@bongos/core 1.19.261 → 1.19.263

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.261",
-  "core_contract": "1.19.261",
-  "source_commit": "089106b0f948c6e344f142a4a4f117b4a4f24590",
+  "core_version": "1.19.263",
+  "core_contract": "1.19.263",
+  "source_commit": "37e76e1c5b93e63f78568bd133de202d80718835",
   "source_ref": "HEAD",
-  "built_at": "2026-08-19T19:56:21.487Z",
+  "built_at": "2026-08-19T21:43:04.995Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 318,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1361,
+    "functional_verbatim": 1364,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1701,
-  "tree_sha256": "63c8c6aa4f2f56b3ebd9849547e4403cbf3a56e0c3484f50738f4b679f30baf6",
+  "file_count": 1704,
+  "tree_sha256": "1f21bf09538e80b09eeae9562e41106fc7c241e0a80f7bc3db5027dfb9755874",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "config/branding.neutral.json",
       "mode": "0000644",
-      "sha256": "c3d785e319252965f8b5f338908d1dd66bd56985dafacb5d2ab8e5095d2515b3"
+      "sha256": "d1d2622e002edaed8a98deb8b69ff5a77c6eeab7993e3b0e7f1513f32ff027c6"
     },
     {
       "path": "config/design-tokens.neutral.json",
@@ -1427,12 +1427,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "8eb317c49266b41d6b64f73331b58eea0ec3b647eb5fb5bff202c2458ee555e9"
+      "sha256": "5766467665c33bcc5a3bdec568af6a02c75f5e88d82a3e8fe2459eccb19c15da"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "9d656a81eda850d1c7c5f7f358395c7319d4ac3c42afa995cd74e8dcc4bb7401"
+      "sha256": "ded30cde6d371dc2172ae778cf079edc00bbfee208002673a6e60e9b5a8ac95b"
     },
     {
       "path": "docs/design-contract.md",
@@ -3377,7 +3377,7 @@
     {
       "path": "modules/hall-ui/public/goals-page.js",
       "mode": "0000644",
-      "sha256": "7ba31240f79d6c0b1a1db236af1b80ccbcef03ef826e48f8e07c7e55863b713a"
+      "sha256": "9ab3110d4854ecde5899b8e83180d05d4fc8ac37803354e51963cda1eb79d4ed"
     },
     {
       "path": "modules/hall-ui/public/goals.css",
@@ -3387,7 +3387,7 @@
     {
       "path": "modules/hall-ui/public/goals.html",
       "mode": "0000644",
-      "sha256": "8bdafe49e7440b52370821755ea55f9a49f5ba9189d4ba367f634ca39365bf3c"
+      "sha256": "cbcdd371061ec71ba0ad6e9ac9ebff4c07bb66a2534decc8c8dfe0c3c436f2c2"
     },
     {
       "path": "modules/hall-ui/public/goals.js",
@@ -3614,6 +3614,11 @@
       "mode": "0000644",
       "sha256": "fc9224e79a1003434f7cb35925b3264b26bb4aea1d32c1b24723de4918530bef"
     },
+    {
+      "path": "modules/hall-ui/public/task-lib.js",
+      "mode": "0000644",
+      "sha256": "c2cc0c75f660312f543c84138bc5b82652b710682bc86ae8fd517d7ee1d9e661"
+    },
     {
       "path": "modules/hall-ui/public/task.html",
       "mode": "0000644",
@@ -3647,12 +3652,12 @@
     {
       "path": "modules/hall-ui/public/work.html",
       "mode": "0000644",
-      "sha256": "740cbb96b52876047e44d0f947b0af683b720ecd0bd68bf3c55f221c28cb9227"
+      "sha256": "fa35f0ed6611db65f92df0815149dbc98c60af634edef13f2b5e7b1b418822c0"
     },
     {
       "path": "modules/hall-ui/public/work.js",
       "mode": "0000644",
-      "sha256": "8ee189def6ded1c8669212d7233f57948ac58bf23ad8277422996ffd8914e537"
+      "sha256": "3c9fc42cfe2954fc285153c93c9e686870097535d4efa83af5bbdfc3f5527a98"
     },
     {
       "path": "modules/ideas/CLAUDE.md",
@@ -4152,7 +4157,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "051074db6bf131f61a39c236728c65bd74177d9410029b24f5118c9028d64aa5"
+      "sha256": "862fa78c7272a28cdc644debfd8ec364b80b635e8b9a6f41afb76b93312f27dd"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -4462,12 +4467,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "296a8f9184663f878f29d9b64dde95ed99bcfd3622f7c7a00592576563922a59"
+      "sha256": "58ecc72707cf6bf7bf66d7f8166ab6ba5aff26889dfa6d16c58d831106e0ee41"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bca956b01dbda32a00d431aee683a77ef8fa70200e3aa244c949da4219b0d692"
+      "sha256": "b7ba32ed44f54e570d1050b609b36194fd9ae545bad8174dec727f6a8281ea10"
     },
     {
       "path": "public-docs/index.html",
@@ -5402,7 +5407,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "7fe0dfd805c6974a3782d388809e767578eeab1a8aa0acf728e495341b9a2503"
+      "sha256": "1b1e4ca721a9052206265736712ea17e96b2b724c2926faba49839def36a1818"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -6092,7 +6097,7 @@
     {
       "path": "src/branding.js",
       "mode": "0000644",
-      "sha256": "a374d2625e09050948c7f619af1937e9c0b315fe7c25691d6b1667147386a04e"
+      "sha256": "04c7bd3146abc16cb51d81fa6550520cdd169cd527fbe2de13dffd2c6fcc8ef5"
     },
     {
       "path": "src/build-info.js",
@@ -6112,7 +6117,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2e7369e55f232a28a03122d9284ef889af7217b2335800da54881f3ff64c88b3"
+      "sha256": "ac17ec5369c8edf4cb20a63057aec474e85b3253c3e588c859d7d36a756091ab"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7032,7 +7037,7 @@
     {
       "path": "tests/goal_criterion_confirm_ui.mjs",
       "mode": "0000644",
-      "sha256": "0dc07b5ad4e162f47bdcf92d7de0baec8af03c7540814d5fd234a4d5a732bbf2"
+      "sha256": "a677104300f3dc266438f342ec9492304827377a55b10e1572491a2eb26eca80"
     },
     {
       "path": "tests/goal_dependencies_read.mjs",
@@ -7889,6 +7894,11 @@
       "mode": "0000644",
       "sha256": "a525fdcfa2fde8edd2be3198ca7213b9b6bc43a12f748a718a570b7f993972b6"
     },
+    {
+      "path": "tests/provisioning_settings_env.mjs",
+      "mode": "0000644",
+      "sha256": "ee73d6af28f68bc6c197aae847663e9db2afb45e5073e2886a28c2a15925ad53"
+    },
     {
       "path": "tests/provisioning_slug_available.mjs",
       "mode": "0000644",
@@ -8394,6 +8404,11 @@
       "mode": "0000644",
       "sha256": "d4f417d485cde211b7664c017f1909eb31bd86539cfc0128a08bf2b474023b80"
     },
+    {
+      "path": "tests/task_lib.mjs",
+      "mode": "0000644",
+      "sha256": "bc89502f571659477178d68047098cf6098030491ac5c5a82b46802474a48387"
+    },
     {
       "path": "tests/task_ownership_gate.mjs",
       "mode": "0000644",

package/config/branding.neutral.json

@@ -3,7 +3,10 @@
   "identity": {
     "productName": "Cloud Bongos",
     "worldName": "Cloud Bongos",
-    "company": { "name": "", "site": "" }
+    "company": {
+      "name": "",
+      "site": ""
+    }
   },
   "llmProjectName": "this project",
   "domains": {
@@ -23,33 +26,70 @@
     "_note": "Cross-site identity (ADR 0141). idp=false → this instance owns its auth outright (its own GitHub app; the default + the self-hosted path). A HOSTED instance sets idp=true and gets its hub origin + client credentials from env (<PREFIX>_HUB_ORIGIN / _HUB_CLIENT_ID / _HUB_CLIENT_SECRET, written by provisioning) so web + CLI sign-in federate through the Cloud Bongos hub with no GitHub app of its own. Identity is federated; authority stays local.",
     "idp": false
   },
-  "repo": { "owner": "", "name": "" },
-  "db": { "database": null },
+  "project": {
+    "_note": "Per-project policy the PLATFORM decides and this instance OBEYS (task 1003139, goal 1000058). Stored on the platform's provisioning_instances.settings; written here as <PREFIX>_PLATFORM_VISIBILITY / <PREFIX>_JOINABILITY by the provisioning runner, which re-writes web.env and restarts the service when the owner changes one. The defaults are TODAY's behavior, so an instance that never receives a push — a self-hosted one, or one provisioned before this channel — keeps behaving exactly as it does now. platformVisibility: public | gated. joinability: open | apply | invite_only.",
+    "platformVisibility": "public",
+    "joinability": "apply"
+  },
+  "repo": {
+    "owner": "",
+    "name": ""
+  },
+  "db": {
+    "database": null
+  },
   "configDir": "cloudbongos",
   "firstAdmin": "",
-  "currency": { "label": "credits", "symbol": "" },
-  "reward": { "marginPct": 20, "usdPeg": 1, "mode": "cost-plus-and-estimate" },
-  "models": { "main": "opus", "subagentDefault": "opus", "subagentRoutine": "haiku" },
+  "currency": {
+    "label": "credits",
+    "symbol": ""
+  },
+  "reward": {
+    "marginPct": 20,
+    "usdPeg": 1,
+    "mode": "cost-plus-and-estimate"
+  },
+  "models": {
+    "main": "opus",
+    "subagentDefault": "opus",
+    "subagentRoutine": "haiku"
+  },
   "theme": {
     "palette": "",
     "mode": "cloud-bongos",
     "ui": {
       "colors": {
-        "bg": "#f9d9a8", "bgCard": "#fffaf2", "bgDeep": "#f6d8ae", "bgFrame": "#f0c489",
-        "ink": "#2b170e", "inkSoft": "#6d4a33", "inkFaint": "#785a41",
-        "rule": "#e8a463", "ruleSoft": "#f6d8ae",
-        "accent": "#ce4806", "accentDeep": "#9e3406", "sea": "#0f7a96", "terracotta": "#855b3d"
+        "bg": "#f9d9a8",
+        "bgCard": "#fffaf2",
+        "bgDeep": "#f6d8ae",
+        "bgFrame": "#f0c489",
+        "ink": "#2b170e",
+        "inkSoft": "#6d4a33",
+        "inkFaint": "#785a41",
+        "rule": "#e8a463",
+        "ruleSoft": "#f6d8ae",
+        "accent": "#ce4806",
+        "accentDeep": "#9e3406",
+        "sea": "#0f7a96",
+        "terracotta": "#855b3d"
       },
       "fonts": {
         "display": "\"Baloo 2\", \"Quicksand\", system-ui, sans-serif",
         "body": "\"Quicksand\", system-ui, -apple-system, \"Segoe UI\", sans-serif",
-        "links": ["https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&family=Fira+Code:wght@400;500&display=swap"]
+        "links": [
+          "https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&family=Fira+Code:wght@400;500&display=swap"
+        ]
       },
       "favicon": "data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><circle cx='12' cy='17' r='8' fill='%23ce4806'/><circle cx='22' cy='17' r='6' fill='%23855b3d'/><circle cx='12' cy='17' r='3.5' fill='%23fffaf2'/><circle cx='22' cy='17' r='2.5' fill='%23fffaf2'/></svg>",
       "backdrop": "#f9d9a8"
     }
   },
-  "rankLabels": { "xenos": "Newcomer", "thetes": "Contributor", "metic": "Trusted", "archon": "Owner" },
+  "rankLabels": {
+    "xenos": "Newcomer",
+    "thetes": "Contributor",
+    "metic": "Trusted",
+    "archon": "Owner"
+  },
   "copy": {
     "tagline": "Building Digitally, as simple as Bongos.",
     "hallName": "Builders' Hall",