@bongos/core 1.19.206 → 1.19.208

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.206",
-  "core_contract": "1.19.206",
-  "source_commit": "6ef49e744b96d37db9a338979fb85bb56fb6aa6f",
+  "core_version": "1.19.208",
+  "core_contract": "1.19.208",
+  "source_commit": "6dabd2e84af8785ac779f8a6801b951d80ecad3b",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T20:15:14.217Z",
+  "built_at": "2026-08-17T20:55:34.065Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1296,
+    "functional_verbatim": 1299,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1627,
-  "tree_sha256": "f7017bc51e10af4dd65ab8df53ce22c7a0e611c7fb948ee6598ce8c4f7831a6a",
+  "file_count": 1630,
+  "tree_sha256": "63df68d9f034ba54b42011a4bfc310a811d2c53cb550a586bf40d5d35228a258",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -187,7 +187,7 @@
     {
       "path": ".claude/skills/new-project/SKILL.md",
       "mode": "0000644",
-      "sha256": "9b36d441850c335fa634d892088e4c15a2a87acaa9e52808b74a8b2e6e9af39f"
+      "sha256": "1d6f60e8fa3cbf06cc5f8901ccf21fd8cac8050f81b3296039b659d700eba242"
     },
     {
       "path": ".claude/skills/otb-character-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "4801db32c6f4ba6220bce8e664be063f8d8483bc22a57df08205b0fc36788b8b"
+      "sha256": "2755203dec4a1450c5950c39a767bc093d1d1227f952193001cdfa94205e995f"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "c3ff3f8c529ac99fe6f968bd3ec110bb6a03c5788caf4dbbab5f59147af28b4c"
+      "sha256": "7b4e5ecf6c6d12a3c9e603a0f5b4bd28ba8cd991399ed8941181b6aeae53772d"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "9de16e178984c7c9ac9c20de3de8ca074bb904423b20a8459a93ce838c1507ea"
+      "sha256": "a92355ef21073634500f6806f1e495c955a0b67e889cf07264ed8d1169b119be"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "38ef88079d260b67161e680ea77fa6ddecb3cc74a1452796cbe28c0e3601c052"
+      "sha256": "8fe97a3daefdceb9bf40a15a19dffb81fb6387c0acbe20041e58e63b24e80dd1"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "d5f8ca20a0826b3258c909d870da54ebd4c3e757c8c35a306c1fa7a72b8292c4"
+      "sha256": "adb2a36a9598c543adbf7c8011f36585f7c394bac7f4961718359ee7a29cb1dd"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1367,12 +1367,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "32c6c5fe14cf8684d353f0c73cde4b09d84ba61eabcb13e75c11bd5b7f9be2b7"
+      "sha256": "52554cf7c8e5355c59594c872f30975581eb6c1b9a5bcb63efa1a1a19f2d3877"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "c11ec9dcb0726382e15bb7fc9e74086037ed158256ef16b5efcc81fe2db2d078"
+      "sha256": "825af2c499836301a34cff79192e41556cc863fe9a5378d9e5134c862769c2fa"
     },
     {
       "path": "docs/architecture.md",
@@ -2682,7 +2682,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "9de16e178984c7c9ac9c20de3de8ca074bb904423b20a8459a93ce838c1507ea"
+      "sha256": "a92355ef21073634500f6806f1e495c955a0b67e889cf07264ed8d1169b119be"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3949,6 +3949,11 @@
       "mode": "0000644",
       "sha256": "8dc04a18ad77563a2bd73029bf13cab03fb5dadd1b62850fddbde475257e6a76"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_009_project_settings.sql",
+      "mode": "0000644",
+      "sha256": "de17cfb74f8684044abfb03e56698f91fa5aa813608f3a19d2ddf81d113e897e"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -3957,7 +3962,7 @@
     {
       "path": "modules/provisioning/onboard-plan.js",
       "mode": "0000644",
-      "sha256": "de7927d2a3c1aac0d40ec5b1ac6c2e98e87cb593c4d3d2bd6ddfe3696371bff6"
+      "sha256": "4aae27c3c56de480e9cc4f19405572a96c6bf0246fdd859adceae629c7a71842"
     },
     {
       "path": "modules/provisioning/pollers/liveness-sweep.js",
@@ -3967,7 +3972,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "e43977d0c5458de4fde91e6ccb784b112187545fdf03ceed2c352b605686a57e"
+      "sha256": "b9d4ee116eb4b213b084408868f727a4587876faa5fae78f4d2f64cb2fe12231"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -3977,7 +3982,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "f7cf016e10587302437f5d8ab7b01d8b1be6694e05b9e8c47a6ccb2cdfda8ac4"
+      "sha256": "78c89017e17dfba57ade2330fce293e6422aab316e9311f8215ff3eb9fdc3fe5"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -3987,7 +3992,7 @@
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
       "mode": "0000644",
-      "sha256": "4c7bb37582485445e947e233c9fbb9c20c9ab55da9dd159c8062fffa4472a5d7"
+      "sha256": "3db404b6ad50e01de0b1d73131cefc01ab8fe939eee18157ba6aa8f28a05fb7f"
     },
     {
       "path": "modules/provisioning/ui/.gitkeep",
@@ -4277,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8cece7080d6a67c93467f86ee1c02cff85f8b2dbd5e8219519e9bc9df034f895"
+      "sha256": "df481ba4f5057938d85fadf4e5551602cb50c68f78358dc110d03ebfb99ff278"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "05a1768a85ccd224b9caa4e388b83f5a1d933b8b46761ebe7ce6f5a06f3c6d6a"
+      "sha256": "5b6943de459044d4545437bd4941abadbdefcedc0063e291f72205e46956beb3"
     },
     {
       "path": "public-docs/index.html",
@@ -4542,7 +4547,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "494d1aa1a6ff006a8e8f239c29d90c052f735919937c9dc6fb6b8eeff4902e91"
+      "sha256": "20dd4fcb471c8d5a4dced2788ca6fffecaba241207bc0087d918d15b60bcc1a1"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5442,7 +5447,7 @@
     {
       "path": "scripts/gds/setup.js",
       "mode": "0000644",
-      "sha256": "8e512a07ed885666722a216951dfad7f57fbfd92923bdf5079ce1c6f7b5c0abc"
+      "sha256": "98671f5666ae6bdafa7691bd519367345772c3041680b59c24ec83c56b99f419"
     },
     {
       "path": "scripts/gds/shell.js",
@@ -5892,7 +5897,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "84441072e12b08bf8c5dde09972dc91dd530b586f30f287016d830589476fb5d"
+      "sha256": "d20ec520ccfe8d1ac72910455f97f728feaf179b265f79ebf6f9a2ca21f1e424"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7377,7 +7382,7 @@
     {
       "path": "tests/onboard.mjs",
       "mode": "0000644",
-      "sha256": "c6823a6f0f81bcb4f01ccbd2364d6dcf76eb21e3ff10972738f792438939dee0"
+      "sha256": "71eeb42b47ad2ba11b8379cce263ceac2da42b00b9fe55aab64546027b193364"
     },
     {
       "path": "tests/onboarding_gate.mjs",
@@ -7539,6 +7544,11 @@
       "mode": "0000644",
       "sha256": "7749df454ac3cca7c7e5ea1acc94ead15d1c9f87b38fe2028a1c93c8adf31bcf"
     },
+    {
+      "path": "tests/provisioning_settings.mjs",
+      "mode": "0000644",
+      "sha256": "bb800d2e15045efbac4fadbc62996054d33e163eb86e6a5e09087d409cc7fbfa"
+    },
     {
       "path": "tests/provisioning_slug_available.mjs",
       "mode": "0000644",
@@ -7819,6 +7829,11 @@
       "mode": "0000644",
       "sha256": "a630ac72981f230e8aa6609152765c13e8928ac329cb0ff3fe615371f31208d2"
     },
+    {
+      "path": "tests/setup_device_flow_fallback.mjs",
+      "mode": "0000644",
+      "sha256": "9a9df92b732b4f13d222329877ab17f8f972ef01370c9a918b00635716c76b5e"
+    },
     {
       "path": "tests/setup_smoke.mjs",
       "mode": "0000644",

package/.claude/skills/new-project/SKILL.md

@@ -9,7 +9,7 @@ You are guiding a new owner from **zero to a live, owned Cloud Bongos instance**
 
 A new instance is **standalone** (ADR 0108): it runs from its **own git repo** with `@cloudbongos/core` installed as a **pinned npm dependency**, not a fork of this monorepo. Central updates are a `bongos upgrade` version-pin bump, not a merge. Every step below assumes this shape (`hosting_shape=standalone`).
 
-Five steps are **irreducibly human** and must be rendered as **precise, UI-first, copy-paste-safe prompts** (a non-technical owner does them with browser clicks, no terminal guessing): (1) create the GitHub repo, (2) approve the pre-filled **GitHub App** for sign-in (ONE click — the App Manifest flow, task 2080; no secret to paste), (3) install that App on the repo (ONE click — the publish credential, task 1003049), (4) own a domain, (5) the first sign-in. Everything else is automated. Never ask the owner to do in a terminal what they can do with a click.
+Six steps are **irreducibly human** and must be rendered as **precise, UI-first, copy-paste-safe prompts** (a non-technical owner does them with browser clicks, no terminal guessing): (1) create the GitHub repo, (2) approve the pre-filled **GitHub App** for sign-in (ONE click — the App Manifest flow, task 2080; no secret to paste), (3) tick **Enable Device Flow** in that App's settings (ONE checkbox — terminal sign-in, task 1003051; until then `bongos setup` falls back to a web token), (4) install that App on the repo (ONE click — the publish credential, task 1003049), (5) own a domain, (6) the first sign-in. Everything else is automated. Never ask the owner to do in a terminal what they can do with a click.
 
 ## The canonical sequence
 

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 276 operations across 46 resource groups
+- 278 operations across 46 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -543,6 +543,10 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app
       postProvisioningInstancesIdGithubApp: (args) => request("POST", "/provisioning/instances/{id}/github-app", { hasBody: true }, args),
+      // GET /provisioning/instances/{id}/settings — rank: any-builder — GET /provisioning/instances/:id/settings
+      getProvisioningInstancesIdSettings: (args) => request("GET", "/provisioning/instances/{id}/settings", { hasBody: false }, args),
+      // PATCH /provisioning/instances/{id}/settings — rank: any-builder — PATCH /provisioning/instances/:id/settings
+      patchProvisioningInstancesIdSettings: (args) => request("PATCH", "/provisioning/instances/{id}/settings", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/teardown — rank: any-builder — POST /provisioning/instances/:id/teardown
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan

package/clients/bongos-client/index.cjs

@@ -542,6 +542,10 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app
       postProvisioningInstancesIdGithubApp: (args) => request("POST", "/provisioning/instances/{id}/github-app", { hasBody: true }, args),
+      // GET /provisioning/instances/{id}/settings — rank: any-builder — GET /provisioning/instances/:id/settings
+      getProvisioningInstancesIdSettings: (args) => request("GET", "/provisioning/instances/{id}/settings", { hasBody: false }, args),
+      // PATCH /provisioning/instances/{id}/settings — rank: any-builder — PATCH /provisioning/instances/:id/settings
+      patchProvisioningInstancesIdSettings: (args) => request("PATCH", "/provisioning/instances/{id}/settings", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/teardown — rank: any-builder — POST /provisioning/instances/:id/teardown
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan

package/clients/bongos-client/index.d.ts

@@ -75,6 +75,7 @@ export interface GetProvisioningFleetResponse { instances: unknown }
 export interface GetProvisioningGithubAppStatusResponse { ok: boolean; status: unknown; ready: unknown; terminal: unknown; domain: unknown; instance_status: unknown; app_slug: unknown }
 export interface GetProvisioningHealthResponse { module: unknown; ok: boolean; coreVersion: unknown }
 export interface GetProvisioningInstancesIdResponse { instance: unknown; open_intent: unknown }
+export interface GetProvisioningInstancesIdSettingsResponse { ok: boolean; settings: unknown; options: unknown }
 export interface GetProvisioningInstancesResponse { instances: unknown }
 export interface GetProvisioningOnboardPlanResponse { mode: unknown; steps: unknown }
 export interface GetProvisioningSlugAvailableResponse { slug: unknown; available: unknown; reason: unknown; address: unknown }
@@ -140,6 +141,8 @@ export interface PatchMeSkillPrefsResponse { prefs: unknown; effective: unknown;
 export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown; effective_map: unknown; volume: unknown; defaults: unknown; known_sounds: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
+export interface PatchProvisioningInstancesIdSettingsRequest { platform_visibility?: string; joinability?: string }
+export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; settings: unknown }
 export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; description?: string; status?: unknown }
 export interface PostAccessRequestsRequest { github_login: string; display_name?: string; note?: string }
 export interface PostAccessRequestsResponse { ok: boolean; request?: unknown; already_pending?: boolean }
@@ -787,6 +790,10 @@ export interface BongosClient {
     postProvisioningInstancesIdForceTeardown(args?: RequestArgs): Promise<PostProvisioningInstancesIdForceTeardownResponse>;
     /** POST /provisioning/instances/{id}/github-app — rank: any-builder */
     postProvisioningInstancesIdGithubApp(args?: RequestArgs & { body?: PostProvisioningInstancesIdGithubAppRequest }): Promise<PostProvisioningInstancesIdGithubAppResponse>;
+    /** GET /provisioning/instances/{id}/settings — rank: any-builder */
+    getProvisioningInstancesIdSettings(args?: RequestArgs): Promise<GetProvisioningInstancesIdSettingsResponse>;
+    /** PATCH /provisioning/instances/{id}/settings — rank: any-builder */
+    patchProvisioningInstancesIdSettings(args?: RequestArgs & { body?: PatchProvisioningInstancesIdSettingsRequest }): Promise<PatchProvisioningInstancesIdSettingsResponse>;
     /** POST /provisioning/instances/{id}/teardown — rank: any-builder */
     postProvisioningInstancesIdTeardown(args?: RequestArgs): Promise<PostProvisioningInstancesIdTeardownResponse>;
     /** GET /provisioning/onboard-plan — rank: public */

package/clients/bongos-client/index.mjs

@@ -539,6 +539,10 @@ export function createClient(opts = {}) {
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app
       postProvisioningInstancesIdGithubApp: (args) => request("POST", "/provisioning/instances/{id}/github-app", { hasBody: true }, args),
+      // GET /provisioning/instances/{id}/settings — rank: any-builder — GET /provisioning/instances/:id/settings
+      getProvisioningInstancesIdSettings: (args) => request("GET", "/provisioning/instances/{id}/settings", { hasBody: false }, args),
+      // PATCH /provisioning/instances/{id}/settings — rank: any-builder — PATCH /provisioning/instances/:id/settings
+      patchProvisioningInstancesIdSettings: (args) => request("PATCH", "/provisioning/instances/{id}/settings", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/teardown — rank: any-builder — POST /provisioning/instances/:id/teardown
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan

package/docs/api/openapi.json

@@ -8951,6 +8951,119 @@
         ]
       }
     },
+    "/provisioning/instances/{id}/settings": {
+      "get": {
+        "operationId": "get_provisioning_instances_id_settings",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/instances/:id/settings",
+        "description": "GET /provisioning/instances/:id/settings — read a project's effective settings + the allowed values (so a form can render its choices). rank: any authenticated builder (own resource; archon may read any).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProvisioningInstancesIdSettingsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "patch": {
+        "operationId": "patch_provisioning_instances_id_settings",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "PATCH /provisioning/instances/:id/settings",
+        "description": "PATCH /provisioning/instances/:id/settings — change a project's settings. Body: any subset of the known keys; strict validation refuses unknown keys and off-vocabulary values. rank: any authenticated builder (own resource; archon may change any — the override is audited via the event's actor).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchProvisioningInstancesIdSettingsRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PatchProvisioningInstancesIdSettingsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/provisioning/instances/{id}/teardown": {
       "post": {
         "operationId": "post_provisioning_instances_id_teardown",
@@ -13441,6 +13554,21 @@
           "open_intent"
         ]
       },
+      "GetProvisioningInstancesIdSettingsResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "settings": {},
+          "options": {}
+        },
+        "required": [
+          "ok",
+          "settings",
+          "options"
+        ]
+      },
       "GetProvisioningInstancesResponse": {
         "type": "object",
         "properties": {
@@ -14253,6 +14381,31 @@
           "project"
         ]
       },
+      "PatchProvisioningInstancesIdSettingsRequest": {
+        "type": "object",
+        "properties": {
+          "platform_visibility": {
+            "type": "string"
+          },
+          "joinability": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PatchProvisioningInstancesIdSettingsResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "settings": {}
+        },
+        "required": [
+          "ok",
+          "settings"
+        ]
+      },
       "PatchTasksIdRequest": {
         "type": "object",
         "properties": {
@@ -17434,9 +17587,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 276,
-  "x-schema-count": 311,
+  "x-endpoint-count": 278,
+  "x-schema-count": 314,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 210,
+  "x-response-schemas": 212,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 276 endpoints across 46 route files.
+> **Generated from the live route files** — the route file is authoritative. 278 endpoints across 46 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -369,7 +369,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/projects/featured` | `public` | — | a curated public showcase; no auth by design. |
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | invite a builder into a project (ADR 0141 §5, task #1002115). |
 
-## `provisioning` (15)
+## `provisioning` (17)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -384,6 +384,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/provisioning/instances/:id/domain` | `any-builder` | `domain` | POST /provisioning/instances/:id/domain — give the caller's OWN instance its address (task 1002692, gap 5: no path existed to add a domai… |
 | POST | `/api/bongos/provisioning/instances/:id/force-teardown` | `metic+archon` | — | POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. |
 | POST | `/api/bongos/provisioning/instances/:id/github-app` | `any-builder` | `account` | POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 01… |
+| GET | `/api/bongos/provisioning/instances/:id/settings` | `any-builder` | — | GET /provisioning/instances/:id/settings — read a project's effective settings + the allowed values (so a form can render its choices). |
+| PATCH | `/api/bongos/provisioning/instances/:id/settings` | `any-builder` | `platform_visibility`, `joinability` | PATCH /provisioning/instances/:id/settings — change a project's settings. |
 | POST | `/api/bongos/provisioning/instances/:id/teardown` | `any-builder` | — | POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. |
 | GET | `/api/bongos/provisioning/onboard-plan` | `public` | — | GET /provisioning/onboard-plan?mode=greenfield\|adopt&domain=<host> — the CANONICAL onboarding step sequence (task 2085; goal 35 / criteri… |
 | GET | `/api/bongos/provisioning/slug-available` | `any-builder` | — | GET /provisioning/slug-available?slug=<handle> — is this handle free to create under? rank: any authenticated builder (same gate as the c… |

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -542,6 +542,10 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdForceTeardown: (args) => request("POST", "/provisioning/instances/{id}/force-teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/github-app — rank: any-builder — POST /provisioning/instances/:id/github-app
       postProvisioningInstancesIdGithubApp: (args) => request("POST", "/provisioning/instances/{id}/github-app", { hasBody: true }, args),
+      // GET /provisioning/instances/{id}/settings — rank: any-builder — GET /provisioning/instances/:id/settings
+      getProvisioningInstancesIdSettings: (args) => request("GET", "/provisioning/instances/{id}/settings", { hasBody: false }, args),
+      // PATCH /provisioning/instances/{id}/settings — rank: any-builder — PATCH /provisioning/instances/:id/settings
+      patchProvisioningInstancesIdSettings: (args) => request("PATCH", "/provisioning/instances/{id}/settings", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/teardown — rank: any-builder — POST /provisioning/instances/:id/teardown
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan

package/modules/provisioning/migrations/provisioning_009_project_settings.sql

@@ -0,0 +1,19 @@
+-- provisioning_009_project_settings.sql — per-project settings storage (task
+-- 1003040, goal 1000058: the project-management page wave's foundation).
+--
+-- WHY jsonb, not columns: the manage-page wave adds settings one task at a time
+-- (platform visibility, joinability, repo visibility, …) and a new key must not
+-- cost a migration each time. The column is a dumb store; the known keys + their
+-- vocabularies are enforced at the API layer (provisioning.SETTINGS_VOCAB /
+-- the settings routes' validator), and unknown stored values fall back to the
+-- default at read time (effectiveSettings) rather than leaking out.
+--
+-- DEFAULTS = today's behavior: '{}'::jsonb READS as
+-- { platform_visibility: 'public', joinability: 'apply' } — the default lives in
+-- code, applied at read time, so ADD COLUMN backfills every existing row with an
+-- empty object and no instance changes behavior.
+ALTER TABLE provisioning_instances
+  ADD COLUMN IF NOT EXISTS settings jsonb NOT NULL DEFAULT '{}'::jsonb;
+
+INSERT INTO schema_migrations (version) VALUES ('provisioning_009_project_settings')
+ON CONFLICT (version) DO NOTHING;

package/modules/provisioning/onboard-plan.js

@@ -44,6 +44,7 @@ function onboardPlan(mode = 'greenfield', opts = {}) {
     { key: 'seed-version', kind: 'auto', label: 'Seed the first version (V1) so the instance can take tasks immediately (task 2119)' },
     { key: 'oauth-app', kind: 'human', label: 'Wire GitHub sign-in — one-click GitHub App (task 2080), or a manual OAuth app' },
     { key: 'oauth-place', kind: 'auto', shapes: CONTROL_PLANE_SHAPES, label: 'Place the OAuth secret — auto via the Manifest flow, or verified manual (task 1979)' },
+    { key: 'device-flow', kind: 'human', label: 'Enable Device Flow in the GitHub App settings — one checkbox, so terminal sign-in (bongos login) works (task 1003051)' },
     { key: 'app-install', kind: 'human', label: 'Install the GitHub App on the repo — the publish credential that lets shipped work land itself (task 1003049, ADR 0055)' },
     { key: 'first-sign-in', kind: 'human', label: 'First sign-in (seats the founding Archon)' },
     { key: 'verify', kind: 'auto', label: 'Verify /healthz auth_configured' },

package/modules/provisioning/provisioning.js

@@ -59,6 +59,17 @@ const PROVISION_ENQUEUE_FROM = new Set(['requested', 'provisioning', 'error', 't
 // itself. Mid-flight or torn-down states refuse truthfully.
 const DOMAIN_ATTACH_FROM = new Set(['requested', 'error', 'active']);
 
+// Per-project settings (task 1003040, goal 1000058): the known keys + their
+// vocabularies, enforced at the API layer — the jsonb `settings` column
+// (migration provisioning_009) is a dumb store with room for future keys.
+// DEFAULT_SETTINGS is TODAY's behavior (public surfaces, apply-to-join),
+// applied at read time so pre-existing rows need no data backfill.
+const SETTINGS_VOCAB = Object.freeze({
+  platform_visibility: ['public', 'gated'],
+  joinability: ['open', 'apply', 'invite_only'],
+});
+const DEFAULT_SETTINGS = Object.freeze({ platform_visibility: 'public', joinability: 'apply' });
+
 // Monthly cost estimate (USD) for a dedicated droplet tier — VISIBILITY only
 // (ADR 0111 §6), never a bill. A small local table so this module needs no
 // sibling-module import; P2 (shared control-plane client extraction) is where a
@@ -210,6 +221,19 @@ function publicInstance(row) {
   };
 }
 
+// The instance's EFFECTIVE settings: the defaults overlaid with the stored,
+// on-vocabulary keys. An off-vocabulary or unknown stored value falls back to
+// its default rather than leaking into the read surface. PURE.
+function effectiveSettings(row) {
+  const stored = row && row.settings && typeof row.settings === 'object' && !Array.isArray(row.settings)
+    ? row.settings : {};
+  const out = { ...DEFAULT_SETTINGS };
+  for (const [key, vocab] of Object.entries(SETTINGS_VOCAB)) {
+    if (vocab.includes(stored[key])) out[key] = stored[key];
+  }
+  return out;
+}
+
 // ---------------------------------------------------------------------------
 // GitHub App Manifest flow — PURE builders (task 2080, ADR 0133).
 // GitHub has no create-an-OAuth-App API, but the App *Manifest* flow lets the owner
@@ -345,6 +369,20 @@ async function getInstanceByDomain(db, domain) {
   return rows[0] || null;
 }
 
+// Merge a VALIDATED settings patch into the instance's settings column (task
+// 1003040). Narrow like updateInstanceDomain: settings + updated_at only — a
+// settings change is a deliberate owner action, so surfacing it in the
+// updated_at-ordered card list is correct (unlike the liveness overlay).
+async function updateInstanceSettings(db, id, patch) {
+  const { rows } = await db.query(
+    `UPDATE provisioning_instances
+        SET settings = settings || $2::jsonb, updated_at = now()
+      WHERE id = $1 RETURNING *`,
+    [id, JSON.stringify(patch)]
+  );
+  return rows[0] || null;
+}
+
 // Record an instance's domain — the ONLY column this touches (task 1002692). Status
 // changes stay setInstanceStatus's job; keeping this narrow means the domain-attach
 // route can never drift an instance's lifecycle as a side effect.
@@ -735,9 +773,10 @@ module.exports = {
   // constants
   INSTANCE_STATES, HOSTING_SHAPES, ONBOARD_MODES, PROJECT_TYPES, INTENT_ACTIONS, TEARDOWN_FROM,
   PROVISION_ENQUEUE_FROM, DOMAIN_ATTACH_FROM, TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
+  SETTINGS_VOCAB, DEFAULT_SETTINGS,
   // pure
   isValidSlug, costEstimateUsd, publicInstance, normalizeHostname,
-  defaultDomainForSlug, isReservedHostname,
+  defaultDomainForSlug, isReservedHostname, effectiveSettings,
   // pure — GitHub App Manifest flow (task 2080)
   githubAppName, buildGithubAppManifest, manifestPostUrl,
   // data access
@@ -745,7 +784,7 @@ module.exports = {
   getInstanceById, getInstanceBySlug, getInstanceByDomain, listInstancesForOwner, listAllInstances,
   // data access — verification overlay (task 1002696)
   listActiveInstancesForLiveness, recordLivenessProbe, recordDnsNote, clearErrorNote,
-  createInstance, setInstanceStatus, updateInstanceDomain,
+  createInstance, setInstanceStatus, updateInstanceDomain, updateInstanceSettings,
   enqueueIntent, enqueueTeardown, getOpenIntent, claimNextIntent, resolveIntent,
   recordEvent, instanceStateForSlug, costLedger,
   // data access — GitHub App Manifest attempts (task 2080)