@bongos/core 1.19.261 → 1.19.262

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.261",
-  "core_contract": "1.19.261",
-  "source_commit": "089106b0f948c6e344f142a4a4f117b4a4f24590",
+  "core_version": "1.19.262",
+  "core_contract": "1.19.262",
+  "source_commit": "5c66bd4246a027582b292909499f6d31009157c6",
   "source_ref": "HEAD",
-  "built_at": "2026-08-19T19:56:21.487Z",
+  "built_at": "2026-08-19T20:21:59.469Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 318,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1361,
+    "functional_verbatim": 1362,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1701,
-  "tree_sha256": "63c8c6aa4f2f56b3ebd9849547e4403cbf3a56e0c3484f50738f4b679f30baf6",
+  "file_count": 1702,
+  "tree_sha256": "6c446d9f84793d24dace5316025f4a09517fd85c5260884cb2885e445dcfb2d1",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "config/branding.neutral.json",
       "mode": "0000644",
-      "sha256": "c3d785e319252965f8b5f338908d1dd66bd56985dafacb5d2ab8e5095d2515b3"
+      "sha256": "d1d2622e002edaed8a98deb8b69ff5a77c6eeab7993e3b0e7f1513f32ff027c6"
     },
     {
       "path": "config/design-tokens.neutral.json",
@@ -4152,7 +4152,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "051074db6bf131f61a39c236728c65bd74177d9410029b24f5118c9028d64aa5"
+      "sha256": "862fa78c7272a28cdc644debfd8ec364b80b635e8b9a6f41afb76b93312f27dd"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -4462,12 +4462,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "296a8f9184663f878f29d9b64dde95ed99bcfd3622f7c7a00592576563922a59"
+      "sha256": "687fe7e65dc80ea4688cbb7e530324b70b97e512f3b786d0264c810e47629388"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bca956b01dbda32a00d431aee683a77ef8fa70200e3aa244c949da4219b0d692"
+      "sha256": "bdb5fabfd35c8e1402b7a68bfd9033ab7bb8072e83f3cd181a835aed180eab8a"
     },
     {
       "path": "public-docs/index.html",
@@ -5402,7 +5402,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "7fe0dfd805c6974a3782d388809e767578eeab1a8aa0acf728e495341b9a2503"
+      "sha256": "1b1e4ca721a9052206265736712ea17e96b2b724c2926faba49839def36a1818"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -6092,7 +6092,7 @@
     {
       "path": "src/branding.js",
       "mode": "0000644",
-      "sha256": "a374d2625e09050948c7f619af1937e9c0b315fe7c25691d6b1667147386a04e"
+      "sha256": "04c7bd3146abc16cb51d81fa6550520cdd169cd527fbe2de13dffd2c6fcc8ef5"
     },
     {
       "path": "src/build-info.js",
@@ -6112,7 +6112,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2e7369e55f232a28a03122d9284ef889af7217b2335800da54881f3ff64c88b3"
+      "sha256": "1c68d692ed6e52924b04af09f9d816514b8b1ccd795984960f1c9cddefb6eba5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7889,6 +7889,11 @@
       "mode": "0000644",
       "sha256": "a525fdcfa2fde8edd2be3198ca7213b9b6bc43a12f748a718a570b7f993972b6"
     },
+    {
+      "path": "tests/provisioning_settings_env.mjs",
+      "mode": "0000644",
+      "sha256": "ee73d6af28f68bc6c197aae847663e9db2afb45e5073e2886a28c2a15925ad53"
+    },
     {
       "path": "tests/provisioning_slug_available.mjs",
       "mode": "0000644",

package/config/branding.neutral.json

@@ -3,7 +3,10 @@
   "identity": {
     "productName": "Cloud Bongos",
     "worldName": "Cloud Bongos",
-    "company": { "name": "", "site": "" }
+    "company": {
+      "name": "",
+      "site": ""
+    }
   },
   "llmProjectName": "this project",
   "domains": {
@@ -23,33 +26,70 @@
     "_note": "Cross-site identity (ADR 0141). idp=false → this instance owns its auth outright (its own GitHub app; the default + the self-hosted path). A HOSTED instance sets idp=true and gets its hub origin + client credentials from env (<PREFIX>_HUB_ORIGIN / _HUB_CLIENT_ID / _HUB_CLIENT_SECRET, written by provisioning) so web + CLI sign-in federate through the Cloud Bongos hub with no GitHub app of its own. Identity is federated; authority stays local.",
     "idp": false
   },
-  "repo": { "owner": "", "name": "" },
-  "db": { "database": null },
+  "project": {
+    "_note": "Per-project policy the PLATFORM decides and this instance OBEYS (task 1003139, goal 1000058). Stored on the platform's provisioning_instances.settings; written here as <PREFIX>_PLATFORM_VISIBILITY / <PREFIX>_JOINABILITY by the provisioning runner, which re-writes web.env and restarts the service when the owner changes one. The defaults are TODAY's behavior, so an instance that never receives a push — a self-hosted one, or one provisioned before this channel — keeps behaving exactly as it does now. platformVisibility: public | gated. joinability: open | apply | invite_only.",
+    "platformVisibility": "public",
+    "joinability": "apply"
+  },
+  "repo": {
+    "owner": "",
+    "name": ""
+  },
+  "db": {
+    "database": null
+  },
   "configDir": "cloudbongos",
   "firstAdmin": "",
-  "currency": { "label": "credits", "symbol": "" },
-  "reward": { "marginPct": 20, "usdPeg": 1, "mode": "cost-plus-and-estimate" },
-  "models": { "main": "opus", "subagentDefault": "opus", "subagentRoutine": "haiku" },
+  "currency": {
+    "label": "credits",
+    "symbol": ""
+  },
+  "reward": {
+    "marginPct": 20,
+    "usdPeg": 1,
+    "mode": "cost-plus-and-estimate"
+  },
+  "models": {
+    "main": "opus",
+    "subagentDefault": "opus",
+    "subagentRoutine": "haiku"
+  },
   "theme": {
     "palette": "",
     "mode": "cloud-bongos",
     "ui": {
       "colors": {
-        "bg": "#f9d9a8", "bgCard": "#fffaf2", "bgDeep": "#f6d8ae", "bgFrame": "#f0c489",
-        "ink": "#2b170e", "inkSoft": "#6d4a33", "inkFaint": "#785a41",
-        "rule": "#e8a463", "ruleSoft": "#f6d8ae",
-        "accent": "#ce4806", "accentDeep": "#9e3406", "sea": "#0f7a96", "terracotta": "#855b3d"
+        "bg": "#f9d9a8",
+        "bgCard": "#fffaf2",
+        "bgDeep": "#f6d8ae",
+        "bgFrame": "#f0c489",
+        "ink": "#2b170e",
+        "inkSoft": "#6d4a33",
+        "inkFaint": "#785a41",
+        "rule": "#e8a463",
+        "ruleSoft": "#f6d8ae",
+        "accent": "#ce4806",
+        "accentDeep": "#9e3406",
+        "sea": "#0f7a96",
+        "terracotta": "#855b3d"
       },
       "fonts": {
         "display": "\"Baloo 2\", \"Quicksand\", system-ui, sans-serif",
         "body": "\"Quicksand\", system-ui, -apple-system, \"Segoe UI\", sans-serif",
-        "links": ["https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&family=Fira+Code:wght@400;500&display=swap"]
+        "links": [
+          "https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&family=Fira+Code:wght@400;500&display=swap"
+        ]
       },
       "favicon": "data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><circle cx='12' cy='17' r='8' fill='%23ce4806'/><circle cx='22' cy='17' r='6' fill='%23855b3d'/><circle cx='12' cy='17' r='3.5' fill='%23fffaf2'/><circle cx='22' cy='17' r='2.5' fill='%23fffaf2'/></svg>",
       "backdrop": "#f9d9a8"
     }
   },
-  "rankLabels": { "xenos": "Newcomer", "thetes": "Contributor", "metic": "Trusted", "archon": "Owner" },
+  "rankLabels": {
+    "xenos": "Newcomer",
+    "thetes": "Contributor",
+    "metic": "Trusted",
+    "archon": "Owner"
+  },
   "copy": {
     "tagline": "Building Digitally, as simple as Bongos.",
     "hallName": "Builders' Hall",

package/modules/provisioning/provisioning.js

@@ -235,6 +235,28 @@ function publicInstance(row) {
 // The instance's EFFECTIVE settings: the defaults overlaid with the stored,
 // on-vocabulary keys. An off-vocabulary or unknown stored value falls back to
 // its default rather than leaking into the read surface. PURE.
+// The web.env lines that carry this instance's settings, as the runner writes them
+// at standup (task 1003139). PURE (row + prefix in, string out) and owned HERE, next
+// to SETTINGS_VOCAB, rather than in provision.js — the vocabulary and the thing that
+// transmits it must not be able to drift. Values come from effectiveSettings, so a
+// row with no stored settings emits today's behavior EXPLICITLY rather than nothing:
+// an instance must never have to infer a policy from an absent variable.
+//
+// This is the standup leg only. Changing a setting on an ALREADY-RUNNING instance
+// needs a push (re-write web.env + restart, since the branding pack is memoized for
+// the process lifetime) — that is the 'settings-apply' intent, still to be built.
+function settingsEnvLines(row, prefix) {
+  const s = effectiveSettings(row);
+  return `# Per-project policy the platform decides and this instance obeys (task
+# 1003139). Written at standup from the platform's provisioning_instances.settings;
+# src/branding.js ENV_OVERRIDES maps these onto project.*. Changing one on a RUNNING
+# instance still needs a push (re-write + restart) — not built yet, so today a change
+# takes effect on the next provision run.
+${prefix}_PLATFORM_VISIBILITY=${s.platform_visibility}
+${prefix}_JOINABILITY=${s.joinability}
+`;
+}
+
 function effectiveSettings(row) {
   const stored = row && row.settings && typeof row.settings === 'object' && !Array.isArray(row.settings)
     ? row.settings : {};
@@ -783,6 +805,7 @@ async function costLedger(db, { limit = 500 } = {}) {
 module.exports = {
   // constants
   INSTANCE_STATES, HOSTING_SHAPES, ONBOARD_MODES, PROJECT_TYPES, INTENT_ACTIONS, TEARDOWN_FROM,
+  settingsEnvLines,
   PROVISION_ENQUEUE_FROM, DOMAIN_ATTACH_FROM, TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
   SETTINGS_VOCAB, DEFAULT_SETTINGS,
   // pure

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.261",
+  "version": "1.19.262",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.261",
+      "version": "1.19.262",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.261",
+  "version": "1.19.262",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision.js

@@ -1157,7 +1157,7 @@ function provisionedEnvPrefix() {
 // stays at neutral localhost and the hall never loads (task 1972). No domain yet
 // (bring-your-own deferred, ADR 0111 §4) ⇒ origins stay neutral until one is set.
 function webEnvBody(inst, { clientId = '', clientSecret = '', appId = null, appPem = null, federation = null } = {}) {
-  const prefix = provisionedEnvPrefix();
+  const prefix = provisionedEnvPrefix(), { settingsEnvLines } = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
   const origin = inst.domain ? `https://${inst.domain}` : '';
   const originLines = origin
     ? `# Single-host origins (task 1972): the hall serves on THIS host + OAuth/redirects
@@ -1234,7 +1234,7 @@ ${prefix}_GITHUB_CLIENT_SECRET=${clientSecret || ''}
 ${firstAdminLine}GDS_BRANDING_FILE=${PROVISIONED_BRANDING_FILE}
 ${originLines}${appLines}PORT=${inst.port}
 PGDATABASE=${dbName(inst)}
-${fedLines}`;
+${fedLines}${settingsEnvLines(inst, prefix)}`;
 }
 function webEnvPath(inst, { etcBase = CONFIG.etcBase } = {}) {
   return path.posix.join(etcBase, inst.slug, 'web.env');

package/src/branding.js

@@ -54,6 +54,12 @@ const ENV_OVERRIDES = [
   // front door with one env var and no instance branding.json — cloudbongos.com
   // sets <PREFIX>_POST_LOGIN_LANDING=/gate/ (the orbs). Task 1002240.
   ['POST_LOGIN_LANDING', ['landing', 'postLogin']],
+  // Per-project policy pushed by the provisioning runner (task 1003139). The pack
+  // ships today's behavior, so an instance that never receives a push is unchanged.
+  // Read through branding, which is memoized + deep-frozen for the process lifetime
+  // — which is exactly why applying a change RESTARTS the instance.
+  ['PLATFORM_VISIBILITY', ['project', 'platformVisibility']],
+  ['JOINABILITY', ['project', 'joinability']],
 ];
 
 const isObj = (v) => v && typeof v === 'object' && !Array.isArray(v);

package/src/module-api.js

@@ -949,8 +949,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.259 with no explicit bump. run 32289043893. (task 1002620)
 //   1.19.261 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.260 with no explicit bump. run 32295699354. (task 1002620)
+//   1.19.262 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.261 with no explicit bump. run 32298063660. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.261'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.262'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provisioning_settings_env.mjs

@@ -0,0 +1,121 @@
+// tests/provisioning_settings_env.mjs
+//
+// The standup leg of the platform->instance settings channel (task 1003139, goal
+// 1000058): a per-project setting the PLATFORM stores must reach the INSTANCE that
+// has to obey it.
+//
+// The gap this closes: PATCH /provisioning/instances/:id/settings wrote
+// platform_visibility / joinability to the platform's jsonb and pushed nothing, and a
+// standalone instance never federates — it holds no hub credential and has no
+// authenticated path back to the platform to pull one. The settings were write-only
+// state. The transport that DOES exist is /etc/<slug>/web.env, read through the
+// branding pack, so the runner now writes them there at standup and src/branding.js
+// resolves them onto project.*.
+//
+// NOT covered here because it is NOT built: pushing a CHANGED setting to an
+// already-running instance (the branding pack is memoized + deep-frozen for the
+// process lifetime, so that needs a re-write + restart — the deferred
+// 'settings-apply' intent). These tests assert the standup leg only, and one of them
+// pins that the generated file does not CLAIM the push exists.
+//
+// DB-free and hermetic: pure builders + a child process with env set. No network.
+//
+// Run:  node tests/provisioning_settings_env.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const linesOf = (s) => s.split('\n').filter((l) => l && !l.startsWith('#'));
+const varsOf = (s) => Object.fromEntries(linesOf(s).map((l) => l.split('=')));
+
+console.log('settingsEnvLines — the platform\'s stored settings, as the instance reads them:');
+
+t('a stored setting is carried verbatim under the pack\'s env prefix', () => {
+  const v = varsOf(provisioning.settingsEnvLines(
+    { settings: { platform_visibility: 'gated', joinability: 'invite_only' } }, 'CLOUDBONGOS'));
+  assert.equal(v.CLOUDBONGOS_PLATFORM_VISIBILITY, 'gated');
+  assert.equal(v.CLOUDBONGOS_JOINABILITY, 'invite_only');
+});
+
+t('a row with NO stored settings emits today\'s behavior EXPLICITLY, never nothing', () => {
+  const v = varsOf(provisioning.settingsEnvLines({}, 'CLOUDBONGOS'));
+  // an instance must never have to infer a policy from an absent variable
+  assert.equal(v.CLOUDBONGOS_PLATFORM_VISIBILITY, 'public');
+  assert.equal(v.CLOUDBONGOS_JOINABILITY, 'apply');
+  assert.equal(linesOf(provisioning.settingsEnvLines({}, 'X')).length, 2, 'both keys always present');
+});
+
+t('an off-vocabulary stored value falls back to the default, never reaches the instance', () => {
+  const v = varsOf(provisioning.settingsEnvLines(
+    { settings: { platform_visibility: 'sort-of-public', joinability: 'whenever' } }, 'CLOUDBONGOS'));
+  assert.equal(v.CLOUDBONGOS_PLATFORM_VISIBILITY, 'public');
+  assert.equal(v.CLOUDBONGOS_JOINABILITY, 'apply');
+});
+
+t('the prefix is the pack\'s, not a guess — a wrong prefix silently never fires', () => {
+  const v = varsOf(provisioning.settingsEnvLines({}, 'MERCURY'));
+  assert.ok('MERCURY_PLATFORM_VISIBILITY' in v);
+  assert.ok(!('CLOUDBONGOS_PLATFORM_VISIBILITY' in v));
+});
+
+t('every emitted key is in SETTINGS_VOCAB — the two lists cannot drift', () => {
+  const keys = linesOf(provisioning.settingsEnvLines({}, 'X')).map((l) => l.split('=')[0].replace(/^X_/, '').toLowerCase());
+  assert.deepEqual(keys.sort(), Object.keys(provisioning.SETTINGS_VOCAB).sort(),
+    'a key added to the vocabulary must be carried, or the instance never learns it');
+});
+
+console.log('\nThe generated file tells the truth about what it is:');
+
+t('it does NOT claim a live push exists — that intent is not built', () => {
+  const s = provisioning.settingsEnvLines({}, 'X');
+  assert.doesNotMatch(s, /settings-apply/,
+    'no comment may name an intent action the runner cannot dispatch');
+  assert.match(s, /next provision run/i, 'it says when a change actually takes effect');
+});
+
+console.log('\nwebEnvBody — the settings ride the real per-instance env file:');
+
+t('the runner writes them into web.env alongside PORT and PGDATABASE', () => {
+  const provision = require('../scripts/gds/provision.js');
+  const body = provision.webEnvBody(
+    { slug: 'spike-harbor', port: 3010, db_name: 'spike-harbor', target_ref: 'jaxri/spike-harbor',
+      hosting_shape: 'standalone', settings: { platform_visibility: 'gated' } }, {});
+  assert.match(body, /_PLATFORM_VISIBILITY=gated/);
+  assert.match(body, /_JOINABILITY=apply/);
+  assert.match(body, /PORT=3010/, 'the rest of the file is untouched');
+});
+
+console.log('\nsrc/branding.js — the value actually reaches code:');
+
+t('the neutral pack ships today\'s behavior, so an un-pushed instance is unchanged', () => {
+  const pack = require('../config/branding.neutral.json');
+  assert.equal(pack.project.platformVisibility, 'public');
+  assert.equal(pack.project.joinability, 'apply');
+});
+
+t('the env override resolves onto project.* in a real process', () => {
+  const read = (env) => JSON.parse(execFileSync(process.execPath, ['-e',
+    "const b=require('./src/branding.js');const r=(b.branding||b)();console.log(JSON.stringify({v:r.project.platformVisibility,j:r.project.joinability}))"],
+    { cwd: ROOT, encoding: 'utf8', env: { ...process.env, ...env } }));
+  assert.deepEqual(read({}), { v: 'public', j: 'apply' }, 'no env → the pack default');
+  assert.deepEqual(
+    read({ CLOUDBONGOS_PLATFORM_VISIBILITY: 'gated', CLOUDBONGOS_JOINABILITY: 'invite_only' }),
+    { v: 'gated', j: 'invite_only' },
+    'the web.env the runner writes is what the instance reads');
+});
+
+console.log(`\nprovisioning_settings_env: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);