fleet', err);
-      res.fail('fleet_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'fleet_failed');
     }
   });
 
@@ -226,7 +227,7 @@ module.exports = function provisioningRoutes() {
       res.json(out);
     } catch (err) {
       log.error('[provisioning] GET /provisioning/fleet/cost-ledger', err);
-      res.fail('cost_ledger_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'cost_ledger_failed');
     }
   });
 
@@ -279,7 +280,7 @@ module.exports = function provisioningRoutes() {
         message: r.created ? 'The instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/force-teardown', err);
-      res.fail('teardown_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'teardown_failed');
     }
   });
 
@@ -518,7 +519,7 @@ module.exports = function provisioningRoutes() {
       // Another instance took the address between the check above and the INSERT (task 1002901).
       if (provisioning.isDomainTaken(err)) return res.fail('domain_taken', { status: 409, message: 'That address is already held by another instance.' });
       log.error('[provisioning] POST /provisioning/instances', err);
-      res.fail('request_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'request_failed');
     }
   });
 
@@ -566,7 +567,7 @@ module.exports = function provisioningRoutes() {
       res.json({ slug, available: reason === null, reason, address: address || null });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/slug-available', err);
-      res.fail('check_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'check_failed');
     }
   });
 
@@ -586,7 +587,7 @@ module.exports = function provisioningRoutes() {
       res.json({ instances });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances', err);
-      res.fail('list_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'list_failed');
     }
   });
 
@@ -630,7 +631,7 @@ module.exports = function provisioningRoutes() {
       });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id', err);
-      res.fail('read_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'read_failed');
     }
   });
 
@@ -750,7 +751,7 @@ module.exports = function provisioningRoutes() {
       });
     } catch (err) {
       log.error('[provisioning] PATCH /provisioning/instances/:id/detail', err);
-      res.fail('detail_update_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'detail_update_failed');
     }
   });
 
@@ -805,7 +806,7 @@ module.exports = function provisioningRoutes() {
       res.json({ suggested, seeking: invites.seeking, reason: invites.reason });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id/invite-suggestions', err);
-      res.fail('invite_suggestions_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'invite_suggestions_failed');
     }
   });
 
@@ -830,7 +831,7 @@ module.exports = function provisioningRoutes() {
         options: { ...provisioning.SETTINGS_VOCAB, ...provisioning.PLANET_VOCAB } });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id/settings', err);
-      res.fail('settings_read_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'settings_read_failed');
     }
   });
 
@@ -983,7 +984,7 @@ module.exports = function provisioningRoutes() {
       res.json({ ok: true, saved: provisioning.effectiveSettings(updated), planet: provisioning.planetChoice(updated), push });
     } catch (err) {
       log.error('[provisioning] PATCH /provisioning/instances/:id/settings', err);
-      res.fail('settings_update_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'settings_update_failed');
     }
   });
 
@@ -1020,7 +1021,7 @@ module.exports = function provisioningRoutes() {
         message: r.created ? 'Your instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/teardown', err);
-      res.fail('teardown_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'teardown_failed');
     }
   });
 
@@ -1079,7 +1080,7 @@ module.exports = function provisioningRoutes() {
         : 'A restart is already under way for this project.' });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/restart', err);
-      res.fail('restart_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'restart_failed');
     }
   });
 
@@ -1224,7 +1225,7 @@ module.exports = function provisioningRoutes() {
       // Same race on the attach side: the index refuses the UPDATE, so nothing is recorded and nothing is enqueued.
       if (provisioning.isDomainTaken(err)) return res.fail('domain_taken', { status: 409, message: 'That address is already in use by another instance.' });
       log.error('[provisioning] POST /provisioning/instances/:id/domain', err);
-      res.fail('domain_attach_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'domain_attach_failed');
     }
   });
 
@@ -1282,7 +1283,7 @@ module.exports = function provisioningRoutes() {
       });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/github-app', err);
-      res.fail('github_app_manifest_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'github_app_manifest_failed');
     }
   });
 

package/modules/provisioning/routes/repo-private.js

@@ -16,6 +16,7 @@ const api = require('../../../src/module-api');
 const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const repoPrivate = require('../repo-private');
+const { failFrom } = require('../public-refusal');
 
 const log = api.logger('provisioning');
 
@@ -74,7 +75,7 @@ module.exports = function buildRepoPrivateRouter() {
           : 'Making the repository private is already under way for this project.' });
     } catch (err) {
       log.error('[provisioning] POST /provisioning/instances/:id/repo-private', err);
-      res.fail('repo_private_failed', { status: 500, message: 'internal error' });
+      failFrom(res, err, 'repo_private_failed');
     }
   });
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1032",
+  "version": "1.19.1034",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1032",
+      "version": "1.19.1034",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1032",
+  "version": "1.19.1034",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",