@bongos/core 1.19.1081 → 1.20.1

package/scripts/gds/provision.js

@@ -50,7 +50,7 @@ const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, softFailResult, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { accountPreflight, appGroupExpr, appUser, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
-const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
+const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, renamedEnvCarry, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, ingressPlaneGap, ingressPreflight, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { resolveProcessManager } = require('./provision-process.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
@@ -374,10 +374,10 @@ async function provisionInstance(inst, deps) {
     // throw: the greenfield flow now has no manual clone step. Idempotent + dry-run-safe.
     if (inst.hosting_shape === 'cloud-host') {
       await scaffoldStandaloneRepo(inst, deps);
-      // A PRIVATE target_ref gets its own read-only deploy key BEFORE step 2's
-      // `git pull --ff-only origin main` — the pull that failed unauthenticated
-      // on every private standup (walk finding N4; ADR 0176).
+      // A PRIVATE target_ref gets its own read-only deploy key BEFORE step 2's `git pull
+      // --ff-only origin main`, which failed unauthenticated on every private standup (N4; ADR 0176).
       await ensurePrivateRepoAccess(inst, deps);
+      await require('./provision-pin-key.js').ensurePinWriteKey(inst, deps); // the hub's WRITE key for later pin pushes, public repos too (task 1004291, ADR 0350)
     }
   }
   if (!inst.db_name) { patch.db_name = inst.slug; inst = { ...inst, db_name: inst.slug }; }
@@ -904,7 +904,7 @@ async function settingsApplyInstance(inst, deps) {
   // exists to avoid). An unreadable or empty file is refused, never "patched":
   // writing two lines over a missing PORT/PGDATABASE would take the instance down.
   const read = boxExec(`${sudoP}cat ${webEnvPath(inst)}`, { allowFail: true });
-  const current = String((read && read.stdout) || '');
+  const current = String((read && read.stdout) || ''), carry = renamedEnvCarry(current); // task 1004395: only its NAMES are ever logged
   if (!apply) {
     log(`  [config] would patch ${Object.keys(vars).join(', ')} in ${webEnvPath(inst)} in place (every other line untouched)`);
     pmFor(deps).restartService(inst, { exec: boxExec, sudoP });
@@ -916,8 +916,8 @@ async function settingsApplyInstance(inst, deps) {
     return { ok: false, error: `cannot read ${webEnvPath(inst)} — nothing to patch (was this instance provisioned by the runner?)` };
   }
   try {
-    log('  [config] patch the settings lines of web.env in place (creds + origins untouched)');
-    boxWriteFile(webEnvPath(inst), upsertEnvVars(current, settingsEnvVarsFor(inst, current)), { mode: 0o600, sudo: true });
+    log(`  [config] patch the settings lines of web.env in place (creds + origins untouched)${carry.carried.length ? `; carry the renamed env forward: ${carry.carried.join(', ')} (value copied on the box, never shown)` : ''}`);
+    boxWriteFile(webEnvPath(inst), upsertEnvVars(current, { ...settingsEnvVarsFor(inst, current), ...carry.vars }), { mode: 0o600, sudo: true });
     log('  [service] restart so the memoized branding pack re-reads them');
     pmFor(deps).restartService(inst, { exec: boxExec, sudoP });
   } catch (e) {
@@ -960,7 +960,7 @@ async function settingsApplyInstance(inst, deps) {
   if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'settings-apply').catch(() => {});
   await provisioning.recordEvent(db, {
     instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'settings-applied',
-    detail: `settings pushed (${shown}) — web.env patched in place; ${outcome}`,
+    detail: `settings pushed (${shown}) — web.env patched in place${carry.carried.length ? `; carried ${carry.carried.join(', ')}` : ''}; ${outcome}`,
     actor: 'runner',
   }).catch(() => {});
   log(healthy && consumed !== false
@@ -1285,7 +1285,7 @@ async function cmdRunIntents(deps) {
       // Dispatch EXPLICITLY per action — an unrecognized action must surface as an
       // error, never fall through to the destructive teardown leg (task 1002692).
       let result;
-      if (intent.action === 'provision') result = await provisionInstance(inst, deps);
+      if (intent.action === 'provision') result = await require('./provision-render.js').afterProvision(inst, deps, intent, await provisionInstance(inst, deps)); // then the app on Render, when the wizard lent a key (task 1004352)
       else if (intent.action === 'teardown') result = await teardownInstance(inst, deps);
       else if (intent.action === 'domain-attach') result = await domainAttachInstance(inst, deps);
       else if (intent.action === 'settings-apply') result = await settingsApplyInstance(inst, deps);
@@ -1489,7 +1489,7 @@ module.exports = {
   makeExec, makeWriteFile, allocatePort, boundLocalPorts, provisionInstance, teardownInstance,
   domainAttachInstance, releasableDomains, cmdRunIntents, cmdReconcile, cmdStatus,
   // live settings push (task 1003140) + the in-place env patch + read-back it rides on
-  settingsApplyInstance, upsertEnvVars, settingsEnvVarsFor, settingsConsumed, instanceManifestCmd,
+  settingsApplyInstance, upsertEnvVars, renamedEnvCarry, settingsEnvVarsFor, settingsConsumed, instanceManifestCmd,
   // restart an unreachable ACTIVE instance (task 1003238) — the settings leg minus the env patch
   restartInstance,
   // GitHub App Manifest flow (task 2080, ADR 0133)

package/scripts/gds/publish-manifest.js

@@ -72,6 +72,7 @@ const PUBLISH_ALLOWLIST = [
   'modules/provisioning/',   // instance-hosting control plane — CORE (its do-api toolchain is core). Reclassified IN so the core CLI scripts/gds/provision.js resolves it from the core package post-split, not a MODULE_NOT_FOUND (task 2135). default:false — shipped ≠ enabled.
   'modules/agents/',         // the declarative agent registry + spawn seam (goal 1000038) — CORE: its own manifest declares maintenance.status 'core-maintained', and it consumes the core `grade` port, so a released core without it cannot run the MAS machinery the methodology describes. default:false — shipped is not enabled (ADR 0083), exactly like provisioning + platform-identity below. Omitted at module-creation time (tasks 1002485/1002486): the omission was invisible until tests/agents_spawn.mjs became the first PUBLISHABLE file to import it and the R89 boundary guard caught it (task 1002489).
   'modules/npm-release/',    // the deploy page's "where is the work" + version history (task 1002622). default:false — on only in the hall that publishes the core. MUST be here: modules/hall-ui/ ships as one subtree, so a released core without this carries deploy.js's loader and the #nr-work mounts with no routes behind them — the copy-desk asymmetry above.
+  'modules/render-deploy/',  // the deploy page of a project whose app deploys through Render (task 1004270). default:false. MUST be here for the npm-release reason: modules/hall-ui/ ships as one subtree, so a released core without it carries deploy.js's loader for #rd-panel with no routes behind it.
   'modules/platform-identity/', // hub identity provider (ADR 0141) — ships in core, enabled ONLY on the hub (cloudbongos.com). MUST be here or the hub's enabledModules() throws "unknown module" and provision.js's federation load MODULE_NOT_FOUNDs (task 1002235, same rationale as provisioning above). default:false — shipped ≠ enabled; a vanilla/self-hosted instance never turns it on.
   // --- neutral (customer-0) config starters + their schemas (the filled-in *.json twins are denied) ---
   'config/branding.neutral.json',

package/scripts/gds/render-api.js

@@ -137,6 +137,25 @@ class RenderApi extends JsonHttpApi {
     return this._req('POST', `/services/${encodeURIComponent(serviceId)}/deploys`, {}, { dryRunResult: { id: null } });
   }
 
+  // A service's deploys, newest first, as the bare deploy objects (Render wraps each in
+  // `{ deploy, cursor }`; both shapes are read). The list carries no owner, so the
+  // service is read through the guard first (the deploy hall's history, task 1004270).
+  async listDeploys(serviceId, { limit = 30 } = {}) {
+    await this.getService(serviceId);
+    const n = Math.max(1, Math.min(100, Number.parseInt(limit, 10) || 30));
+    const json = await this._req('GET', `/services/${encodeURIComponent(serviceId)}/deploys?limit=${n}`, null, { dryRunResult: { items: [] } });
+    const items = Array.isArray(json) ? json : (json && json.items) || [];
+    return items.map((e) => (e && e.deploy) || e).filter((d) => d && typeof d.id === 'string');
+  }
+
+  // Roll the service back to one of its earlier deploys. The answer carries no owner, so
+  // the service is read through the guard first. This is a write on the owner's account;
+  // the caller (the deploy hall) asks the owner twice before it reaches here.
+  async rollbackTo(serviceId, deployId) {
+    await this.getService(serviceId);
+    return this._req('POST', `/services/${encodeURIComponent(serviceId)}/rollback`, { deployId }, { dryRunResult: { id: null } });
+  }
+
   // ---- Postgres --------------------------------------------------------------
 
   async createPostgres(payload) {

package/scripts/gds/render-payload.js

@@ -1,23 +1,27 @@
 // scripts/gds/render-payload.js — WHAT the Render standup leg creates, kept apart from
-// HOW it creates it (scripts/gds/provision-render.js) (task 1004183).
+// HOW it creates it (scripts/gds/provision-render.js) (task 1004183; retargeted by
+// task 1004350).
 //
-// Pure functions, no I/O. They are separate so the thing being stood up can change
-// without touching the guard or the key plumbing: this file builds the Bongos instance
-// the Render pilot proved (task 1004142, docs/recipes/render-pilot.md §4 and its
-// "Corrections" box), and task 1004350 retargets it at the project's own app, per
-// ADR 0345 (we host the hall; the owner's app is what goes to their Render account).
+// Pure functions, no I/O. What goes to the owner's Render account is their APP, not the
+// Bongos hall: we host every project's hall, and the app deploys where its owner
+// chooses (ADR 0345 D1, D3). So the service is built from the project's own repository
+// and started the way that repository says — the owner's runtime and commands, or the
+// repository's own Dockerfile — never the Bongos core.
 //
-// The plans are per-instance settings (ADR 0327 §5), never constants. The defaults are
-// what the pilot measured as enough for a new instance at idle: a `starter` web service
-// (48-62 MiB of 512) and a paid `basic_256mb` Postgres, because Render's free Postgres
-// has no backups of any kind.
+// A database is optional (some apps need none). When there is one, its internal
+// connection string is handed to the app as DATABASE_URL, the one name every mainstream
+// framework reads. That is the only env var the platform sets: every other variable is
+// the owner's to set on Render, and Bongos keeps their NAMES only (task 1004062's
+// manifest) — never a value.
+//
+// The plans are per-project settings (ADR 0327 §5), never constants. The defaults are
+// what the Render pilot (task 1004142) found enough at idle: a `starter` web service and
+// a paid `basic_256mb` Postgres, because Render's free Postgres has no backups.
 
 'use strict';
 
-const crypto = require('node:crypto');
-
 // The vocabulary lives with the web tier's validation, so the two can never disagree.
-const { WEB_PLANS, DB_PLANS, REGIONS } = require('../../modules/provisioning/render-standup.js');
+const { WEB_PLANS, DB_PLANS, REGIONS, RUNTIMES } = require('../../modules/provisioning/render-standup.js');
 const DEFAULTS = Object.freeze({ webPlan: 'starter', dbPlan: 'basic_256mb', region: 'virginia' });
 
 // A Render resource name from the project's slug. Render allows letters, digits and
@@ -27,7 +31,7 @@ function resourceName(inst, suffix) {
   return suffix ? `${base}-${suffix}` : base;
 }
 
-// The plan and region an instance asked for, with the defaults filled in. A value outside
+// The plan and region a project asked for, with the defaults filled in. A value outside
 // the vocabulary is refused rather than passed through for Render to reject.
 function plansFor(appHost) {
   const h = appHost || {};
@@ -42,35 +46,29 @@ function plansFor(appHost) {
   return out;
 }
 
+// How the app is built and started, as the owner said. `docker` builds the repository's
+// own Dockerfile and needs no commands; every other runtime needs a start command, and a
+// build command if the app has a build step.
+function buildFor(appHost) {
+  const h = appHost || {};
+  if (!RUNTIMES.includes(h.runtime)) throw new Error(`unknown Render runtime '${h.runtime || 'none'}'`);
+  if (h.runtime === 'docker') return { runtime: 'docker' };
+  if (!h.startCommand) throw new Error('the app needs a start command');
+  return { runtime: h.runtime, buildCommand: h.buildCommand || null, startCommand: h.startCommand };
+}
+
 // POST /postgres. `plan` is never 'free' — see the header.
 function renderPostgresPayload(inst, { ownerId, dbPlan, region }) {
   return { name: resourceName(inst, 'db'), ownerId, plan: dbPlan, region, version: '16' };
 }
 
-// POST /services, for a Bongos instance from its repository. `dbUrl` is the database's
-// internal connection string; `secretKey` is a fresh BUILDER_SECRET_KEY. Both are VALUES
-// sent to Render and held there — the platform keeps neither.
-//
-// What each non-obvious line is for, from the pilot's corrections:
-//   - runtime + startCommand are explicit: a hybrid repo defaults to Python on Render, and
-//     an adopted instance has no `npm start`;
-//   - HOST=0.0.0.0: the server binds 127.0.0.1 otherwise and Render's router never reaches it;
-//   - PGDATABASE = the URL: migrate.sh addresses the database as `psql -d "$PGDATABASE"`;
-//   - BUILDER_SECRET_KEY: Render's disk is wiped each deploy, so the key-file fallback
-//     would mint a new key every time and orphan every stored per-builder secret;
-//   - no PORT: Render injects it.
-// Bongos reads DATABASE_URL first (src/bongos/pool.js), so none of the PG* family the box
-// writes is needed — the one simplification Render buys.
-function renderServicePayload(inst, { ownerId, repoUrl, branch, webPlan, region, dbUrl, secretKey, envPrefix, firstAdmin }) {
-  const envVars = [
-    { key: 'NODE_VERSION', value: '22' },
-    { key: 'HOST', value: '0.0.0.0' },
-    { key: 'DATABASE_URL', value: dbUrl },
-    { key: 'PGDATABASE', value: dbUrl },
-    { key: 'PGPOOL_MAX', value: '5' },
-    { key: 'BUILDER_SECRET_KEY', value: secretKey },
-  ];
-  if (firstAdmin) envVars.push({ key: `${envPrefix}_FIRST_ADMIN`, value: firstAdmin });
+// POST /services, for the owner's app from their repository. `dbUrl` is the database's
+// internal connection string, or null when the app has no database. It is a VALUE sent
+// to Render and held there — the platform keeps none.
+function renderServicePayload(inst, { ownerId, repoUrl, branch, webPlan, region, build, dbUrl }) {
+  const envSpecificDetails = build.runtime === 'docker'
+    ? {}
+    : { ...(build.buildCommand ? { buildCommand: build.buildCommand } : {}), startCommand: build.startCommand };
   return {
     type: 'web_service',
     name: resourceName(inst),
@@ -78,33 +76,9 @@ function renderServicePayload(inst, { ownerId, repoUrl, branch, webPlan, region,
     repo: repoUrl,
     branch: branch || 'main',
     autoDeploy: 'yes',
-    serviceDetails: {
-      runtime: 'node',
-      plan: webPlan,
-      region,
-      healthCheckPath: '/healthz',
-      envSpecificDetails: {
-        buildCommand: 'npm ci',
-        startCommand: 'node node_modules/@bongos/core/src/platform-server.js',
-        preDeployCommand: 'bash node_modules/@bongos/core/scripts/migrate.sh',
-      },
-    },
-    envVars,
+    serviceDetails: { runtime: build.runtime, plan: webPlan, region, envSpecificDetails },
+    envVars: dbUrl ? [{ key: 'DATABASE_URL', value: dbUrl }] : [],
   };
 }
 
-// The env vars that can only be set once the service exists, because they name the URL
-// Render gave it. The four origins must all be that one host: a single-host instance has
-// no separate builders./status. subdomain, and without them the hall never loads.
-function renderAfterCreateEnv(serviceUrl, { envPrefix }) {
-  const origin = String(serviceUrl || '').replace(/\/+$/, '');
-  if (!/^https:\/\//.test(origin)) throw new Error(`Render gave the service no https URL (${serviceUrl || 'none'})`);
-  return ['PUBLIC', 'BUILDERS', 'STATUS', 'OAUTH'].map((k) => ({ key: `${envPrefix}_${k}_ORIGIN`, value: origin }));
-}
-
-function freshSecretKey() { return crypto.randomBytes(32).toString('hex'); }
-
-module.exports = {
-  WEB_PLANS, DB_PLANS, REGIONS, DEFAULTS,
-  resourceName, plansFor, renderPostgresPayload, renderServicePayload, renderAfterCreateEnv, freshSecretKey,
-};
+module.exports = { DEFAULTS, resourceName, plansFor, buildFor, renderPostgresPayload, renderServicePayload };

package/scripts/gds/run-unit-tests.js

@@ -102,6 +102,13 @@ const INTEGRATION = new Set([
   // never was a dedicated consumer-layout-boot workflow, whatever older notes say.
   'consumer_layout_boot',
   'claim_gate_open_blocker', 'claim_gate_rebase',
+  // task 1003457: proves the blocker-resolve auto-promotion trigger (migration
+  // 009, tightened by core_223) fires on the HALL'S OWN write path — the real
+  // buildGdsRouter() HTTP routes, not a static SQL-text pin (blocker_resolve_guard.mjs,
+  // blocker_unlink.mjs) or a pure-predicate unit test (blocker_link.mjs, which never
+  // touches a database). Only a real transaction engine behind a real router proves
+  // that; self-skips without a reachable Postgres.
+  'blocker_hall_live_proof',
   // task 1002709: core_221's re-keyed backstop index against a real Postgres.
   // The DB-free sibling pins the guard and the migration's text; this proves the
   // index actually refuses the commingling INSERT and still allows the parallel
@@ -122,6 +129,9 @@ const INTEGRATION = new Set([
   // dev box session. The claims foreign key that failed the live upgrade is a
   // schema fact only a transaction engine enforces. Always rolled back.
   'core_258_box_session_claims_db',
+  // task 1004360: core_262 drops the four builders columns migration 104 added, against a real
+  // Postgres, with the foreign key live, then re-runs it. Always rolled back.
+  'core_262_drop_box_blocked_db',
   'discord_autojoin', 'discord_oauth',
   // task 1003000 (IC6): the three ideator credit streams against a real Postgres.
   // The three DB-free sibling suites stub the client and SIMULATE the

package/scripts/gds/ship-finish.js

@@ -14,7 +14,8 @@ const { cliClient, printOnboardingNudge, rewardPolicy, cardFlagsFromMe } = requi
 const { closeoutPlan } = require('../../modules/lifecycle/ship-preflight');
 const { syncMemoryOnShip } = require('./ship-memory-sync.js');
 const { uploadSessionOnShip } = require('./ship-session-upload.js');
-const { gitOk, shellOk } = require('./ship-git.js');
+const { execFileSync } = require('node:child_process');
+const { gitOk } = require('./ship-git.js');
 const { fetchDeployedVersion } = require('./ship-deploy-target.js');
 const { landBailed, reconciledCardStatus } = require('./ship-land.js');
 const { autoMerge, publishHeld } = require('./ship-merge.js');
@@ -142,18 +143,23 @@ async function onboardingNudgeBestEffort() {
 // close-out, folded into the delivery process (NOT a separate skill). After a
 // ship lands, scratch often lingers uncommitted — untracked files the preflight
 // lets through, generated artifacts, post-commit edits — making the session
-// hard to archive cleanly. This reports what's left and stashes it under a
-// labeled, RECOVERABLE stash so the tree is left clean + archive-ready and
-// nothing is lost. STRICTLY fail-open: the ship has already succeeded by the
-// time this runs, so nothing here may throw, prompt, or change the exit status —
-// a messy tree (or a stash failure) must never surface as a ship failure. The
-// caller gates this on a SUCCESSFUL land so a grade-failed 'completed' tree the
-// builder still needs to fix is never stashed out from under them.
+// hard to archive cleanly. This REPORTS what's left and leaves it in place.
+// task 1004254: it used to `git stash push -u` the leftover, but the stash stack
+// is repo-global across every worktree (task 1003344), so one builder's scratch
+// landed where a parallel agent's pop could apply it to the wrong branch — and
+// it swallowed review renders an owner still needed. It never touches the stash.
+// STRICTLY fail-open: the ship has already succeeded by the time this runs, so
+// nothing here may throw, prompt, or change the exit status — a messy tree must
+// never surface as a ship failure. The caller gates this on a SUCCESSFUL land.
 function postShipCloseout(taskId) {
   try {
-    const out = gitOk('git status --porcelain');
-    if (out == null) return; // git unavailable / not a repo — nothing to reconcile
-    const plan = closeoutPlan(out, taskId);
+    // Untrimmed: gitOk's trim() eats the first line's leading status column, so
+    // " M a.txt" was listed as ".txt" (task 1004254).
+    let out;
+    try {
+      out = execFileSync('git', ['status', '--porcelain'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    } catch (_) { return; } // git unavailable / not a repo — nothing to reconcile
+    const plan = closeoutPlan(out);
     if (plan.clean) {
       console.log('Close-out: working tree clean — session is archive-ready.');
       return;
@@ -162,15 +168,7 @@ function postShipCloseout(taskId) {
     console.log(`Close-out: ${plan.leftover.length} uncommitted/untracked path(s) remain after the ship:`);
     for (const f of plan.leftover.slice(0, 15)) console.log(`  ${f}`);
     if (plan.leftover.length > 15) console.log(`  … and ${plan.leftover.length - 15} more`);
-    // --include-untracked so scratch the preflight waved through is captured too.
-    // Label is `otb-postship-<numericId>` — no shell metacharacters.
-    const stashed = shellOk(`git stash push --include-untracked -m "${plan.stashLabel}"`);
-    if (stashed) {
-      console.log(`Close-out: stashed the leftover as "${plan.stashLabel}" — tree is now clean + archive-ready.`);
-      console.log('           Recover anytime:  git stash list  →  git stash pop');
-    } else {
-      console.log('Close-out: could not stash the leftover; left it in place (the ship already succeeded — tidy up manually when convenient).');
-    }
+    console.log(`Close-out: left in place (task ${taskId} already shipped) — commit, move or delete them before archiving this worktree.`);
   } catch (err) {
     // Fail-open — a post-ship close-out problem must never look like a ship failure.
     console.log(`Close-out: skipped (${err && err.message ? err.message : 'error'}).`);
@@ -404,6 +402,7 @@ module.exports = {
   finishHeld,
   mergeAndDeploy,
   onboardingNudgeBestEffort,
+  postShipCloseout,
   postShipSync,
   printCompletionCard,
 };

package/scripts/gds/smoke-dependencies.sh

@@ -10,9 +10,12 @@
 #   5. Promote A manually (the route allows it; the gate is at claim time)
 #   6. Try to claim A — still 409 DEPS_NOT_SHIPPED
 #   7. Claim B, ship B (active → completed → confirmed → shipped)
-#   8. Verify A auto-promoted backlog→ready (or stays ready if step 5 ran)
+#   8. Verify C — a second dependent of B that NOTHING ever promoted by hand —
+#      flipped backlog→ready. This is the only assertion that can fail if the
+#      auto-promotion trigger is broken (task 1004191): A was already 'ready'
+#      from the manual step, so A's status proves nothing about the trigger.
 #   9. Claim A — succeeds
-#  10. Release A, abandon A (B is shipped and cannot be abandoned)
+#  10. Release A, abandon A and C (B is shipped and cannot be abandoned)
 #
 # Run from any environment with a valid CLI session (/builder-setup).
 # Requires curl.
@@ -44,7 +47,22 @@ A=$(curl -sS -X POST "$BASE/api/bongos/tasks" \
 A_ID=$(echo "$A" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['id'])")
 echo "  A id=$A_ID"
 
-echo "=== 3. Wire A → depends_on B ==="
+echo "=== 2b. Create task C (dependent, status=backlog, NEVER promoted by hand) ==="
+# task 1004191 (finding 62 of the task 1000379 audit): A is promoted manually in
+# step 4, so "A is ready after B ships" held whether or not the auto-promotion
+# trigger fired. C exists to be the dependent only the trigger can flip.
+C=$(curl -sS -X POST "$BASE/api/bongos/tasks" \
+  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+  --data "{\"version_id\":\"GDS-V3\",\"title\":\"__smoke__ dep-test C $SUFFIX\",\"description\":\"smoke\",\"status\":\"backlog\",\"kind\":\"feature\",\"discipline\":\"engineering\",\"priority\":5,\"touches\":[\"smoke-dep-C-$SUFFIX/\"],\"source\":\"smoke\",\"source_ref\":\"smoke-dep-C-$SUFFIX\"}")
+C_ID=$(echo "$C" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['id'])")
+echo "  C id=$C_ID"
+
+echo "=== 3. Wire A → depends_on B, and C → depends_on B ==="
+curl -sS -X POST "$BASE/api/bongos/tasks/$C_ID/dependencies" \
+  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+  --data "{\"depends_on_task_id\": $B_ID}" >/dev/null
+C_PRE=$(curl -sS -H "Authorization: Bearer $TOKEN" "$BASE/api/bongos/tasks/$C_ID" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['status'])")
+[ "$C_PRE" = "backlog" ] && echo "  PASS: C is backlog before B ships" || (echo "  FAIL: C is '$C_PRE' before B ships — the auto-promotion check below would prove nothing"; exit 1)
 curl -sS -X POST "$BASE/api/bongos/tasks/$A_ID/dependencies" \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   --data "{\"depends_on_task_id\": $B_ID}" | python3 -m json.tool
@@ -69,15 +87,18 @@ curl -sS -X POST "$BASE/api/bongos/claims/by-task/$B_ID/resolve" \
 curl -sS -X POST "$BASE/api/bongos/tasks/$B_ID/confirm" -H "Authorization: Bearer $TOKEN" >/dev/null
 curl -sS -X POST "$BASE/api/bongos/tasks/$B_ID/ship"    -H "Authorization: Bearer $TOKEN" >/dev/null
 
-echo "=== 7. Verify A auto-promoted (status should still be 'ready' from manual step 4, or auto-flipped from backlog) ==="
-A_STATUS=$(curl -sS -H "Authorization: Bearer $TOKEN" "$BASE/api/bongos/tasks/$A_ID" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['status'])")
-echo "  A status: $A_STATUS"
-[ "$A_STATUS" = "ready" ] && echo "  PASS" || (echo "  FAIL: A not ready"; exit 1)
+echo "=== 7. Verify the auto-promotion trigger fired: C backlog → ready ==="
+# C was never promoted by hand, so only promote_dependents_on_ship can have made
+# it 'ready'. (A is 'ready' from the manual step 4 regardless, so A is not asserted
+# here — that is the assertion that used to pass with the trigger broken.)
+C_STATUS=$(curl -sS -H "Authorization: Bearer $TOKEN" "$BASE/api/bongos/tasks/$C_ID" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['status'])")
+echo "  C status: $C_STATUS"
+[ "$C_STATUS" = "ready" ] && echo "  PASS: C auto-promoted" || (echo "  FAIL: C is '$C_STATUS' — B shipped but the auto-promotion trigger did not flip its dependent"; exit 1)
 
 echo "=== 8. Claim A — must succeed now ==="
 node scripts/gds/claim.js "$A_ID" --worktree "smoke-$SUFFIX-A"
 
-echo "=== 9. Cleanup — abandon A; B is shipped and stays ==="
+echo "=== 9. Cleanup — abandon A and C; B is shipped and stays ==="
 # task 1004026: this step used to ANNOUNCE "release A; mark both abandoned" and then
 # only release A. Neither task reached a terminal state, so every run leaked two
 # __smoke__ rows into the live tasks table — invisibly, because anyone grepping the
@@ -108,6 +129,14 @@ case "${A_CLEANUP_CODE:-000}" in
   000) echo "  SKIP cleanup — POST /tasks/$A_ID/abandon got no response; task #$A_ID left in the ledger" ;;
   *)   echo "  SKIP cleanup — POST /tasks/$A_ID/abandon returned HTTP $A_CLEANUP_CODE; task #$A_ID left in the ledger" ;;
 esac
+C_CLEANUP_CODE=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
+  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+  --data '{"reason":"smoke cleanup (task 1004191) - auto-promotion witness; the throwaway row has served its purpose"}' \
+  "$BASE/api/bongos/tasks/$C_ID/abandon") || true
+case "${C_CLEANUP_CODE:-000}" in
+  2*) echo "  PASS cleaned up throwaway task #$C_ID (abandoned)" ;;
+  *)  echo "  SKIP cleanup — POST /tasks/$C_ID/abandon returned HTTP ${C_CLEANUP_CODE:-000}; task #$C_ID left in the ledger" ;;
+esac
 echo "  NOTE task #$B_ID is SHIPPED and is deliberately left in the ledger — the abandon route refuses shipped work (cannot_abandon_shipped)."
 
 echo

package/scripts/gds/status.js

@@ -167,6 +167,14 @@ function shortTitle(title, max = 52) {
   return t.length > max ? t.slice(0, max - 1) + '…' : t;
 }
 
+// "area 6" for a working-area goal, else nothing (task 1004057). Read from the
+// goal's working_area FIELD, never parsed from its title and never taken from
+// sort_order or the id, which both look like it and are not.
+function areaTag(g) {
+  const n = g && g.working_area;
+  return Number.isInteger(n) && n > 0 ? 'area ' + n : '';
+}
+
 // "1 confirmed, 2 backlog" — non-shipped tasks grouped by status, ordered.
 function remainingSummary(remaining) {
   if (remaining.length === 0) return 'none — all shipped ✓';
@@ -283,7 +291,7 @@ function renderStatusWidget(data, criterion) {
   const rows = goals
     ? goals.map((g) => {
         const ach = g.status === 'achieved';
-        const head = `<tr><td class="st-td" colspan="5" style="background:var(--color-background-secondary);font-weight:500;"><i class="ti ti-target" aria-hidden="true"></i> ${sesc(g.title)} <span class="st-sub">· ${ach ? '<span class="st-ok">achieved</span>' : sesc(g.status)}${g.criteria.length ? '' : ' · no criteria yet'}</span></td></tr>`;
+        const head = `<tr><td class="st-td" colspan="5" style="background:var(--color-background-secondary);font-weight:500;"><i class="ti ti-target" aria-hidden="true"></i> ${sesc(g.title)} <span class="st-sub">· ${areaTag(g) ? sesc(areaTag(g)) + ' · ' : ''}${ach ? '<span class="st-ok">achieved</span>' : sesc(g.status)}${g.criteria.length ? '' : ' · no criteria yet'}</span></td></tr>`;
         return head + g.criteria.map(critRow).join('');
       }).join('')
     : data.criteria.map(critRow).join('');
@@ -336,7 +344,7 @@ function renderStatusMarkdown(data, criterion) {
   const tableHeader = () => { lines.push('| | Criterion | Pos | Shipped | Remaining |'); lines.push('|---|---|---|---|---|'); };
   if (goals) {
     for (const g of goals) {
-      lines.push(`**🎯 ${g.title}** — ${g.status === 'achieved' ? 'achieved ✓' : g.status}${g.criteria.length ? '' : ' · no criteria yet'}`);
+      lines.push(`**🎯 ${g.title}** — ${areaTag(g) ? areaTag(g) + ' · ' : ''}${g.status === 'achieved' ? 'achieved ✓' : g.status}${g.criteria.length ? '' : ' · no criteria yet'}`);
       if (g.criteria.length) { tableHeader(); for (const c of g.criteria) lines.push(critRow(c)); }
       lines.push('');
     }
@@ -383,7 +391,7 @@ function printAll(data) {
   };
   if (goals) {
     for (const g of goals) {
-      console.log(`  🎯 ${g.title}  [${g.status === 'achieved' ? 'achieved ✓' : g.status}]${g.criteria.length ? '' : '  (no criteria yet)'}`);
+      console.log(`  🎯 ${g.title}  [${areaTag(g) ? areaTag(g) + ' · ' : ''}${g.status === 'achieved' ? 'achieved ✓' : g.status}]${g.criteria.length ? '' : '  (no criteria yet)'}`);
       for (const c of g.criteria) printCrit(c);
       if (g.criteria.length) console.log('');
     }
@@ -523,4 +531,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { parseArgs, resolveVersion, defaultedVersionNote, positionalRefNote, renderStatusWidget, renderStatusMarkdown };
+module.exports = { parseArgs, resolveVersion, defaultedVersionNote, positionalRefNote, renderStatusWidget, renderStatusMarkdown, areaTag };

package/scripts/gds/upgrade.js

@@ -127,9 +127,9 @@ function restorePin(instanceDir, depString, fsImpl = fs) {
 
 // ---- steps (each injectable for tests) --------------------------------------
 
-// `ignore` is waived (it comes from — and is argued for in — claude-materialize.js materializeWillRewrite, task 1004122); every OTHER dirty path still halts the bump.
+// `ignore` is waived (it comes from — and is argued for in — claude-materialize.js materializeWillRewrite, task 1004122); every OTHER dirty path still halts the bump. -uall (task 1004188): a bare status collapses a NEW untracked dir to one '?? dir/' entry the file-path waiver never matches.
 function gitTreeClean(instanceDir, run = spawnSync, ignore = []) {
-  const r = run('git', ['status', '--porcelain'], { cwd: instanceDir, encoding: 'utf8' });
+  const r = run('git', ['status', '--porcelain', '-uall'], { cwd: instanceDir, encoding: 'utf8' });
   if (!r || r.error || r.status !== 0) return { ok: false, reason: 'git status failed (not a git repo?)' };
   const skip = new Set(ignore), all = (r.stdout || '').split('\n').filter((l) => l.trim());
   const kept = all.filter((l) => !skip.has(l.slice(3).trim()));

package/scripts/public-mirror-export.js

@@ -22,7 +22,13 @@
 //
 // The 6-month delay alone does NOT scrub secrets/topology — redaction is mandatory and
 // the gate is the backstop. Reuses the status-mirror-sync transport shape (--repo-dir /
-// --push + a scoped deploy key, see .github/workflows/sync-public-mirror.yml).
+// --push + a scoped deploy key).
+//
+// PUBLISHING IS A MANUAL STEP. No workflow or schedule runs this script (there is
+// no sync-public-mirror workflow) and nothing publishes the public mirror automatically.
+// A person runs it by hand, e.g.
+//   node scripts/public-mirror-export.js --repo-dir <mirror-checkout> --push
+// (a scheduled public release channel needs the owner's approval first).
 //
 // USAGE:
 //   node scripts/public-mirror-export.js --repo-dir <mirror-checkout> [--push]

package/src/bongos/module-scope-map.js

@@ -73,6 +73,16 @@ const MODULE_GLOBS = {
     // protected - ADR 0314 in a second costume. Ownership follows what the
     // file IS, and what it is is the core read facade over ten modules.
     'src/bongos/routes/me.js',
+    // The rest of the core route directory (task 1004116). It is a BLANKET
+    // protected glob, so every file in it is walled, but until now only the two
+    // entries above were authorable: sixteen live routes (auth, public,
+    // core-update, builders, ...) sat in no module's territory and no goal could
+    // author a task on them. They are the core HTTP surface that stayed in core
+    // while domain routes carved into modules/<key>/routes/, so they are kernel's.
+    // Kernel was already protected, so this changes no module's protected status;
+    // the me.js overlap the task feared is gone (task 1004110 moved it here too).
+    // The two explicit entries above stay for their reasons.
+    'src/bongos/routes/',
     'server.js', 'config/',
   
     // ADOPTED (task 1004111): a protected path owned by no module is authorable
@@ -340,6 +350,9 @@ const MODULE_GLOBS = {
   //     (tests/npm_release_*.mjs) because a default-off module's own tests/ is skipped
   //     by the unit runner. The /deploy page shell stays hall-ui's (one key per surface).
   'npm-release': ['modules/npm-release/', 'tests/npm_release_*.mjs'],
+  // --- the render-deploy module (task 1004270): a Render project's deploy page. Tests live at
+  //     the repo root (tests/render_deploy_*.mjs) for the same reason as npm-release above.
+  'render-deploy': ['modules/render-deploy/', 'tests/render_deploy_*.mjs'],
   // --- instance provisioning: the web-tier REQUEST + STATE surface (module home)
   //     plus the control-plane runner CLI — a command travels with its domain (the
   //     lifecycle precedent). Covers the projects-surface work (goal

package/src/bongos/serve-internal.js

@@ -986,7 +986,9 @@ function mountInternalSurfaces(app) {
     if (req.method !== 'GET' && req.method !== 'HEAD') return next();
     if (!DEPLOY_PAGE_RE.test(path.posix.normalize(req.path))) return next();
     let door = false;
-    try { door = isModuleEnabled('provisioning'); } catch { door = false; }
+    // The page also exists where the render-deploy module is on: a Render project's own deploy
+    // page (task 1004270). Neither module on and the page still answers with Settings.
+    try { door = isModuleEnabled('provisioning') || isModuleEnabled('render-deploy'); } catch { door = false; }
     if (door) return next();
     return res.redirect(302, `${isBuildersHost(req) ? '' : '/builders'}/settings#software-update`);
   });

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.19.1081'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.1'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -255,6 +255,15 @@ module.exports = {
   // second protected list — so a module reaches it via the doorway, not a deep
   // core require (which the module-boundary fitness check would red). PERMANENT.
   get goalScopeCheck() { return require('./bongos/goal-scope-check'); },
+  // cascadeDispatch — the cheapest-model-first cascade router (src/bongos/
+  // cascade-dispatch.js, task 1001691 / ADR 0101 Part 1). KERNEL (it composes
+  // no domain state — a pure ladder + an injected runner), grandfathered
+  // dormant core since System 3 (grading/CLAUDE.md's own note: "stays in
+  // src/gds/... nothing calls it but its mock unit test"). The lifecycle
+  // module's relevance/anti-hack judge (goal-task-relevance-judge.js) is its
+  // FIRST real caller, injecting grade.runSubagent (resolved via the `grade`
+  // port, never required directly) as the runner — never a deep core require.
+  get cascadeDispatch() { return require('./bongos/cascade-dispatch'); },
 
   // === DOMAIN capabilities still on the doorway — SCHEDULED TO RELOCATE ======
   //     NOT kernel: these leak a domain's queries through the doorway (ADR 0091