@bongos/core 1.19.205 → 1.19.207

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.205",
-  "core_contract": "1.19.205",
-  "source_commit": "d0acea23dc9611622e44ceb27f2632f3691451c7",
+  "core_version": "1.19.207",
+  "core_contract": "1.19.207",
+  "source_commit": "f67179175e23c7d9144c3ede28fd365783eed34f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T19:35:41.400Z",
+  "built_at": "2026-08-17T20:29:20.492Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1296,
+    "functional_verbatim": 1298,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1627,
-  "tree_sha256": "17c1dd5861c35d9e42508f3ad241714488c6cd8fa4e81597c214e2e3c022e647",
+  "file_count": 1629,
+  "tree_sha256": "fb6abbc6818ae6e399e4154a08816d3aeeaf4d9cd65ab89ff1bb3ce3f33428b5",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -187,7 +187,7 @@
     {
       "path": ".claude/skills/new-project/SKILL.md",
       "mode": "0000644",
-      "sha256": "55b86978a60e33eefe024d7c7d521e4093b82235eeb7e5d4a145fbb0e4db0b06"
+      "sha256": "9b36d441850c335fa634d892088e4c15a2a87acaa9e52808b74a8b2e6e9af39f"
     },
     {
       "path": ".claude/skills/otb-character-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "4801db32c6f4ba6220bce8e664be063f8d8483bc22a57df08205b0fc36788b8b"
+      "sha256": "2755203dec4a1450c5950c39a767bc093d1d1227f952193001cdfa94205e995f"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "c3ff3f8c529ac99fe6f968bd3ec110bb6a03c5788caf4dbbab5f59147af28b4c"
+      "sha256": "7b4e5ecf6c6d12a3c9e603a0f5b4bd28ba8cd991399ed8941181b6aeae53772d"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "9de16e178984c7c9ac9c20de3de8ca074bb904423b20a8459a93ce838c1507ea"
+      "sha256": "a92355ef21073634500f6806f1e495c955a0b67e889cf07264ed8d1169b119be"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "b37e4a561554ec579b525ff660246d350a70c4acdda9a16d8e6521c38180bae6"
+      "sha256": "8fe97a3daefdceb9bf40a15a19dffb81fb6387c0acbe20041e58e63b24e80dd1"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "d5f8ca20a0826b3258c909d870da54ebd4c3e757c8c35a306c1fa7a72b8292c4"
+      "sha256": "adb2a36a9598c543adbf7c8011f36585f7c394bac7f4961718359ee7a29cb1dd"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -707,7 +707,7 @@
     {
       "path": "docs/adr/0055-server-mediated-branch-publish.md",
       "mode": "0000644",
-      "sha256": "6f51c67939eacaf510774894625d0a09e6883e4c8e1d8fdea2cf35f8d9f58ea4"
+      "sha256": "11ee013554922e0f9dadb582373c22d4aaa6433ddcb14af28386c4843a39497f"
     },
     {
       "path": "docs/adr/0056-prod-deploy-script-mirror-and-healthcheck-retry.md",
@@ -1137,7 +1137,7 @@
     {
       "path": "docs/adr/0133-github-app-manifest-onboarding-signin.md",
       "mode": "0000644",
-      "sha256": "94e1f79e0a32a53b51e5bbf6d10d37d477d676cad33b267dc3ddc0891ae70704"
+      "sha256": "dbd5b30d75631ba2754f4e7da0d43c03b1ed998b4082e8df23de0d7e7d5c5305"
     },
     {
       "path": "docs/adr/0134-private-first-npm-distribution.md",
@@ -1367,12 +1367,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "32c6c5fe14cf8684d353f0c73cde4b09d84ba61eabcb13e75c11bd5b7f9be2b7"
+      "sha256": "52554cf7c8e5355c59594c872f30975581eb6c1b9a5bcb63efa1a1a19f2d3877"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "7892d449572d19f058c6ac364d5b697e28d76bcd922d25d33b5203f5e1b5b7aa"
+      "sha256": "825af2c499836301a34cff79192e41556cc863fe9a5378d9e5134c862769c2fa"
     },
     {
       "path": "docs/architecture.md",
@@ -1672,7 +1672,7 @@
     {
       "path": "docs/recipes/ops-gotchas.md",
       "mode": "0000644",
-      "sha256": "52a209553565405dca461b1c4c0cef9fb0ec6d98b95ed420c82eaf1fa3eb15f6"
+      "sha256": "d9956abefe8496cbbb8bbc94361431d40823c3a9d1fa8f4145e8b48999b54672"
     },
     {
       "path": "docs/recipes/overnight-builder.md",
@@ -2682,7 +2682,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "9de16e178984c7c9ac9c20de3de8ca074bb904423b20a8459a93ce838c1507ea"
+      "sha256": "a92355ef21073634500f6806f1e495c955a0b67e889cf07264ed8d1169b119be"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3567,7 +3567,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "aef4e5dca5cbea3c7c2041b877a98204f2cb21c3a9ce017cad57955d2212cf96"
+      "sha256": "127b6666bfbc4b85baebe85b0bf5501ad73b517faf4dafbc1a76a5535ac04ebc"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -3622,7 +3622,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "6e41bbab9f8277a13178e4f9fcd278b47b8b34421114522ac113e57aedb631ac"
+      "sha256": "1cca02e8eff2b0a7fdc1fa06ad6be2f633e25a29bdd10dddf6147610fdae087a"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -3662,7 +3662,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "68b4f47e3a5016645893c60eca2fe11a242012abf6625c99d6a774356d82d1ce"
+      "sha256": "95193b64dcf1121f10fbc871a07cb7997a27a64d3f7b2176957abdae28979729"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -3949,6 +3949,11 @@
       "mode": "0000644",
       "sha256": "8dc04a18ad77563a2bd73029bf13cab03fb5dadd1b62850fddbde475257e6a76"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_009_project_settings.sql",
+      "mode": "0000644",
+      "sha256": "de17cfb74f8684044abfb03e56698f91fa5aa813608f3a19d2ddf81d113e897e"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -3957,7 +3962,7 @@
     {
       "path": "modules/provisioning/onboard-plan.js",
       "mode": "0000644",
-      "sha256": "e06957844e7161ef42e9971cc1a9b952d9ae87a781b2821d882085ca02c6eccf"
+      "sha256": "de7927d2a3c1aac0d40ec5b1ac6c2e98e87cb593c4d3d2bd6ddfe3696371bff6"
     },
     {
       "path": "modules/provisioning/pollers/liveness-sweep.js",
@@ -3967,7 +3972,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "eebcba4b333030f17c06bc6e1423450ae4af124e4075af52cbd512e80d5ba95e"
+      "sha256": "b9d4ee116eb4b213b084408868f727a4587876faa5fae78f4d2f64cb2fe12231"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -3977,7 +3982,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "17f6adb4edd7dee2ab339f5d302b61ecfbcf45db2ba4d0315eeeffbad87a9dce"
+      "sha256": "78c89017e17dfba57ade2330fce293e6422aab316e9311f8215ff3eb9fdc3fe5"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -3987,7 +3992,7 @@
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
       "mode": "0000644",
-      "sha256": "98787fad5df787a8ebdbf90fb8bf21b68f1529387b15d65724fdafc8ac0b91d0"
+      "sha256": "3db404b6ad50e01de0b1d73131cefc01ab8fe939eee18157ba6aa8f28a05fb7f"
     },
     {
       "path": "modules/provisioning/ui/.gitkeep",
@@ -4277,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7354ee51c98271c15bb6f173f19c151ce6386a4e837b3534432376d743ed76cc"
+      "sha256": "fc64c06226801735546c101af64db40d30492a4ce855303e538bac1111a18930"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "88bc02329b19b8b55b8f19a63fa8e56d582da98dd40179e5dda1766d9d2ce296"
+      "sha256": "d3457496b5c76bab949eb1693518d88745db75eb7bd3afb4299d68e545cdb0bd"
     },
     {
       "path": "public-docs/index.html",
@@ -4542,7 +4547,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "5edfc22fd5d85453df0d83a531fd085b3d5d079b66c7e3f58dcb9a0261c6b4a6"
+      "sha256": "494d1aa1a6ff006a8e8f239c29d90c052f735919937c9dc6fb6b8eeff4902e91"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5152,7 +5157,7 @@
     {
       "path": "scripts/gds/onboard.js",
       "mode": "0000644",
-      "sha256": "c6fb2c531c6d84dcb16daea50984e1b24021b6379cf992a01482951b119bf9e4"
+      "sha256": "71ee037f1e893a1bcbcaca95e6bdc80c5eb4f5d3e613b59b95e1272d673d3d12"
     },
     {
       "path": "scripts/gds/onboarding-analyze.js",
@@ -5197,7 +5202,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "1c348e8859004c69e66b8eede56da0bab68ec4d473790f1c1f9bf1769934211f"
+      "sha256": "242f51c3e2ae991dc8a02d7285c829d3cd7b2a4022c516b218d259cac14b855f"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -5892,7 +5897,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3796fb722590f24c98f87a4d5467cb91c047a7dba8f544158b4495b3537a84d6"
+      "sha256": "167ead50611054c2a0d46ebb14510c993e7c05e9c86428cad2d15d78aae0bad4"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7377,7 +7382,7 @@
     {
       "path": "tests/onboard.mjs",
       "mode": "0000644",
-      "sha256": "72590fd2d6f99db3020cb5488ec4f31cef2ad15718a63d8b147ab5adefe347f7"
+      "sha256": "c6823a6f0f81bcb4f01ccbd2364d6dcf76eb21e3ff10972738f792438939dee0"
     },
     {
       "path": "tests/onboarding_gate.mjs",
@@ -7517,7 +7522,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "9e8da984a2a9378809f03cc3f5f1c2cda34f8589ad954db1acd5b12bf424f322"
+      "sha256": "30b55efaa97e695603875ec057901d5333977d41705fc862fc831a424c4e2674"
     },
     {
       "path": "tests/provisioning_default_domain.mjs",
@@ -7539,6 +7544,11 @@
       "mode": "0000644",
       "sha256": "7749df454ac3cca7c7e5ea1acc94ead15d1c9f87b38fe2028a1c93c8adf31bcf"
     },
+    {
+      "path": "tests/provisioning_settings.mjs",
+      "mode": "0000644",
+      "sha256": "bb800d2e15045efbac4fadbc62996054d33e163eb86e6a5e09087d409cc7fbfa"
+    },
     {
       "path": "tests/provisioning_slug_available.mjs",
       "mode": "0000644",
@@ -7572,7 +7582,7 @@
     {
       "path": "tests/publish_branch_route.mjs",
       "mode": "0000644",
-      "sha256": "db309db9b8fe350a64708d2a0c9dd1622ad0e5bfdef7c89775721ff3daa7042d"
+      "sha256": "485b2b965bcf44a515571de43851c42a32f278dcdd02510f0d3cd9f6ac53e61c"
     },
     {
       "path": "tests/publish_manifest.mjs",
@@ -7582,7 +7592,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "fed6533bd829adc0fc2126c48b28248c90bd32660650f2af91fee112e3f7369a"
+      "sha256": "1dfca44ba378b69041894371c1a3765eba40edbdec18570d7b67cc849bcb9e8a"
     },
     {
       "path": "tests/rank_gate.mjs",

package/.claude/skills/new-project/SKILL.md

@@ -9,7 +9,7 @@ You are guiding a new owner from **zero to a live, owned Cloud Bongos instance**
 
 A new instance is **standalone** (ADR 0108): it runs from its **own git repo** with `@cloudbongos/core` installed as a **pinned npm dependency**, not a fork of this monorepo. Central updates are a `bongos upgrade` version-pin bump, not a merge. Every step below assumes this shape (`hosting_shape=standalone`).
 
-Four steps are **irreducibly human** and must be rendered as **precise, UI-first, copy-paste-safe prompts** (a non-technical owner does them with browser clicks, no terminal guessing): (1) create the GitHub repo, (2) approve the pre-filled **GitHub App** for sign-in (ONE click — the App Manifest flow, task 2080; no secret to paste), (3) own a domain, (4) the first sign-in. Everything else is automated. Never ask the owner to do in a terminal what they can do with a click.
+Five steps are **irreducibly human** and must be rendered as **precise, UI-first, copy-paste-safe prompts** (a non-technical owner does them with browser clicks, no terminal guessing): (1) create the GitHub repo, (2) approve the pre-filled **GitHub App** for sign-in (ONE click — the App Manifest flow, task 2080; no secret to paste), (3) install that App on the repo (ONE click — the publish credential, task 1003049), (4) own a domain, (5) the first sign-in. Everything else is automated. Never ask the owner to do in a terminal what they can do with a click.
 
 ## The canonical sequence
 
@@ -85,6 +85,8 @@ node scripts/gds/oauth-secret.js place <slug> --client-id <id> --client-secret <
 
 > **Guidance the standup learned:** do **NOT** hand-edit `web.env` with a shell `read -s` — during the Emersonian standup that silently left a 26-char truncated secret that broke sign-in with no obvious cause. `oauth-secret` validates the length/format (catching that truncation), rewrites the env line via Node, restarts the service, then **probes `/healthz` for `auth_configured:true`** before it reports success. If it refuses, the creds are wrong — recheck them; do not proceed.
 
+**Human-only — install the GitHub App on the repo (task 1003049, ADR 0055).** The one-click App doubles as the instance's **publish credential**: the manifest requests Contents rw + PR rw + Actions read, the runner places `GITHUB_APP_ID` + `GITHUB_APP_PRIVATE_KEY` in `web.env`, and the server discovers the installation id on its own — but only an **installed** App can mint push tokens. One click: the wizard's **Install the app on your repo** button (`github.com/apps/<slug>/installations/new`), or GitHub → Settings → Developer settings → GitHub Apps → your app → **Install App** → the project repo. Skip it and every ship strands at `confirmed` behind a manual merge. (Manual OAuth-app path instead? Set a fine-grained `GITHUB_PUSH_TOKEN` in `web.env` — ADR 0055.)
+
 **Human-only — first sign-in.** The owner opens `https://<domain>` and signs in with GitHub **once**. This seats the **founding Archon** — config alone seats no one, so this step is inherent and cannot be automated.
 
 ### 7. Verify

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 276 operations across 46 resource groups
+- 278 operations across 46 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -543,6 +543,10 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app
       postProvisioningInstancesIdGithubApp: (args) => request("POST", "/provisioning/instances/{id}/github-app", { hasBody: true }, args),
+      // GET /provisioning/instances/{id}/settings — rank: any-builder — GET /provisioning/instances/:id/settings
+      getProvisioningInstancesIdSettings: (args) => request("GET", "/provisioning/instances/{id}/settings", { hasBody: false }, args),
+      // PATCH /provisioning/instances/{id}/settings — rank: any-builder — PATCH /provisioning/instances/:id/settings
+      patchProvisioningInstancesIdSettings: (args) => request("PATCH", "/provisioning/instances/{id}/settings", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/teardown — rank: any-builder — POST /provisioning/instances/:id/teardown
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan

package/clients/bongos-client/index.cjs

@@ -542,6 +542,10 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app
       postProvisioningInstancesIdGithubApp: (args) => request("POST", "/provisioning/instances/{id}/github-app", { hasBody: true }, args),
+      // GET /provisioning/instances/{id}/settings — rank: any-builder — GET /provisioning/instances/:id/settings
+      getProvisioningInstancesIdSettings: (args) => request("GET", "/provisioning/instances/{id}/settings", { hasBody: false }, args),
+      // PATCH /provisioning/instances/{id}/settings — rank: any-builder — PATCH /provisioning/instances/:id/settings
+      patchProvisioningInstancesIdSettings: (args) => request("PATCH", "/provisioning/instances/{id}/settings", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/teardown — rank: any-builder — POST /provisioning/instances/:id/teardown
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan

package/clients/bongos-client/index.d.ts

@@ -72,9 +72,10 @@ export interface GetProfilesHandleResponse { account: unknown; cross_project: un
 export interface GetProjectsFeaturedResponse { projects: unknown }
 export interface GetProjectsResponse { projects: unknown }
 export interface GetProvisioningFleetResponse { instances: unknown }
-export interface GetProvisioningGithubAppStatusResponse { ok: boolean; status: unknown; ready: unknown; terminal: unknown; domain: unknown; instance_status: unknown }
+export interface GetProvisioningGithubAppStatusResponse { ok: boolean; status: unknown; ready: unknown; terminal: unknown; domain: unknown; instance_status: unknown; app_slug: unknown }
 export interface GetProvisioningHealthResponse { module: unknown; ok: boolean; coreVersion: unknown }
 export interface GetProvisioningInstancesIdResponse { instance: unknown; open_intent: unknown }
+export interface GetProvisioningInstancesIdSettingsResponse { ok: boolean; settings: unknown; options: unknown }
 export interface GetProvisioningInstancesResponse { instances: unknown }
 export interface GetProvisioningOnboardPlanResponse { mode: unknown; steps: unknown }
 export interface GetProvisioningSlugAvailableResponse { slug: unknown; available: unknown; reason: unknown; address: unknown }
@@ -140,6 +141,8 @@ export interface PatchMeSkillPrefsResponse { prefs: unknown; effective: unknown;
 export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown; effective_map: unknown; volume: unknown; defaults: unknown; known_sounds: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
+export interface PatchProvisioningInstancesIdSettingsRequest { platform_visibility?: string; joinability?: string }
+export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; settings: unknown }
 export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; description?: string; status?: unknown }
 export interface PostAccessRequestsRequest { github_login: string; display_name?: string; note?: string }
 export interface PostAccessRequestsResponse { ok: boolean; request?: unknown; already_pending?: boolean }
@@ -787,6 +790,10 @@ export interface BongosClient {
     postProvisioningInstancesIdForceTeardown(args?: RequestArgs): Promise<PostProvisioningInstancesIdForceTeardownResponse>;
     /** POST /provisioning/instances/{id}/github-app — rank: any-builder */
     postProvisioningInstancesIdGithubApp(args?: RequestArgs & { body?: PostProvisioningInstancesIdGithubAppRequest }): Promise<PostProvisioningInstancesIdGithubAppResponse>;
+    /** GET /provisioning/instances/{id}/settings — rank: any-builder */
+    getProvisioningInstancesIdSettings(args?: RequestArgs): Promise<GetProvisioningInstancesIdSettingsResponse>;
+    /** PATCH /provisioning/instances/{id}/settings — rank: any-builder */
+    patchProvisioningInstancesIdSettings(args?: RequestArgs & { body?: PatchProvisioningInstancesIdSettingsRequest }): Promise<PatchProvisioningInstancesIdSettingsResponse>;
     /** POST /provisioning/instances/{id}/teardown — rank: any-builder */
     postProvisioningInstancesIdTeardown(args?: RequestArgs): Promise<PostProvisioningInstancesIdTeardownResponse>;
     /** GET /provisioning/onboard-plan — rank: public */

package/clients/bongos-client/index.mjs

@@ -539,6 +539,10 @@ export function createClient(opts = {}) {
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app
       postProvisioningInstancesIdGithubApp: (args) => request("POST", "/provisioning/instances/{id}/github-app", { hasBody: true }, args),
+      // GET /provisioning/instances/{id}/settings — rank: any-builder — GET /provisioning/instances/:id/settings
+      getProvisioningInstancesIdSettings: (args) => request("GET", "/provisioning/instances/{id}/settings", { hasBody: false }, args),
+      // PATCH /provisioning/instances/{id}/settings — rank: any-builder — PATCH /provisioning/instances/:id/settings
+      patchProvisioningInstancesIdSettings: (args) => request("PATCH", "/provisioning/instances/{id}/settings", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/teardown — rank: any-builder — POST /provisioning/instances/:id/teardown
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan

package/docs/adr/0055-server-mediated-branch-publish.md

@@ -42,6 +42,8 @@ A **fine-grained GitHub PAT** scoped to the single repo: `Contents: read/write`
 >
 > Check it with `node scripts/gds/publish-credential-check.js` on the host — it lists the repo's workflows as a control call first, so `blind` and `readable_no_workflow` are distinguishable. Task 1002724 makes a blind probe non-fatal (the reconciler falls back to the git-history land proof), but a blind credential means the deploy gate is **not being enforced**, only bypassed.
 
+> **Update (2026-08-17, task 1003049 — fresh instances get the credential from the manifest App; installation id auto-discovered):** a wizard-born instance had NO publish credential at all — the ADR 0133 manifest requested zero permissions and the conversion's `pem` was discarded — so on every new project the auto-merge + reconciler were dead on arrival and each ship stranded at `confirmed` behind manual archon surgery (gap-list W7, proven live on Spike Harbor). Now: the manifest requests exactly this ADR's scopes (Contents rw + PR rw + Actions read), the control-plane runner places `GITHUB_APP_ID` + `GITHUB_APP_PRIVATE_KEY` into the instance's web.env alongside the OAuth creds, and `github-push.js` **discovers the installation id at runtime** (`GET /repos/{owner}/{repo}/installation` with the App JWT; the env var still wins when set) — so `GITHUB_APP_INSTALLATION_ID` is no longer required. The one human step is installing the App on the repo (the onboarding `app-install` step; the wizard renders the one-click `github.com/apps/<slug>/installations/new` link). <redacted> is a first-class loud state: routes answer a plain-sentence 503 naming the install URL, and the publish-reconciler warns once per streak instead of silently parking ships. **Security trade-off (accepted):** the App is public (the W6 sign-in fix), so third parties can install it on their own repos — those installs sit inside a leaked App key's blast radius even though this server only ever uses its own repo's installation. Mitigation: the reconciler's foreign-install watch (`github-push.foreignInstallations`) warns loudly whenever the App is installed anywhere beyond the repo owner. Pre-existing instances: see the ops-gotchas entry (grant the permissions + generate a key by hand, or use a PAT).
+
 ## Consequences
 
 - A dev-box builder ships end-to-end: `/builder-reauth` → claim → edit → `/builder-stage` ([ADR 0046](<redacted>.md)) → `/builder-ship`, with the GDS doing the push. The box holds no GitHub credential, so the [ADR 0053](0053-scoped-dev-box-session.md) blast-radius argument still holds.

package/docs/adr/0133-github-app-manifest-onboarding-signin.md

@@ -31,9 +31,9 @@ The conversion endpoint is unauthenticated (the code is the auth), so the web ti
 
 ### Manifest shape
 
-`redirect_url` = the **mothership** callback (the instance can't do the exchange). `callback_urls` = the **instance's** own `/api/gds/auth/web/callback` (what `auth.js` actually builds) **and** the `/api/bongos/...` alias, so sign-in works regardless of which prefix a build emits. `default_permissions: {}` (sign-in needs none), `hook_attributes.active:false`, `public:true`. Personal vs org differs only in the POST URL (derived from the repo owner); the App works for sign-in either way.
+`redirect_url` = the **mothership** callback (the instance can't do the exchange). `callback_urls` = the **instance's** own `/api/gds/auth/web/callback` (what `auth.js` actually builds) **and** the `/api/bongos/...` alias, so sign-in works regardless of which prefix a build emits. `default_permissions: { contents: 'write', pull_requests: 'write', actions: 'read' }` — sign-in itself needs none, but the App doubles as the instance's ADR 0055 **publish credential** (task 1003049): the conversion's `pem` + app id land in web.env, and once the owner installs the App on the repo the server mints installation tokens to land shipped work itself. `hook_attributes.active:false`, `public:true`. Personal vs org differs only in the POST URL (derived from the repo owner); the App works for sign-in either way.
 
-> **Amended 2026-08-17 (task 1003048, gap-list W6):** the manifest originally set `public:false`. That made every wizard-born project structurally single-builder on the web — GitHub answers a private App's authorize URL for any non-owner account with a bare 404, before the instance is ever involved (reproduced live on Spike Harbor). The App requests zero permissions, so public costs nothing; the manifest now sets `public:true`. Apps minted before the fix must be flipped by hand (GitHub App settings → Advanced → Make public) — see the ops-gotchas entry.
+> **Amended 2026-08-17 (task 1003048, gap-list W6):** the manifest originally set `public:false`. That made every wizard-born project structurally single-builder on the web — GitHub answers a private App's authorize URL for any non-owner account with a bare 404, before the instance is ever involved (reproduced live on Spike Harbor). The App requested zero permissions at the time, so public cost nothing; the manifest now sets `public:true`. (Task 1003049 later added the ADR 0055 repo scopes, which changes the calculus: a public App with write scopes **can** be installed by third parties on their own repos, and a leaked App private key's blast radius includes those installs — the server itself only ever uses its own repo's installation, but the credential could reach further if compromised. Accepted to keep this fix; mitigated by the publish-reconciler's **foreign-install watch**, which warns loudly whenever the App is installed anywhere beyond the repo owner.) Apps minted before the fix must be flipped by hand (GitHub App settings → Advanced → Make public) — see the ops-gotchas entry.
 
 **App name (tasks 2093 → 2095).** GitHub App names are globally unique across all of GitHub, so a bare project slug (e.g. `demo`) is almost always already taken. The auto name is the **instance domain** (e.g. `demo.cloudbongos.com`): a domain is inherently unique (so it never collides) and it reads perfectly on GitHub's sign-in consent screen, where the name is shown as *"`<name>` by `<owner>` … will redirect to `https://<domain>`"* — the name IS the destination. GitHub keeps the dots in the display name (only the internal slug is transformed) and caps it at 34 chars. **Fallback** (no domain, or a domain over 34 chars): brand-qualify the project — `<mothership brand> - <project>`, e.g. `Cloud Bongos - demo`, from the mothership's own `branding().identity.productName` (portable, not hardcoded) — still far less collision-prone than a bare slug. Either way it is only a default the owner can rename on GitHub's confirmation screen.
 

package/docs/api/openapi.json

@@ -8951,6 +8951,119 @@
         ]
       }
     },
+    "/provisioning/instances/{id}/settings": {
+      "get": {
+        "operationId": "get_provisioning_instances_id_settings",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/instances/:id/settings",
+        "description": "GET /provisioning/instances/:id/settings — read a project's effective settings + the allowed values (so a form can render its choices). rank: any authenticated builder (own resource; archon may read any).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProvisioningInstancesIdSettingsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "patch": {
+        "operationId": "patch_provisioning_instances_id_settings",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "PATCH /provisioning/instances/:id/settings",
+        "description": "PATCH /provisioning/instances/:id/settings — change a project's settings. Body: any subset of the known keys; strict validation refuses unknown keys and off-vocabulary values. rank: any authenticated builder (own resource; archon may change any — the override is audited via the event's actor).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchProvisioningInstancesIdSettingsRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PatchProvisioningInstancesIdSettingsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/provisioning/instances/{id}/teardown": {
       "post": {
         "operationId": "post_provisioning_instances_id_teardown",
@@ -13402,7 +13515,8 @@
           "ready": {},
           "terminal": {},
           "domain": {},
-          "instance_status": {}
+          "instance_status": {},
+          "app_slug": {}
         },
         "required": [
           "ok",
@@ -13410,7 +13524,8 @@
           "ready",
           "terminal",
           "domain",
-          "instance_status"
+          "instance_status",
+          "app_slug"
         ]
       },
       "GetProvisioningHealthResponse": {
@@ -13439,6 +13554,21 @@
           "open_intent"
         ]
       },
+      "GetProvisioningInstancesIdSettingsResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "settings": {},
+          "options": {}
+        },
+        "required": [
+          "ok",
+          "settings",
+          "options"
+        ]
+      },
       "GetProvisioningInstancesResponse": {
         "type": "object",
         "properties": {
@@ -14251,6 +14381,31 @@
           "project"
         ]
       },
+      "PatchProvisioningInstancesIdSettingsRequest": {
+        "type": "object",
+        "properties": {
+          "platform_visibility": {
+            "type": "string"
+          },
+          "joinability": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PatchProvisioningInstancesIdSettingsResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "settings": {}
+        },
+        "required": [
+          "ok",
+          "settings"
+        ]
+      },
       "PatchTasksIdRequest": {
         "type": "object",
         "properties": {
@@ -17432,9 +17587,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 276,
-  "x-schema-count": 311,
+  "x-endpoint-count": 278,
+  "x-schema-count": 314,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 210,
+  "x-response-schemas": 212,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }