@bongos/core 1.19.1035 → 1.19.1037

package/modules/hall-ui/public/studio.html

@@ -66,7 +66,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -171,7 +171,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-25-sky4b"></script>
+<script src="/builders/shell.js?v=2026-09-26-own1"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/lifecycle/db-ship.js

@@ -277,9 +277,9 @@ async function resolveClaim({ claimId, builderId, outcome, notesMd, valueSummary
     // The ordering below is NOT for the grader, whatever this comment used to
     // say. V3.R18 (#209) moved the grader out of resolveClaim — see the block
     // after this one — and the live panel never receives actual_minutes at all
-    // (modules/grading/grader-prompt.js buildPrompt prints est_minutes only;
-    // scoreEstActualBand lives in gradeDeterministic, whose one non-test caller
-    // is the retroactive audit in scripts/gds/audit-ships.js). The seal must
+    // (modules/grading/grader-prompt.js buildPrompt prints est_minutes only; the
+    // one scorer that read actual_minutes was retired with the v1 grader in task
+    // 1002842). The seal must
     // still precede the recompute, because the recompute SUMs the row it writes.
     // tests/regrade_actual_minutes.mjs pins the panel half of that.
     await sealSessionLog(client, {

package/modules/provisioning/core-upgrade-authz.js

@@ -0,0 +1,85 @@
+'use strict';
+
+// modules/provisioning/core-upgrade-authz.js — who may move ONE hosted project's core
+// pin: its owner, or a holder of `core.pin.move` (task 1004174, ADR 0339).
+//
+// THE OWNER'S RULING, 2026-09-26: only a project's owner upgrades it — "owners and
+// archons are the same" for the platform operator, because the operator owns the
+// platform. Until this file the deploy door was `core.pin.move` alone: archon-floor
+// and system:true, so the owner of a hosted project below Archon could see that they
+// were behind and could never act on it. The door stays on the control plane (ADR
+// 0293 D1): a hosted project hands its owner off to this hub's /deploy?project=<slug>
+// and gains no capability of its own.
+//
+// THE SHAPE IS THE ONE THE MODULE ALREADY USES FOR "OWNER OR OPERATOR" (ADR 0328
+// Decision 2, and platform-identity's requireScoutingReader, ADR 0210). Ownership is
+// asked FIRST; on any "no" — not the owner, no such row, an unreadable id, a database
+// blip — the request falls through to the UNMODIFIED permission gate. So a caller who
+// is neither gets byte-for-byte the refusal the door has always given, whether or not
+// the id exists, and the widening can only ever admit. The atom is still spelled in
+// the route's middleware list, where route-rank-check.js and gen-api-docs.js read it.
+//
+// THE PLATFORM'S OWN ROW IS NOT A PROJECT AN OWNER MAY MOVE HERE. Moving the control
+// plane changes the code every hosted project is driven by, so it stays on the atom:
+// OWNER_SHAPES admits the two tenant shapes and nothing else, and a shape added later
+// is excluded by omission.
+
+// The tenant shapes the runner can actually reach (UPGRADE_SHAPES minus the platform).
+const OWNER_SHAPES = Object.freeze(new Set(['co-tenant', 'cloud-host']));
+
+// An id as the route names it: a positive integer and nothing else. Anything else is
+// not looked up at all — it falls to the permission gate, and the handler's own
+// parseId gives the 400 an admitted caller would get.
+const ID_RE = /^[1-9][0-9]{0,15}$/;
+
+/**
+ * Does this builder own this instance in a way that lets them move its core? PURE.
+ * Fail-closed on every missing piece: no row, no builder, no recorded owner, or a
+ * shape that is not a tenant.
+ */
+function ownsUpgradableProject(inst, builder) {
+  return !!inst && !!builder && builder.id != null
+    && OWNER_SHAPES.has(inst.hosting_shape)
+    && inst.owner_builder_id != null
+    && String(inst.owner_builder_id) === String(builder.id);
+}
+
+/**
+ * The OR gate, as one middleware mounted after requireBuilder. `pinGate` is the
+ * ALREADY-BUILT `requirePermission('core.pin.move')` middleware.
+ *
+ * It records WHICH door admitted the caller on `req.coreUpgradeAuthority`, because
+ * the intent's actor has to say so truthfully (coreUpgradeActor below).
+ */
+function requireOwnProjectOrPin({ pinGate, provisioning, pool, log }) {
+  return async function ownProjectOrPinGate(req, res, next) {
+    const raw = req.params ? req.params.id : undefined;
+    if (typeof raw === 'string' && ID_RE.test(raw)) {
+      try {
+        const inst = await provisioning.getInstanceById(pool, Number(raw));
+        if (ownsUpgradableProject(inst, req.builder)) {
+          req.coreUpgradeAuthority = 'owner';
+          return next();
+        }
+      } catch (err) {
+        // Message only: a query error can carry row data. The permission gate below
+        // then decides, so a blip here can deny an owner but never admit anyone.
+        if (log && log.error) log.error(`core-upgrade owner check failed, falling back to core.pin.move: ${err && err.message}`);
+      }
+    }
+    req.coreUpgradeAuthority = 'pin';
+    return pinGate(req, res, next);
+  };
+}
+
+/**
+ * The actor recorded on the intent and the event. Both forms carry the builder id,
+ * because the runner hands it to the core_upgrades ledger as `--requested-by` and
+ * ADR 0293 D5 refuses an unattributed row for a move an HTTP request started.
+ */
+function coreUpgradeActor(req) {
+  const door = req.coreUpgradeAuthority === 'owner' ? 'owner' : 'archon';
+  return `api:${door}:${req.builder.id}`;
+}
+
+module.exports = { OWNER_SHAPES, ownsUpgradableProject, requireOwnProjectOrPin, coreUpgradeActor };

package/modules/provisioning/core-upgrade.js

@@ -177,7 +177,8 @@ function makeCoreUpgradeHandler({ provisioning, pool, parseId, validateOrRespond
       // The actor rides the intent, and the runner carries it through to the
       // core_upgrades ledger (ADR 0293 D5): a privileged action with an
       // unattributed row is not acceptable here.
-      const actor = `api:archon:${req.builder.id}`;
+      // `api:owner:<id>` when the project's owner pressed it (task 1004174), else `api:archon:<id>`.
+      const actor = require('./core-upgrade-authz').coreUpgradeActor(req);
       // `dry_run: true` asks what the move WOULD do and moves nothing (task 1004121).
       // Queued the same way as the move, through the same single-open-intent slot, so a
       // preview cannot be requested on top of a move that is already running — and, just

package/modules/provisioning/provisioning.js

@@ -1158,9 +1158,9 @@ async function enqueueIntent(db, instanceId, action, requestedBy, targetVersion
 // delete hostage would repeat 1002691. A pending 'restart' or 'repo-private' (task 1004193) joins them for the same
 // reason (task 1003238) — and more sharply, since the owner reaches for Restart
 // precisely when a project looks broken, which is also when they give up and delete
-// it. A RUNNING intent is mid-flight and never yanked —
-// the caller gets { conflict: 'open_intent' } with the blocking intent so the route
-// can answer truthfully. Each statement is atomic and the index stays the arbiter:
+// it. A RUNNING intent is mid-flight and never yanked — the caller gets { conflict: 'open_intent' } with the blocking intent so the route
+// can answer truthfully. The control-plane row is never superseded, in the same statement (task 1004286): enqueueIntent's guard refuses its
+// teardown, and a refused teardown must cancel nothing (it used to cancel a pending restart). Each statement is atomic, the index the arbiter:
 // any interleaving with the runner or a concurrent enqueue lands on one of these
 // truthful outcomes.
 async function enqueueTeardown(db, instanceId, requestedBy) {
@@ -1169,7 +1169,7 @@ async function enqueueTeardown(db, instanceId, requestedBy) {
         SET state = 'error', last_error = 'superseded: teardown requested',
             updated_at = now(), resolved_at = now()
       WHERE instance_id = $1 AND action IN ('provision', 'settings-apply', 'restart', 'repo-private') AND state = 'pending'
-      RETURNING id`,
+        AND NOT EXISTS (SELECT 1 FROM provisioning_instances WHERE id = $1 AND hosting_shape = 'control-plane') RETURNING id`,
     [instanceId]
   );
   const { intent, created } = await enqueueIntent(db, instanceId, 'teardown', requestedBy);

package/modules/provisioning/routes/core-upgrade.js

@@ -26,6 +26,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const provisioning = require('../provisioning');
 const { makeCoreUpgradeHandler, makeCoreUpgradePreviewHandler, makeControlPlaneHandler } = require('../core-upgrade');
+const { requireOwnProjectOrPin } = require('../core-upgrade-authz');
 
 const log = api.logger('provisioning');
 
@@ -40,6 +41,11 @@ module.exports = function buildCoreUpgradeRouter() {
   // and not `requireRank`: tests/government_require_permission.mjs fails the build
   // on a new requireRank in a modules/*/routes gate.
   //
+  // OR THE PROJECT'S OWN OWNER (task 1004174, ADR 0339 — the owner's ruling that only
+  // a project's owner upgrades it). Ownership of a TENANT row is asked first; any other
+  // caller meets the unmodified `core.pin.move` gate and its unchanged refusal. The
+  // platform's own row is not an owner's to move here — it stays on the atom.
+  //
   // Body: { to: "1.19.757" } — and requiring it IS the second step of the two-step
   // the owner asked for (ADR 0293 D4). A request that cannot fire without naming
   // its target cannot fire from a stray click, and "move to whatever is newest",
@@ -55,7 +61,7 @@ module.exports = function buildCoreUpgradeRouter() {
   router.post(
     '/provisioning/instances/:id/core-upgrade',
     api.requireBuilder,
-    api.requirePermission('core.pin.move'),
+    requireOwnProjectOrPin({ pinGate: api.requirePermission('core.pin.move'), provisioning, pool: api.pool, log }),
     makeCoreUpgradeHandler({
       provisioning,
       pool: api.pool,
@@ -71,19 +77,19 @@ module.exports = function buildCoreUpgradeRouter() {
   // core version and how far behind it is, which is a vulnerability-window disclosure —
   // precisely the sort of thing ADR 0043 keeps off unauthenticated surfaces. A preview
   // anyone could read would also let an attacker time a request against a known-stale
-  // window. The read being no cheaper than the write costs the owner nothing: they hold
-  // the atom by construction, because they are the only one who can press the button.
+  // window. The read being no cheaper than the write costs the owner nothing: whoever
+  // may press the button may read what it would do — the same two doors as the POST.
   router.get(
     '/provisioning/instances/:id/core-upgrade',
     api.requireBuilder,
-    api.requirePermission('core.pin.move'),
+    requireOwnProjectOrPin({ pinGate: api.requirePermission('core.pin.move'), provisioning, pool: api.pool, log }),
     makeCoreUpgradePreviewHandler({ provisioning, pool: api.pool, parseId: api.parseId, log }),
   );
 
   // GET /provisioning/control-plane — "which row is this platform, and where does it
   // stand?" The deploy page's first call: the self row is created once by hand at
-  // install time, so its id is per-install and nobody's to memorise. Same atom again,
-  // so the entrance is no wider than the door it leads to.
+  // install time, so its id is per-install and nobody's to memorise. The atom ALONE
+  // here, with no owner door: this is the platform's own row (ADR 0339).
   router.get(
     '/provisioning/control-plane',
     api.requireBuilder,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1035",
+  "version": "1.19.1037",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1035",
+      "version": "1.19.1037",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1035",
+  "version": "1.19.1037",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7487,5 +7487,25 @@
       "id": "1002669",
       "text": "The owner can now check from their own laptop what the automatic background jobs decided and when the project's core software was last upgraded, instead of logging into the server to find out."
     }
+  ],
+  "1.19.1036": [
+    {
+      "id": "1004286",
+      "text": "Pressing delete on the platform's own server is still refused, and now it no longer quietly cancels a restart you had already asked for."
+    },
+    {
+      "id": "1004174",
+      "text": "The owner of a hosted project can now upgrade it themselves: the \"you're behind\" banner on their project links to the Deploy page on the hub, which lets a project's owner move their own project, and only their own."
+    }
+  ],
+  "1.19.1037": [
+    {
+      "id": "1002842",
+      "text": "The grader's retired first generation and an unused one-off audit script are removed, and the pieces a newer reviewer still depends on now live with it — nothing about how work is graded changes."
+    },
+    {
+      "id": "1004280",
+      "text": "The project's own notes no longer claim a past decision banned all new checks; each one now gives its real reason, and a test stops the wrong claim coming back."
+    }
   ]
 }

package/scripts/gds/claim.js

@@ -739,7 +739,8 @@ async function main() {
     // last thing the builder reads before deciding how to work — task 1267.
     printDisciplineMode(task);
     // task 1004202: a task that changes a page is told to use /design and get its
-    // human's OK on the before/after. A nudge, never a gate (ADR 0162).
+    // human's OK on the before/after. A nudge, never a gate: gating on that OK would
+    // put a person's approval in the land path, which ADR 0162 retired.
     try {
       const nudge = visualReviewNudge(task);
       if (nudge) console.log(`\n${nudge.join('\n')}`);

package/scripts/gds/grade-smoke.js

@@ -2,7 +2,7 @@
 // Subagent grader smoke test — GDS-V3 task V3.R18 (#209) → MAS Phase 1 #395.
 //
 // Runs two synthetic ship scenarios end-to-end through the v3 multi-shot
-// subagent grader (DEFAULT_SHOTS × cross-family model, unanimous-PASS gate).
+// subagent grader (the worker panel, cross-family model, unanimous-PASS gate).
 // Asserts:
 //
 //   - Known-GOOD ship: a tiny, complete change → grade passes (unanimous
@@ -148,8 +148,8 @@ function summarize(result, label) {
 // -------- Main --------
 
 (async () => {
-  console.log(`Running subagent grader smoke (v${grader.VERSION}, model=${grader.DEFAULT_GRADER_MODEL}, ${grader.DEFAULT_SHOTS}× shots, threshold=${grader.THRESHOLD})`);
-  console.log('Two scenarios will run sequentially. Each spawns 3 parallel shots.');
+  console.log(`Running subagent grader smoke (v${grader.VERSION}, model=${grader.DEFAULT_GRADER_MODEL}, ${grader.WORKERS.DEFAULT_PANEL.length}-worker panel, threshold=${grader.THRESHOLD})`);
+  console.log(`Two scenarios will run sequentially. Each runs the ${grader.WORKERS.DEFAULT_PANEL.length}-worker panel.`);
 
   let assertFailures = 0;
 

package/scripts/gds/provision-core-upgrade.js

@@ -140,6 +140,16 @@ function targetFault(to, available, installed, channel, channelAllows) {
   return null;
 }
 
+// The builder id a queued move is attributed to, from the actor the web tier recorded.
+// PURE. Two doors reach the move (ADR 0339): an Archon (`api:archon:<id>`) and, since
+// task 1004174, the project's own owner (`api:owner:<id>`). Both carry the id, because
+// it becomes `--requested-by` on the core_upgrades ledger (ADR 0293 D5). Anything else
+// yields '' — the id is interpolated into a shell command, so only digits ever pass.
+function requestedByOf(intent) {
+  const m = intent && typeof intent.requested_by === 'string' && /^api:(?:archon|owner):(\d+)$/.exec(intent.requested_by);
+  return m ? m[1] : '';
+}
+
 /**
  * Perform a queued core-pin move. Returns { ok } — NEVER throws for an expected refusal.
  *
@@ -224,9 +234,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
   // it the pin lives only in the working tree, and the next pull-deploy resets it away —
   // the silent thirteen-release revert upgrade.js's own header records.
   const versionUrl = `http://127.0.0.1:${inst.port}/version`;
-  const requestedBy = intent.requested_by && /^api:archon:(\d+)$/.test(intent.requested_by)
-    ? intent.requested_by.replace(/^api:archon:/, '')
-    : '';
+  const requestedBy = requestedByOf(intent);
   // Built by the SAME function the preview uses, so "what you were shown" and "what runs"
   // cannot drift apart into two hand-maintained flag lists (task 1004121).
   // The preview probes; the move must probe identically or the two commands diverge on
@@ -982,4 +990,4 @@ async function snapshotAllCoreVersions(deps) {
   return { seen };
 }
 
-module.exports = { UPGRADE_SHAPES, CHANGE_CAP, REPO_NOTES, repoNote, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };
+module.exports = { UPGRADE_SHAPES, CHANGE_CAP, REPO_NOTES, repoNote, requestedByOf, parseChangeRecords, readInstalledNotes, readPackagedNotes, changesBetween, coreCheckoutCandidates, findCoreCheckout, gitFault, resolveRunAs, versionCmd, parseServedVersion, parseSchemaPending, targetFault, parsePreflight, upgradeInvocation, preflightUpgrade, preflightCoreUpgrade, coreUpgradeInstance, snapshotCoreVersions, snapshotAllCoreVersions };

package/scripts/gds/render-check.js

@@ -7,7 +7,7 @@
 // count that still ran past its card (task 1003480) and a second grid child landing on the first (task 1003078)
 // both shipped looking correct in code and were found only by opening a browser.
 //
-// A SIGNAL, never a gate (ADR 0162): /ship-check shows it as an advisory row; ship.js and the grader never
+// A SIGNAL, never a gate (ADR 0329, decisions 3-4): /ship-check shows it as an advisory row; ship.js and the grader never
 // read it. The measurement is the kit's `text-fit` + `sibling-overlap` floors (modules/ui-design/kit/lib.js);
 // this file only picks the pages, runs the kit's renderer at 1280 + 390, and keeps those two floors.
 //

package/scripts/gds/ship-check.js

@@ -25,7 +25,7 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
 // Each step: a label, the argv to run (node scripts run with THIS node), the command that heals it,
 // and how to read a non-zero exit. `optional` steps are skipped when their script is absent. An `advisory`
-// step is a signal, never a gate (ADR 0162): a non-zero exit reads `warn` (3 = no browser reads `skipped`).
+// step is a signal, never a gate (ADR 0329, decision 3): a non-zero exit reads `warn` (3 = no browser reads `skipped`).
 // `onlyWith` names the flag that adds a step; `skipWith` the flag that leaves one out.
 const STEPS = [
   { key: 'fitness', label: 'fitness.js (architecture + budgets + freshness gate)', argv: ['scripts/gds/fitness.js'], fix: 'read the ✗ lines above; each names its fix' },

package/scripts/gds/ship-flow.js

@@ -496,7 +496,7 @@ async function shipMain() {
       passed,
       // touches[] cleanup [4/8] (task 879): the drift scanner is gone; with no
       // scanner there is nothing to drift, so this audit-trail signal
-      // (grader.scoreScannerSmoke) is vacuously clean.
+      // (read by the retired v1 grader, task 1002842) is vacuously clean.
       scanner_clean: true,
       smoke_clean: smoke.clean,
     },

package/scripts/gds/ship-grade-steps.js

@@ -314,7 +314,7 @@ function formatOutageDiagnostic(g, cliFinding) {
 
 // cliFinding: the preflight `claude CLI` row, injected by printGradeOutcome so a
 // dark panel can say "your CLI is logged out" instead of leaving the builder to
-// guess. Report-only — it never changes the outcome (ADR 0162: no new gates).
+// guess. Report-only — it never changes the outcome: it explains an outage, it does not decide one.
 function formatGradeOutcome(g, taskId, cliFinding = null) {
   const out = [];
   // #943: a TOTAL grader outage (every gating worker failed to spawn / the
@@ -466,7 +466,7 @@ function printGradeOutcome(g, taskId) {
   // task 1003313: on a TOTAL outage only, ask the existing preflight whether the
   // local `claude` CLI is launchable and logged in — the two faults that produce
   // this exact all-workers-dead signature. Report-only and outage-only, so the
-  // happy path pays nothing and no ship is newly gated (ADR 0162).
+  // happy path pays nothing and no ship's outcome depends on the probe.
   let cliFinding = null;
   if (g?.signals?.panel_outcome === 'unavailable') {
     try {

package/scripts/gds/visual-review-nudge.js

@@ -5,7 +5,8 @@
 // real browser, and get the human's OK on the before/after before shipping — the
 // project default for every builder since the owner's 2026-09-23 decision.
 //
-// A NUDGE, never a gate (ADR 0162). "Is this UI work" is the ONE predicate the
+// A NUDGE, never a gate: as a gate, the human's OK would be a person's approval in
+// the land path, which ADR 0162 retired. "Is this UI work" is the ONE predicate the
 // artist review and the grader's copy lens already use (lifecycle/cascade.js), so
 // the three cannot disagree. Nothing has changed yet at claim time, so it is fed
 // the paths the task NAMES: its touches[] and any modules/*/public/ path written

package/src/bongos/auth.js

@@ -461,7 +461,13 @@ const PAGE_GATES = Object.freeze({
   // preview discloses the exact core version the box serves and how far behind it is
   // — a vulnerability window, and exactly the kind of topology ADR 0043 keeps off
   // unauthenticated surfaces.
-  requireCorePinPage: Object.freeze({ permission: 'core.pin.move', deniedTo: '/builders' }),
+  //
+  // SINCE ADR 0339 (task 1004174) its routes admit a SECOND audience — a hosted
+  // project's own owner, for that project only — so the shell follows through the same
+  // `alsoAdmits` door /people uses (ADR 0210). It admits the SHELL for an owner of any
+  // live project; which project they may read or move is still the routes' question,
+  // asked per request against that project's row.
+  requireCorePinPage: Object.freeze({ permission: 'core.pin.move', deniedTo: '/builders', alsoAdmits: 'isProjectOwner' }),
   // The /fleet cost page (task 1001949) — on `provisioning.fleet.manage`, the SAME atom
   // its one read (GET /provisioning/fleet/cost-ledger) checks: every owner's projects
   // and what they cost, so the page reaches exactly as far as the data does.
@@ -469,7 +475,7 @@ const PAGE_GATES = Object.freeze({
 });
 
 // The `alsoAdmits` door — "is this visitor the page's OTHER audience?", asked of
-// the module that owns the answer, only for the one gate that declares one.
+// the module that owns the answer, only for a gate that declares one.
 //
 // FAIL-CLOSED, EVERY WAY IT CAN FAIL: a gate with no `alsoAdmits`, a hub module
 // that is off (every non-hub instance), a port that never grew the function, or a

package/src/bongos/routes/core-update.js

@@ -22,6 +22,25 @@ const express = require('express');
 const { asyncHandler } = require('./_helpers');
 const auth = require('../auth');
 const { readCoreUpdate, readCoreUpgrades } = require('../core-update');
+const { loadIdpConfig } = require('../auth-config');
+
+// WHERE A HOSTED PROJECT'S OWNER TAKES THE UPGRADE (task 1004174, ADR 0339): the hub's
+// own deploy door, scoped to this project — `<hub>/deploy?project=<slug>`. The act stays
+// on the control plane (ADR 0293 D1); this instance only names the address, so it gains
+// no capability. Both halves are already here on a federated project: provisioning
+// writes the hub origin and this project's hub client id, which IS its slug (ADR 0246),
+// into web.env. null when this instance is not federated with a hub — a self-hosted
+// instance, or the hub itself — so the hall offers no link rather than a wrong one.
+// Only the origin and the client id are read; the client secret never leaves auth-config.
+function hubDeployUrl(config) {
+  if (!config || typeof config.origin !== 'string' || !config.clientId) return null;
+  if (!/^https?:\/\/[^\s"'<>]+$/i.test(config.origin)) return null;
+  return `${config.origin.replace(/\/+$/, '')}/deploy?project=${encodeURIComponent(String(config.clientId))}`;
+}
+
+function safeIdpConfig() {
+  try { return loadIdpConfig(); } catch { return null; }
+}
 
 // ?limit for GET /core-upgrades: an integer 1..100, else 20.
 function upgradesLimit(raw) {
@@ -30,7 +49,7 @@ function upgradesLimit(raw) {
   return Math.min(100, Math.max(1, n));
 }
 
-module.exports = function buildCoreUpdateRouter({ upgrades = readCoreUpgrades } = {}) {
+function buildCoreUpdateRouter({ upgrades = readCoreUpgrades } = {}) {
   const router = express.Router();
 
   router.get(
@@ -48,7 +67,7 @@ module.exports = function buildCoreUpdateRouter({ upgrades = readCoreUpgrades }
       // that cannot name its own core reports `no_answer` and renders no banner.
       let running = null;
       try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
-      res.json({ ok: true, update: await readCoreUpdate({ running }) });
+      res.json({ ok: true, update: await readCoreUpdate({ running }), deploy_url: hubDeployUrl(safeIdpConfig()) });
     }, { errorCode: 'core_update_failed', message: false }),
   );
 
@@ -71,4 +90,7 @@ module.exports = function buildCoreUpdateRouter({ upgrades = readCoreUpgrades }
   );
 
   return router;
-};
+}
+
+module.exports = buildCoreUpdateRouter;
+module.exports.hubDeployUrl = hubDeployUrl;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1035'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1037'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');