@bongos/core 1.19.114 → 1.19.115

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.114",
-  "core_contract": "1.19.114",
-  "source_commit": "0de67d2652248283befaf1c2ee7ecbf83fa50346",
+  "core_version": "1.19.115",
+  "core_contract": "1.19.115",
+  "source_commit": "f98d169e99486bbb55d50e2fb3b18d2d0e035400",
   "source_ref": "HEAD",
-  "built_at": "2026-08-14T15:52:55.624Z",
+  "built_at": "2026-08-14T17:50:49.780Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 302,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1236,
+    "functional_verbatim": 1235,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1559,
-  "tree_sha256": "f530c12a47c766a901cbfd537e9aa4cdaa95663cfda270bbc25c8575fee0bede",
+  "file_count": 1558,
+  "tree_sha256": "85dc1b669e706f57dd7ae065edc3c04eba737c5875959566b2487e6b01053e59",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1172,7 +1172,7 @@
     {
       "path": "docs/adr/0143-onboarding-repo-picker-oauth-scope.md",
       "mode": "0000644",
-      "sha256": "d1dd9398825ef9bd9ab613427c5bfeab561d94b0af10abc7ad9041177c88c9b4"
+      "sha256": "6057dfbc25ed45f545f469ee59e7b232fd2b922b1968d1582b519f285f890b7a"
     },
     {
       "path": "docs/adr/0144-devbox-rehome-onto-cloudbongos-plane.md",
@@ -1192,7 +1192,7 @@
     {
       "path": "docs/adr/0145-free-hosted-project-tier-isolation-and-domain-separation.md",
       "mode": "0000644",
-      "sha256": "71835c589de921e99485dfe07bbc61a864cce690dff47fd42f0b25ce5e31406f"
+      "sha256": "53488f1ff783c49467dd7f9bcf17f5a35c8e3161e2840a89ac5f3f571f7471d9"
     },
     {
       "path": "docs/adr/0146-configurable-reward-mode-cost-plus-only.md",
@@ -1342,7 +1342,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "2cb65f1332abf4cb1a232df38caedf38399f34edd7058b27458b75e51cd564c7"
+      "sha256": "3b5917da91883faf736528e7ba5600356f06056228a7c81c7d5e025762253699"
     },
     {
       "path": "docs/architecture.md",
@@ -3837,7 +3837,7 @@
     {
       "path": "modules/provisioning/onboard-plan.js",
       "mode": "0000644",
-      "sha256": "fe0990abe9087922ca2e376fed805b9138c5b716a684531c173b903c633bdffa"
+      "sha256": "e06957844e7161ef42e9971cc1a9b952d9ae87a781b2821d882085ca02c6eccf"
     },
     {
       "path": "modules/provisioning/pollers/liveness-sweep.js",
@@ -3857,7 +3857,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "f3242a86d28b91fb089d58b1d6ce1735946bcac15d6fe3438d79e805bf4ba1bc"
+      "sha256": "1880a5b0812a32feb9dc313024b3a27b1403884316f17fbaad68909872e21535"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -4152,12 +4152,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "de51e915b8cf14b11d3cc68cc6106a2baed1bf351da2c94be74ff65b42c2ac09"
+      "sha256": "d7ad6805c0d040d4d14e0f95b7be3fc175b3e89068e8cb17b08be555827fe029"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2fdb7573bd5efafc25771e96ce4a3fc790a8d5e83483dac1c3d3bcd3f1b513fe"
+      "sha256": "feca9d093739c6fc3c7067bc4fbe725ff7e8cffd9420ddb6d2be632542b03667"
     },
     {
       "path": "public-docs/index.html",
@@ -4397,18 +4397,13 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "ad327f42773674cc3a6deb3f65e0f9da89fd1c4c47947c513a958a0b8d37ff5f"
+      "sha256": "b615a392fea969c2b0549476843f26d5185cabc6556036e1f3337aacdeac359e"
     },
     {
       "path": "public-landing/buddha.png",
       "mode": "0000644",
       "sha256": "411319a732791bee09e15b745229b70319488427a492a5edabade5a38461fb4c"
     },
-    {
-      "path": "public-landing/create.html",
-      "mode": "0000644",
-      "sha256": "efcc1894c06d1f4755028ae554707a61f8ef6e6753d7d7554f94e3748910f155"
-    },
     {
       "path": "public-landing/index.html",
       "mode": "0000644",
@@ -4417,7 +4412,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "1a58ca91bed5e4658599b1290465ee83b5845b7465376e13d19bd79ab6ac3dc1"
+      "sha256": "961850a566b9fa797036b9ac8b12b3f0eacf5cc6f5fbabbb6230dccd02e836b8"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -4522,7 +4517,7 @@
     {
       "path": "scripts/gds/audit-authorship.sh",
       "mode": "0000644",
-      "sha256": "6922f6008c72db47855172fce7e40df0953575b7bead0504758648e2cf2859e9"
+      "sha256": "b574ba3d0e3c279bcd478e0dfdc14eff101ae7675579fa03b536ca086a2e4831"
     },
     {
       "path": "scripts/gds/audit-deps.js",
@@ -5027,7 +5022,7 @@
     {
       "path": "scripts/gds/onboard.js",
       "mode": "0000644",
-      "sha256": "11472bb450751330e865cbd8f6dba0276005f120db6438e058cd148dbeb580fb"
+      "sha256": "2a8fd60c85b7ef4372a3325d44c9b939f394c5ab1a8364985f2278abfdb8aca4"
     },
     {
       "path": "scripts/gds/onboarding-analyze.js",
@@ -5732,7 +5727,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "766abd484728dd8ceb692aa3a4e5a1c4e68f9767503af3982ba69bc6deabe0c6"
+      "sha256": "e80df1f75bd2a569a72d29eaa00146960390d86ef9a6fd66535d89aac6e6bd39"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -5772,7 +5767,7 @@
     {
       "path": "src/platform-server.js",
       "mode": "0000644",
-      "sha256": "6ffe23398bc452b4224e7c4aa49dbd3c4f61a61da0fd51d43bb6c5ce0bd51aa7"
+      "sha256": "9567d70acc5150dbdd0f6ea1df996977f2566c8c577bd6c9d0ca05516163dc1b"
     },
     {
       "path": "src/ui/adapters/claude-design/index.js",
@@ -6237,7 +6232,7 @@
     {
       "path": "tests/cosmos_token_contrast.mjs",
       "mode": "0000644",
-      "sha256": "f295115dbefe49aef1ac4cb9b34404952fb92c858d45f00af2caacee580ec9ce"
+      "sha256": "a133a1ed438dfb589b0e31ce2dacced2e38e1047411d85e0086d4c2ff8b88f16"
     },
     {
       "path": "tests/cost.mjs",
@@ -7032,7 +7027,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "f52f1f92215b6352b90faafb32d7b9ae546724d28172196cdf6137630df2d569"
+      "sha256": "e858ff2ae89fbd1577dc00f988c97b71e91f06ee754f5513ba8c18c214d3e181"
     },
     {
       "path": "tests/module_api.mjs",
@@ -7137,7 +7132,7 @@
     {
       "path": "tests/onboard.mjs",
       "mode": "0000644",
-      "sha256": "40d4656e2170370cd3b662911502579fed595fd66fd25b8add65d488a28bb834"
+      "sha256": "72590fd2d6f99db3020cb5488ec4f31cef2ad15718a63d8b147ab5adefe347f7"
     },
     {
       "path": "tests/onboarding_gate.mjs",
@@ -7217,7 +7212,7 @@
     {
       "path": "tests/platform_boot.mjs",
       "mode": "0000644",
-      "sha256": "220230af482f6ac97067ac9e78c133f754b160155b9f2dcb8c3db70ac8818f41"
+      "sha256": "de3bbe68cb648ad5027506f7dcf848e2758e9e67ea65d8c7fb27febbab264845"
     },
     {
       "path": "tests/post_login_landing.mjs",
@@ -7257,7 +7252,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "dc915f8d09f97eb4a359bf4627a4e4dddb77daf2cd438084bae1b4abbe04963d"
+      "sha256": "8cd0d3f4ce68085f782fbd3e359039ad6d20198bc706481f165c39ee133cea3a"
     },
     {
       "path": "tests/provision.mjs",
@@ -7292,7 +7287,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "e03bbf258cb4b8ffd3e242ab2ddd927d1f52706347d06b539a386ca502caf1e4"
+      "sha256": "2d4dea6cd6be287c1d7629009adc64fba526b1ebbe53a800ae43499e1b8e3f18"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/docs/adr/0143-onboarding-repo-picker-oauth-scope.md

@@ -7,7 +7,7 @@
 
 ## Context
 
-The onboarding wizard at `/create` ([public-landing/create.html](../../public-landing/create.html)) had the visitor **type `owner/repo` by hand** (adopt) and, for a fresh project, do a **manual** "New repository on github.com → leave it empty" step. Owner feedback: make it real — let the signed-in user **pick from their own repos** (adopt) and **auto-create the empty repo** (fresh).
+The onboarding wizard at `/create` (`public-landing/create.html`, absorbed into `projects.html` `?view=new` by task 1002763) had the visitor **type `owner/repo` by hand** (adopt) and, for a fresh project, do a **manual** "New repository on github.com → leave it empty" step. Owner feedback: make it real — let the signed-in user **pick from their own repos** (adopt) and **auto-create the empty repo** (fresh).
 
 Blocker: the wizard's GitHub sign-in requests only `read:user` ([auth.js `SCOPE`](../../src/bongos/auth.js)), which cannot list or create repos, and `completeWebFlow` discarded the OAuth token after reading the username. Two ways forward were weighed:
 

package/docs/adr/0145-free-hosted-project-tier-isolation-and-domain-separation.md

@@ -7,7 +7,7 @@
 
 ## Context
 
-Owner design review of the `/create` wizard ([public-landing/create.html](../../public-landing/create.html)) asked that a new project be reachable at a **free `<handle>.<platform>` address that works out of the box** (sign-in included), with **bring-your-own-domain** as the optional upgrade — i.e. the handle becomes a real subdomain, not just an internal name.
+Owner design review of the `/create` wizard (`public-landing/create.html`, absorbed into `projects.html` `?view=new` by task 1002763) asked that a new project be reachable at a **free `<handle>.<platform>` address that works out of the box** (sign-in included), with **bring-your-own-domain** as the optional upgrade — i.e. the handle becomes a real subdomain, not just an internal name.
 
 Today `/create` always provisions the **`standalone`** shape (the owner's own GitHub repo + a pinned `@bongos/core`, run **control-plane-local** on the hub box), and sign-in on a standalone requires the owner to hand-create their own GitHub OAuth app. The natural-looking implementation was: default the address to `<handle>.cloudbongos.com` and extend the hub federation ([ADR 0141](<redacted>.md)) — which already gives co-tenant instances zero-setup sign-in — to standalone instances on that subdomain. A pre-build security review found this **UNSAFE** on two independent counts.
 

package/docs/api/openapi.json

@@ -8733,7 +8733,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/onboard-plan",
-        "description": "GET /provisioning/onboard-plan?mode=greenfield|adopt&domain=<host> — the CANONICAL onboarding step sequence (task 2085; goal 35 / criterion 165: \"the canonical step sequence is the source of truth; skill/CLI/hall are forms over it\"). The branded /create page + the hall wizard fetch it so their human-steps checklist can't drift from the CLI's (scripts/gds/onboard.js reads the same modules/provisioning/onboard-plan.js). `domain` relabels the terminal enter-hall step with the instance's own hall address (task 1002703); a non-hostname is dropped — clients render these labels, so unvalidated input must never be echoed back. rank: public — the signed-out /create landing page reads it; it is the same public runbook the /new-project skill documents (no write, no secret).\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "GET /provisioning/onboard-plan?mode=greenfield|adopt&domain=<host> — the CANONICAL onboarding step sequence (task 2085; goal 35 / criterion 165: \"the canonical step sequence is the source of truth; skill/CLI/hall are forms over it\"). The hub's ?view=new wizard fetches it so its human-steps checklist can't drift from the CLI's (scripts/gds/onboard.js reads the same modules/provisioning/onboard-plan.js). `domain` relabels the terminal enter-hall step with the instance's own hall address (task 1002703); a non-hostname is dropped — clients render these labels, so unvalidated input must never be echoed back. rank: public — the signed-out hub wizard (/projects?view=new) reads it; it is the same public runbook the /new-project skill documents (no write, no secret).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "responses": {

package/modules/provisioning/onboard-plan.js

@@ -2,8 +2,8 @@
 //
 // Goal 35 / criterion 165 names the sequence as the source of truth: "The canonical
 // step sequence is the source of truth; skill/CLI/hall are forms over it." This file
-// is that ONE source. The CLI (`bongos onboard`, scripts/gds/onboard.js), the branded
-// /create landing page, and the hall's new-project wizard all read it — via a direct
+// is that ONE source. The CLI (`bongos onboard`, scripts/gds/onboard.js) and the hub's
+// ?view=new create wizard (task 1002763) read it — via a direct
 // require (the CLI) or the public GET /provisioning/onboard-plan route (the web) — so
 // the sequence can never drift between the forms (task 2085, anti-drift).
 //

package/modules/provisioning/routes/provisioning.js

@@ -611,13 +611,13 @@ module.exports = function provisioningRoutes() {
 
   // GET /provisioning/onboard-plan?mode=greenfield|adopt&domain=<host> — the CANONICAL
   // onboarding step sequence (task 2085; goal 35 / criterion 165: "the canonical step
-  // sequence is the source of truth; skill/CLI/hall are forms over it"). The branded
-  // /create page + the hall wizard fetch it so their human-steps checklist can't drift
+  // sequence is the source of truth; skill/CLI/hall are forms over it"). The hub's
+  // ?view=new wizard fetches it so its human-steps checklist can't drift
   // from the CLI's (scripts/gds/onboard.js reads the same
   // modules/provisioning/onboard-plan.js). `domain` relabels the terminal enter-hall
   // step with the instance's own hall address (task 1002703); a non-hostname is dropped
   // — clients render these labels, so unvalidated input must never be echoed back.
-  // rank: public — the signed-out /create landing page reads it; it is the same public
+  // rank: public — the signed-out hub wizard (/projects?view=new) reads it; it is the same public
   // runbook the /new-project skill documents (no write, no secret).
   router.get('/provisioning/onboard-plan', (req, res) => {
     const mode = req.query.mode === 'adopt' ? 'adopt' : 'greenfield';

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.114",
+  "version": "1.19.115",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.114",
+      "version": "1.19.115",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.114",
+  "version": "1.19.115",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -1,7 +1,8 @@
 /* ═══════════════════════════════════════════════════════════════════════
    Cloud Bongos — cosmos.css (task 1002696, the R07 redesign)
    The shared token + component layer for the owner-facing project surfaces
-   (/create, /projects).
+   (/projects — the hub carrying the map, your projects, and the create wizard
+   at ?view=new since task 1002763).
 
    THE LOOK — ember marigold (owner, 2026-08-13; task 1002748, and before it
    the 2026-08-12 Loop 2 decisions). A LIGHT/DARK mode flips the WHOLE WORLD,
@@ -51,6 +52,9 @@
   /* semantic state tier — each is painted as 12px/700 chip TEXT on its own
      -soft tint, so each must clear 4.5:1 against that tint AND the plain card. */
   --ok:#0e6b31; --warn:#8b4d03; --err:#bb1f1f;
+  /* the label INK on an --ok fill (the wizard tick, sdone chips, Copied) --
+     dark flips --ok to a bright mint, where white ink drops to 1.74:1 */
+  --on-ok:#ffffff;
 
   /* chrome tier — the WHOLE WORLD flips with the mode (owner, 2026-08-12,
      Loop 2: light = the sunrise white/orange page, dark = the gate's space).
@@ -95,6 +99,7 @@
   --rule:#5e3521; --rule-soft:#3f2317;
   --accent-deep:color-mix(in srgb, var(--accent) 45%, #ffffff);
   --ok:#4ade80; --warn:#fbbf24; --err:#f87171;
+  --on-ok:#0b2e18;
   --page-bg:#150c06;
   --sky-bg:#150c06;
   --star-display:block;
@@ -120,6 +125,7 @@
     --rule:#5e3521; --rule-soft:#3f2317;
     --accent-deep:color-mix(in srgb, var(--accent) 45%, #ffffff);
     --ok:#4ade80; --warn:#fbbf24; --err:#f87171;
+    --on-ok:#0b2e18;
     --page-bg:#150c06;
     --sky-bg:#150c06;
     --star-display:block;
@@ -336,11 +342,11 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .strip.flowDown .stages li.now .slbl,.strip.flowDown .stages li.done .slbl{color:var(--ink-soft);}
 
 /* ── layout primitives (task 1002748, direction §6). cosmos.css was built for
-   /create and /projects — two single-column forms — so it had no page container,
+   the create wizard and /projects — two single-column forms — so it had no page container,
    no type scale below h1, no section rhythm and no grid. The landing page needed
    all five; they live HERE rather than page-locally so the marketing surface and
    the working surfaces stay one system instead of two that merely resemble each
-   other. `.hero` above is the /create + /projects page-title block and is a
+   other. `.hero` above is the /projects page-title block and is a
    different thing from a landing hero — both are kept. ── */
 .wrap{position:relative;z-index:1;max-width:1060px;margin:0 auto;padding:0 clamp(16px,4vw,40px);}
 .sec{margin-bottom:var(--pad-xl);}