@bongos/core 1.19.318 → 1.19.320

package/scripts/gds/go-live.js

@@ -76,8 +76,9 @@ function isSafeToken(v) {
 // The fields a target must carry, and the ones it may. Unknown keys are reported
 // rather than ignored: a typo'd `healthURL` that silently disables the health gate
 // is precisely the class of quiet failure this pipeline keeps being bitten by.
-const REQUIRED_FIELDS = ['ssh', 'instanceDir', 'service', 'healthUrl', 'versionUrl', 'deployTimer'];
-const OPTIONAL_FIELDS = ['deployService', 'npmEnvFile', 'runAs', 'backupDb', 'backupDir', 'env', 'registryPackage'];
+// `ssh` is NOT required: a target with no ssh host is LOCAL (the box driving itself).
+const REQUIRED_FIELDS = ['instanceDir', 'service', 'healthUrl', 'versionUrl', 'deployTimer'];
+const OPTIONAL_FIELDS = ['ssh', 'local', 'deployService', 'npmEnvFile', 'runAs', 'backupDb', 'backupDir', 'env', 'registryPackage'];
 
 function validateTarget(name, t) {
   const errors = [];
@@ -100,6 +101,10 @@ function validateTarget(name, t) {
       continue;
     }
     if (!known.has(k)) continue;
+    if (k === 'local') { // a flag, never interpolated into a command
+      if (typeof v !== 'boolean') errors.push(`target "${name}".local must be true or false`);
+      continue;
+    }
     if (!isSafeToken(v)) errors.push(`target "${name}".${k} contains characters that are unsafe in a shell (got ${JSON.stringify(v)})`);
   }
   return errors;
@@ -166,8 +171,32 @@ function selectTarget(config, name) {
 // the remote login shell). Values are validated above; this is the second layer.
 // ---------------------------------------------------------------------------
 
+// Privilege preamble for any phase that touches systemd.
+//
+// Over ssh these phases run as ROOT, so `systemctl stop …` just works — which is what
+// they originally assumed. Run LOCALLY by the nightly lane they run as the instance
+// OWNER, where the same line fails with "Interactive authentication required" and the
+// timer is never stopped: the pull-deploy `git reset --hard` then stays armed for the
+// whole upgrade, which is the exact hazard the stop exists to remove. Deciding at RUN
+// time keeps one script correct for both callers.
+const SUDO_PREAMBLE = 'SUDO=""; [ "$(id -u)" -eq 0 ] || SUDO="sudo -n"';
+
+// A target is LOCAL when it names no ssh host: the phases run through a local shell
+// instead of a remote one. Everything else — the phases, the halts, the reporting —
+// is byte-identical, which is the point: one deployment engine, reachable from a
+// laptop (remote) or from the box itself (local, how the nightly lane uses it).
+// Without this the unattended path would need its own second implementation, and the
+// two would drift — which is exactly how the nightly deploy ended up with weaker
+// checks than the manual one (task 1003219).
+function isLocalTarget(target) {
+  return !target || !target.ssh;
+}
+
 function remote(target, script, { run = spawnSync, timeoutMs = 900000 } = {}) {
-  const res = run('ssh', ['-o', 'ConnectTimeout=20', '-o', 'BatchMode=yes', target.ssh, 'bash', '-s'], {
+  const [cmd, args] = isLocalTarget(target)
+    ? ['bash', ['-s']]
+    : ['ssh', ['-o', 'ConnectTimeout=20', '-o', 'BatchMode=yes', target.ssh, 'bash', '-s']];
+  const res = run(cmd, args, {
     input: script, encoding: 'utf8', timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024,
   });
   if (!res || res.error) return { ok: false, status: null, stdout: '', stderr: res && res.error ? res.error.message : 'spawn failed' };
@@ -177,36 +206,47 @@ function remote(target, script, { run = spawnSync, timeoutMs = 900000 } = {}) {
 // `sudo -u <user> -H env K=V … <cmd>` — the shape every runbook entry uses. Returns
 // a string safe to embed because every component was allowlist-validated.
 //
-// `forward` names variables that exist in the calling root shell and must reach the
-// child — NPM_TOKEN above all. sudo's env_reset drops it, and an explicit `env K=V`
-// list that omits it drops it too, so `npm install` 404s the PRIVATE package and the
-// upgrade auto-rolls-back, which reads as "the release is broken" when it is only
-// "the token never arrived". Sourcing the env file in the OUTER shell is necessary
-// and NOT sufficient.
+// A privileged child needs npm auth, and there is NO WAY to hand it a secret through
+// sudo without logging it (task 1003218, corrected).
+//
+//   `env NPM_TOKEN="$NPM_TOKEN" …`     → sudo logs it in COMMAND=
+//   `sudo --preserve-env=NPM_TOKEN …`  → sudo logs it in ENV=
 //
-// A FORWARDED VARIABLE IS A SECRET, SO IT MUST NOT ENTER argv (task 1003218).
-// `env K="$K"` keeps the value out of the script TEXT, but the shell EXPANDS it
-// before sudo runs — and sudo logs the full argv. That is how 26 lines of
-// `COMMAND=... NPM_TOKEN=npm_<real token> ...` ended up in the droplet's PERSISTENT
-// journal between 2026-08-17 and 2026-08-23. Passing by reference is NOT the same as
-// keeping a secret out of argv; only `--preserve-env` does that, handing the variable
-// over through the environment where nothing logs it. Verified side by side on the
-// box: both forms reach the child, only this one leaves no value in the journal.
+// The first was the original bug; the second was my "fix", which only MOVED the value
+// to a different field of the same log line. Both put a live credential in a
+// persistent journal. What matters is that sudo logs its whole invocation, so the
+// secret must never be part of it.
+//
+// So the child DERIVES the token itself, from a file it can already read. Only the
+// `sed` appears in argv; the value never does. This is the shape docs/recipes/
+// core-release-pipeline.md already documents as the safe one. The guard matters as
+// much as the derivation: an EMPTY token silently sends npm to the public registry,
+// which 404s the private package, which auto-rolls-back "cleanly" having taught you
+// nothing — so an empty read aborts loudly instead of half-running.
+//
+// (The nightly lane never takes this path: it runs under systemd as the owner with an
+// EnvironmentFile, no sudo, and leaks nothing. This is the manual/agent path only.)
+const NPM_AUTH_PREAMBLE = [
+  'export NPM_TOKEN="${NPM_TOKEN:-$(sed -n \'s/.*_authToken=//p\' "$HOME/.npmrc" 2>/dev/null | head -1)}"',
+  '[ -n "$NPM_TOKEN" ] || { echo "go-live: EMPTY NPM_TOKEN — npm would 404 the private core and roll back; aborting" >&2; exit 12; }',
+].join('; ');
+
+// `sudo -u <user> -H env K=V … <cmd>` — the shape every runbook entry uses. Returns
+// a string safe to embed because every component was allowlist-validated.
 //
-// The plain `env K=V` list is still used for NON-secret values (PGDATABASE, HOME) —
-// those are configuration, and seeing them in a log is useful rather than harmful.
-function asOwner(target, cmd, { forward = [] } = {}) {
+// `needsNpm` wraps the command so it derives its own npm auth (see above) instead of
+// having a secret handed across the privilege boundary. Only NON-secret configuration
+// (PGDATABASE, HOME) travels in the plain `env K=V` list — seeing those in a log is
+// useful rather than harmful.
+function asOwner(target, cmd, { needsNpm = false } = {}) {
+  const inner = needsNpm ? `sh -c ${shq(`${NPM_AUTH_PREAMBLE}; ${cmd}`)}` : cmd;
   const envPairs = Object.entries(target.env || {}).map(([k, v]) => `${k}=${v}`);
-  const preserve = forward.filter((k) => SAFE_ENV_KEY_RE.test(k)); // never interpolate an unvetted name
   if (!target.runAs) {
-    // No privilege drop: the child already inherits our environment, so a forwarded
-    // secret needs no mention at all.
     const joined = envPairs.join(' ');
-    return `${joined ? `env ${joined} ` : ''}${cmd}`.trim();
+    return `${joined ? `env ${joined} ` : ''}${inner}`.trim();
   }
-  const keep = preserve.length ? `--preserve-env=${preserve.join(',')} ` : '';
   const joined = [...envPairs, `HOME=/home/${target.runAs}`].join(' ');
-  return `sudo ${keep}-u ${target.runAs} -H env ${joined} ${cmd}`.trim();
+  return `sudo -u ${target.runAs} -H env ${joined} ${inner}`.trim();
 }
 
 // POSIX single-quote a value for embedding in a shell command.
@@ -264,6 +304,12 @@ function parseMarkerHits(raw) {
   return Number(first);
 }
 
+// Does this process sit inside a git repo that knows the given ref?
+function gitRefExists(ref, { run = spawnSync } = {}) {
+  const r = run('git', ['rev-parse', '--verify', '--quiet', ref], { cwd: ROOT, encoding: 'utf8' });
+  return !!r && !r.error && r.status === 0;
+}
+
 // Refresh origin/main before reading anything from it.
 //
 // deploy-divergence reads CORE_VERSION at the local `origin/main` REF, and a ref is
@@ -283,13 +329,6 @@ function refreshMain({ run = spawnSync } = {}) {
   return { ok: true };
 }
 
-// Which variables an npm-running command needs forwarded. Only when the target
-// declares an env file to source them from — otherwise `K="$K"` would expand to
-// empty and quietly do nothing.
-function npmForward(target) {
-  return target.npmEnvFile ? ['NPM_TOKEN'] : [];
-}
-
 // Parse a `key=value` marker into its parts. Kept pure + exported: the marker is
 // the answer to the trap that the release current when your fix merges usually
 // does NOT contain your fix (ADR 0161 carriers bump on their own cadence).
@@ -435,13 +474,13 @@ function probeRemote(target, targetVersion, marker, opts = {}) {
 set -uo pipefail
 ${src}
 echo "##REGISTRY##"
-${asOwner(target, `npm view ${pkg}@${targetVersion} version`, { forward: npmForward(target) })} 2>&1 | tail -1
+${asOwner(target, `npm view ${pkg}@${targetVersion} version`, { needsNpm: true })} 2>&1 | tail -1
 echo "##TREE##"
 ( cd ${target.instanceDir} && ${target.runAs ? `sudo -u ${target.runAs} -H ` : ''}git status --porcelain | head -20 )
 echo "##INSTALLED##"
 ${asOwner(target, `node -e "console.log(require('${target.instanceDir}/node_modules/${pkg}/package.json').version)"`)} 2>&1 | tail -1
 ${marker ? `echo "##MARKER##"
-${asOwner(target, `sh -c ${shq(markerProbe(pkg, targetVersion, marker))}`, { forward: npmForward(target) })}` : ''}
+${asOwner(target, `sh -c ${shq(markerProbe(pkg, targetVersion, marker))}`, { needsNpm: true })}` : ''}
 echo "##END##"
 `;
   const res = remote(target, script, opts);
@@ -479,7 +518,8 @@ function applyGoLive(target, targetName, targetVersion, from, opts = {}) {
     : 'echo "(no backupDb configured — skipping)"';
   const phaseA = remote(target, `
 set -euo pipefail
-echo "##TIMER##"; systemctl stop ${target.deployTimer} && systemctl is-active ${target.deployTimer} || true
+${SUDO_PREAMBLE}
+echo "##TIMER##"; $SUDO systemctl stop ${target.deployTimer} && $SUDO systemctl is-active ${target.deployTimer} || true
 echo "##BACKUP##"; ${backup}
 echo "##END##"
 `, opts);
@@ -499,7 +539,7 @@ echo "##END##"
   const phaseB = remote(target, `
 set -uo pipefail
 ${src}
-${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade}"`, { forward: npmForward(target) })}
+${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade}"`, { needsNpm: true })}
 `, opts);
   const rolledBack = /rolled back/i.test(phaseB.stdout + phaseB.stderr);
   steps.push({
@@ -510,7 +550,7 @@ ${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade}"`, { forward:
   if (!phaseB.ok || rolledBack) {
     // Restart the timer even on failure — leaving it stopped silently disables
     // the instance's pull-deploy until someone notices.
-    remote(target, `systemctl start ${target.deployTimer} || true`, opts);
+    remote(target, `${SUDO_PREAMBLE}\n$SUDO systemctl start ${target.deployTimer} || true`, opts);
     return { ok: false, steps, from, to: targetVersion, targetName, failedAt: 'UPGRADE', rolledBack, raw: phaseB };
   }
 
@@ -519,10 +559,11 @@ ${asOwner(target, `bash -c "cd ${target.instanceDir} && ${upgrade}"`, { forward:
   // not evidence; 127.0.0.1 is.
   const phaseC = remote(target, `
 set -uo pipefail
-echo "##TIMERSTART##"; systemctl start ${target.deployTimer}; systemctl is-active ${target.deployTimer}
+${SUDO_PREAMBLE}
+echo "##TIMERSTART##"; $SUDO systemctl start ${target.deployTimer}; $SUDO systemctl is-active ${target.deployTimer}
 echo "##PIN##"; ( cd ${target.instanceDir} && ${target.runAs ? `sudo -u ${target.runAs} -H ` : ''}git status --porcelain -- package.json package-lock.json )
 echo "##HEAD##"; ( cd ${target.instanceDir} && ${target.runAs ? `sudo -u ${target.runAs} -H ` : ''}git log -1 --format='%h %s' )
-${target.deployService ? `echo "##TICK##"; systemctl start ${target.deployService} || true; journalctl -u ${target.deployService} -n 20 --no-pager | tail -8` : ''}
+${target.deployService ? `echo "##TICK##"; $SUDO systemctl start ${target.deployService} || true; $SUDO journalctl -u ${target.deployService} -n 20 --no-pager | tail -8` : ''}
 echo "##VERSION##"; curl -s --max-time 20 ${target.versionUrl} | head -c 400
 echo ""
 echo "##INSTALLED##"; ${asOwner(target, `node -e "console.log(require('${target.instanceDir}/node_modules/${pkg}/package.json').version)"`)} 2>&1 | tail -1
@@ -563,6 +604,8 @@ go-live — move an enrolled instance's core pin, as one command.
   node scripts/gds/go-live.js --config <path>     default: ${DEFAULT_CONFIG}
   node scripts/gds/go-live.js --allow-unreleased  downgrade UNRELEASED_ON_MAIN to a warning
   node scripts/gds/go-live.js --no-fetch          skip the origin/main refresh (default: fetch)
+  node scripts/gds/go-live.js --target-json '{…}' pass a target inline instead of a config file
+  node scripts/gds/go-live.js --no-divergence     skip the git-derived checks (needs --to)
   node scripts/gds/go-live.js --json              machine-readable
 
 Host topology is NOT baked into the core. ${DEFAULT_CONFIG} (host-owned, not published):
@@ -578,6 +621,24 @@ async function main() {
   const apply = hasFlag('--apply');
   const allowUnreleased = hasFlag('--allow-unreleased');
 
+  // An inline target lets a CALLER drive this without inventing a second host-owned
+  // config file beside the one it already has. The nightly lane already holds a roster
+  // entry; making it also maintain config/go-live.json would be two sources of truth
+  // for one box, which is how they drift.
+  const inline = arg('--target-json');
+  if (inline) {
+    let parsed;
+    try { parsed = JSON.parse(inline); }
+    catch (e) { console.error(`  go-live: --target-json is not valid JSON — ${e.message}`); return 2; }
+    const errors = validateTarget('inline', parsed);
+    if (errors.length) {
+      if (json) { console.log(JSON.stringify({ ok: false, halt: 'CONFIG_INVALID', detail: errors.join('; ') }, null, 2)); return 1; }
+      console.error(`\n  go-live: CONFIG_INVALID — ${errors.join('; ')}\n`);
+      return 1;
+    }
+    return runGoLive({ target: parsed, targetName: arg('--target') || 'inline', configPath: '--target-json', json, apply, allowUnreleased });
+  }
+
   const cfg = loadConfig({ configPath: arg('--config') });
   if (cfg.error) {
     if (json) { console.log(JSON.stringify({ ok: false, halt: cfg.error, path: cfg.path, detail: cfg.detail }, null, 2)); return 1; }
@@ -595,7 +656,10 @@ async function main() {
     return 1;
   }
   const { target, name: targetName } = sel;
+  return runGoLive({ target, targetName, configPath: cfg.path, json, apply, allowUnreleased });
+}
 
+async function runGoLive({ target, targetName, configPath, json, apply, allowUnreleased }) {
   const marker = parseMarker(arg('--verify-marker'));
   if (marker && marker.error) { console.error(`  go-live: ${marker.error}`); return 2; }
 
@@ -603,18 +667,40 @@ async function main() {
   let targetVersion = arg('--to');
   if (targetVersion && !SEMVER_RE.test(targetVersion)) { console.error(`  go-live: --to "${targetVersion}" is not a version`); return 2; }
 
-  const fetched = hasFlag('--no-fetch') ? { ok: false, skipped: true } : refreshMain();
-  const div = await divergence.check({ base: arg('--url') });
+  // Is there a core GIT CHECKOUT to reason about at all?
+  //
+  // Every git-derived signal — the target read from origin/main, the UNRELEASED halt,
+  // the dirty-checkout halt — presumes this process is running inside a core repo.
+  // The nightly lane is NOT: it runs on the box, against an installed package, and it
+  // resolves its target from the REGISTRY under a channel policy instead. Running the
+  // git checks there would halt every sweep on a condition that does not apply.
+  //
+  // So the git legs are SKIPPED only when both are true: there is no resolvable
+  // origin/main, AND the caller named the version explicitly. A missing checkout with
+  // no --to is still an error — silently inventing a target is exactly the class of
+  // guess this script exists to refuse.
+  // "Am I in a SOURCE checkout?" is `.git` AT OUR ROOT — not "is there a git repo
+  // somewhere above me". The installed core package lives inside the INSTANCE's repo
+  // and ships its own src/module-api.js, so a naive `git rev-parse HEAD` succeeds
+  // there and CORE_VERSION resolves — against the instance repo's main, which is a
+  // meaningless answer delivered confidently. That is the failure this check avoids.
+  const hasCheckout = fs.existsSync(path.join(ROOT, '.git'));
+  const gitless = (!hasCheckout || hasFlag('--no-divergence')) && !!targetVersion;
+
+  const fetched = (gitless || hasFlag('--no-fetch')) ? { ok: false, skipped: true } : refreshMain();
+  const div = gitless ? null : await divergence.check({ base: arg('--url') });
   if (!targetVersion) targetVersion = div && div.onMain;
-  if (targetVersion && !SEMVER_RE.test(targetVersion)) {
-    console.error(`  go-live: could not resolve a target version (read ${JSON.stringify(targetVersion)} from main)`);
+  if (!targetVersion || !SEMVER_RE.test(targetVersion)) {
+    console.error(`  go-live: could not resolve a target version${hasCheckout ? ` (read ${JSON.stringify(targetVersion)} from main)` : ' — this is not a core source checkout, so pass --to <version>'}`);
     return 1;
   }
 
-  const dirtyRes = spawnSync('git', ['status', '--porcelain'], { cwd: ROOT, encoding: 'utf8' });
+  const dirtyRes = gitless ? { status: 1 } : spawnSync('git', ['status', '--porcelain'], { cwd: ROOT, encoding: 'utf8' });
   const dirtyCheckout = dirtyRes.status === 0 && (dirtyRes.stdout || '').trim() ? (dirtyRes.stdout || '').trim().split('\n').slice(0, 5).join(', ') : null;
 
-  const plan = planGoLive({ div, target, targetVersion, dirtyCheckout, allowUnreleased });
+  const plan = gitless
+    ? { halts: [], notes: [{ code: 'NO_CORE_CHECKOUT', message: `no core git checkout here — target ${targetVersion} was given explicitly, so the git-derived checks (unreleased-on-main, dirty tree) are skipped` }], from: null, targetVersion, target }
+    : planGoLive({ div, target, targetVersion, dirtyCheckout, allowUnreleased });
   plan.marker = marker;
   if (!fetched.ok && !fetched.skipped) {
     // Say so rather than silently planning off a ref of unknown age.
@@ -626,6 +712,14 @@ async function main() {
   if (!plan.halts.length) {
     const probe = probeRemote(target, targetVersion, marker);
     plan.registry = probe.registry;
+    // With no source checkout there is no git-derived `from`; the installed version on
+    // the box IS the truth, and the probe just read it.
+    if (gitless && probe.installed) {
+      plan.from = probe.installed;
+      if (probe.installed === targetVersion) {
+        plan.halts.push({ code: 'ALREADY_LIVE', message: HALTS.ALREADY_LIVE, detail: `installed and target are both ${targetVersion}` });
+      }
+    }
     if (!probe.reachable) {
       plan.halts.push({ code: 'BOX_UNREACHABLE', message: `could not reach ${target.ssh}`, detail: (probe.raw.stderr || '').trim().split('\n').pop() });
     } else {
@@ -656,7 +750,7 @@ async function main() {
 
   if (!apply || plan.halts.length) {
     if (json) { console.log(JSON.stringify({ ok: !plan.halts.length, mode: apply ? 'halted' : 'plan', targetName, ...plan }, null, 2)); }
-    else { console.log(renderPlan(plan, { targetName, configPath: cfg.path })); }
+    else { console.log(renderPlan(plan, { targetName, configPath })); }
     return plan.halts.length ? 1 : 0;
   }
 
@@ -675,6 +769,6 @@ if (require.main === module) {
 
 module.exports = {
   loadConfig, selectTarget, validateTarget, planGoLive, parseMarker, parseMarkerHits,
-  renderPlan, renderReport, failureExcerpt, asOwner, isSafeToken, npmForward, refreshMain,
+  renderPlan, renderReport, failureExcerpt, asOwner, isSafeToken, NPM_AUTH_PREAMBLE, refreshMain, isLocalTarget, gitRefExists, SUDO_PREAMBLE,
   CONFIG_TEMPLATE, HALTS, SEMVER_RE,
 };

package/scripts/gds/instance-apex.js

@@ -0,0 +1,28 @@
+'use strict';
+// instance-apex.js — the instance's own registrable apex + the addresses derived
+// from it, read from its branding pack (task 1002757).
+//
+// WHY THIS EXISTS. Operator-plane defaults used to carry the founder's apex as a
+// literal (box DNS zones, the Cloudflare zone, the provisioner's git identity),
+// so another operator's fleet pointed at the founder's DNS and its commits were
+// attributed to the hub. These resolvers return NULL rather than guessing when the
+// pack names no public origin: every caller treats null as "not configured" and
+// refuses, which fails loudly instead of minting an unreachable host.
+function instanceApex() {
+  try {
+    const host = new URL(require('../../src/branding').branding().domains.publicOrigin).hostname;
+    return host && !/^localhost$/i.test(host) ? host : null;
+  } catch { return null; }
+}
+
+// The git identity a provisioner commits scaffold/pin changes as: explicit env →
+// bot@<instance apex> → a neutral, deliberately-undeliverable platform address
+// (never a live inbox by accident).
+function provisionerBotEmail(env = process.env) {
+  const explicit = String(env.PROVISION_BOT_EMAIL || '').trim();
+  if (explicit) return explicit;
+  const apex = instanceApex();
+  return apex ? `bot@${apex}` : 'bot@cloud-bongos.invalid';
+}
+
+module.exports = { instanceApex, provisionerBotEmail };

package/scripts/gds/newcomer-floor.templates.json

@@ -49,7 +49,7 @@
       "est_minutes": 55,
       "credits_reward": 15,
       "title": "Generate one new in-world art asset of your choice (a prop, plant, animal, or accessory) via the pixel-art pipeline",
-      "description": "## What you're doing\n\nAmazonprimea is a young ancient-Greek coastal world, and it always needs more to look at. Your first ship as an artist is to **generate ONE new in-world asset of your own choosing** and add it to the world. You pick the subject — that's the fun part. Good candidates, all in-world (Mediterranean coast just south of Athens, mythic 'discovered secret' tone):\n- **Props**: amphora, fishing net, basket, crate, urn, torch, market awning, oar, clay pot.\n- **Plants**: olive tree, cypress, reeds, grapevine, shrub, wild herbs.\n- **Animals**: goat, chicken, duck, donkey, fish, gull, lizard.\n- **Accessories**: a sandal, a sun hat, a length of rope, a string of beads.\n\nIt is identical for every newcomer and **always valuable**, because a growing world has effectively unbounded demand for new props, flora, fauna, and detail — every newcomer picks a different subject, so two runs never collide.\n\n## How to find your way in\n\n1. Read `art/README.md` and `docs/recipes/pixel-art-pipeline.md`, plus `modules/art-pipeline/template/style_guide.md`, `modules/art-pipeline/template/rubric.json`, and `modules/art-pipeline/template/palette.json` — that's the look you must hit: 16-bit pixel art, early-Pokémon (FireRed) touchstone, top-down, 32×32, locked 64-colour Mediterranean palette (olive greens, warm tans, turquoise sea, weathered marble — NOT spring green, NOT navy, NOT pine).\n2. **Pick ONE subject.** Keep it to a SINGLE 32×32 tile/sprite — not a whole spritesheet or family (that's a bigger task).\n3. **Check the budget first**: `python3 modules/art-pipeline/pipeline/cost_ledger.py status` (the pipeline hard-stops at $80; one asset is ~$0.05–0.45).\n4. **Generate via the pipeline — do not hand-draw or freelance.** Use the `/otb-tile-generate` skill: it appends your new entry to `modules/art-pipeline/template/vocabulary.json`, runs the generate → post-process-to-32×32 → score-against-rubric → retry orchestrator, saves the final PNG to `modules/art-pipeline/generated/tiles/<id>.png`, and logs cost. (This needs the art pipeline's `GOOGLE_AI_STUDIO_KEY`, which resolves from `~/.config/otb/env`; most builder setups have it. If yours doesn't, claim the engineer or ideator newcomer chore instead, or ask an Archon to enable it.)\n5. **Confirm it PASSED** the rubric (`modules/art-pipeline/iterations/run_summary.json` shows `status: \"pass\"`). If it only reached best-effort, regenerate with the fix_hint — never paper over a fail.\n6. **See it in-game**: `node scripts/gds/art-stage.js` rebuilds the atlas and surfaces it on your sandbox preview (`sandbox-<login>.amazonprimea.com`).\n7. Ship via `/builder-ship`; the ship notes name your asset and its rubric score.\n\n## Stay clear of (READ-ONLY)\n\nNever modify the locked palette (`modules/art-pipeline/template/palette.json`) or the rubric (`modules/art-pipeline/template/rubric.json`) — those are theme-defining and changing them needs an ADR (out of scope for a first ship). Touch only art assets/vocabulary under `art/` (and, only if your asset is a genuinely new base-tile TYPE, the `public/game/world/tilePalette.js` mapping). Do not touch any permission/pipeline-core/migration/infra file.",
+      "description": "## What you're doing\n\nThis instance's world always needs more to look at. Your first ship as an artist is to **generate ONE new in-world asset of your own choosing** and add it to the world. You pick the subject — that's the fun part. Good candidates, all in-world (Mediterranean coast just south of Athens, mythic 'discovered secret' tone):\n- **Props**: amphora, fishing net, basket, crate, urn, torch, market awning, oar, clay pot.\n- **Plants**: olive tree, cypress, reeds, grapevine, shrub, wild herbs.\n- **Animals**: goat, chicken, duck, donkey, fish, gull, lizard.\n- **Accessories**: a sandal, a sun hat, a length of rope, a string of beads.\n\nIt is identical for every newcomer and **always valuable**, because a growing world has effectively unbounded demand for new props, flora, fauna, and detail — every newcomer picks a different subject, so two runs never collide.\n\n## How to find your way in\n\n1. Read `art/README.md` and `docs/recipes/pixel-art-pipeline.md`, plus `modules/art-pipeline/template/style_guide.md`, `modules/art-pipeline/template/rubric.json`, and `modules/art-pipeline/template/palette.json` — that's the look you must hit: 16-bit pixel art, early-Pokémon (FireRed) touchstone, top-down, 32×32, locked 64-colour Mediterranean palette (olive greens, warm tans, turquoise sea, weathered marble — NOT spring green, NOT navy, NOT pine).\n2. **Pick ONE subject.** Keep it to a SINGLE 32×32 tile/sprite — not a whole spritesheet or family (that's a bigger task).\n3. **Check the budget first**: `python3 modules/art-pipeline/pipeline/cost_ledger.py status` (the pipeline hard-stops at $80; one asset is ~$0.05–0.45).\n4. **Generate via the pipeline — do not hand-draw or freelance.** Use the `/otb-tile-generate` skill: it appends your new entry to `modules/art-pipeline/template/vocabulary.json`, runs the generate → post-process-to-32×32 → score-against-rubric → retry orchestrator, saves the final PNG to `modules/art-pipeline/generated/tiles/<id>.png`, and logs cost. (This needs the art pipeline's `GOOGLE_AI_STUDIO_KEY`, which resolves from `~/.config/otb/env`; most builder setups have it. If yours doesn't, claim the engineer or ideator newcomer chore instead, or ask an Archon to enable it.)\n5. **Confirm it PASSED** the rubric (`modules/art-pipeline/iterations/run_summary.json` shows `status: \"pass\"`). If it only reached best-effort, regenerate with the fix_hint — never paper over a fail.\n6. **See it in-game**: `node scripts/gds/art-stage.js` rebuilds the atlas and surfaces it on your sandbox preview (`sandbox-<login>.<instance-apex>`).\n7. Ship via `/builder-ship`; the ship notes name your asset and its rubric score.\n\n## Stay clear of (READ-ONLY)\n\nNever modify the locked palette (`modules/art-pipeline/template/palette.json`) or the rubric (`modules/art-pipeline/template/rubric.json`) — those are theme-defining and changing them needs an ADR (out of scope for a first ship). Touch only art assets/vocabulary under `art/` (and, only if your asset is a genuinely new base-tile TYPE, the `public/game/world/tilePalette.js` mapping). Do not touch any permission/pipeline-core/migration/infra file.",
       "done_when": [
         "Exactly one NEW in-world asset (your chosen subject) was generated via the pixel-art pipeline (`/otb-tile-generate` / orchestrator.py); the final PNG exists at modules/art-pipeline/generated/tiles/<id>.png.",
         "It PASSED the rubric (modules/art-pipeline/iterations/run_summary.json status 'pass', or /otb-design-review numbers reported at/above the bar) and every pixel is on the locked palette (modules/art-pipeline/template/palette.json).",
@@ -70,7 +70,7 @@
       "est_minutes": 45,
       "credits_reward": 12,
       "title": "Idea-seed pass: file 5-8 fresh in-world ideas (names, lore, or builder-UX) into the idea inbox",
-      "description": "## What you'll do\n\nThe seed of almost everything built here is the **idea_inbox** — a queue anyone can drop ideas into, which trusted builders later triage into real tasks. Your first ship as an ideator is simple and concrete: **add a small batch of fresh ideas to that inbox.** You write no code, touch no game, change no system — you think, write a few short well-shaped ideas, and file them with one command each.\n\nIt is identical for every newcomer and **always valuable**: the inbox is never \"done\" — every triage pass consumes ideas (promote/discard/merge), so it is permanently hungry for fresh input, and a world the size of Amazonprimea always wants more names, more lore, more texture. Your batch is brand-new content, so it can never duplicate \"the work\" — the supply IS the work.\n\n## Pick ONE branch\n\n- **Branch A — PRODUCT flavour (default).** Ideas that grow the world players see: **names + one line of lore** for a character, structure, landmark, district, ship, or festival; or a world-background snippet (a custom, a superstition, a line a named NPC says). Tone: mythic, mysterious, a \"discovered secret\"; Mediterranean ancient-Greek coast (just south of Athens); NOT modern, NOT tongue-in-cheek-modern. Ground it in CLAUDE.md §3/§6/§7.\n- **Branch B — INTERNAL / builder-UX.** Small user-experience improvement ideas for the GDS / builders' hall (the surfaces builders use, not the game): a clearer label, a confusing onboarding message, a quality-of-life tweak to a status page or a slash-command's output. See `docs/TRACKS.md` for product vs internal.\n\n## How to find your way in\n\n1. (Branch A) Read CLAUDE.md §3/§6/§7 for tone. (Branch B) Skim `docs/TRACKS.md` and click around https://amazonprimea.com/builders for the rough edge you'll write up.\n2. See what's already filed so you don't repeat it: `node scripts/gds/api.js GET /api/gds/inbox`.\n3. File each idea with `node scripts/gds/capture.js \"<title>\" --body-file <path>` (filing an idea is the open-to-all path — a Xenos/Thetes session is allowed to do it; you just can't triage them). Put one line of detail + a `track: product` or `track: internal` line in each body file.",
+      "description": "## What you'll do\n\nThe seed of almost everything built here is the **idea_inbox** — a queue anyone can drop ideas into, which trusted builders later triage into real tasks. Your first ship as an ideator is simple and concrete: **add a small batch of fresh ideas to that inbox.** You write no code, touch no game, change no system — you think, write a few short well-shaped ideas, and file them with one command each.\n\nIt is identical for every newcomer and **always valuable**: the inbox is never \"done\" — every triage pass consumes ideas (promote/discard/merge), so it is permanently hungry for fresh input, and a growing world always wants more names, more lore, more texture. Your batch is brand-new content, so it can never duplicate \"the work\" — the supply IS the work.\n\n## Pick ONE branch\n\n- **Branch A — PRODUCT flavour (default).** Ideas that grow the world players see: **names + one line of lore** for a character, structure, landmark, district, ship, or festival; or a world-background snippet (a custom, a superstition, a line a named NPC says). Tone: mythic, mysterious, a \"discovered secret\"; Mediterranean ancient-Greek coast (just south of Athens); NOT modern, NOT tongue-in-cheek-modern. Ground it in CLAUDE.md §3/§6/§7.\n- **Branch B — INTERNAL / builder-UX.** Small user-experience improvement ideas for the GDS / builders' hall (the surfaces builders use, not the game): a clearer label, a confusing onboarding message, a quality-of-life tweak to a status page or a slash-command's output. See `docs/TRACKS.md` for product vs internal.\n\n## How to find your way in\n\n1. (Branch A) Read CLAUDE.md §3/§6/§7 for tone. (Branch B) Skim `docs/TRACKS.md` and click around your instance's /builders hall for the rough edge you'll write up.\n2. See what's already filed so you don't repeat it: `node scripts/gds/api.js GET /api/gds/inbox`.\n3. File each idea with `node scripts/gds/capture.js \"<title>\" --body-file <path>` (filing an idea is the open-to-all path — a Xenos/Thetes session is allowed to do it; you just can't triage them). Put one line of detail + a `track: product` or `track: internal` line in each body file.",
       "done_when": [
         "You filed 5–8 fresh ideas into the idea_inbox via `node scripts/gds/capture.js` (each prints a `Captured idea #N` confirmation), all in ONE branch (A product, or B internal/UX).",
         "Each idea has a clear title and a body with at least one sentence of detail — for Branch A, one line of in-world lore (who/what it is); for Branch B, what the rough edge is and what 'better' looks like.",

package/scripts/gds/provision.js

@@ -169,6 +169,10 @@ const CONFIG = {
   sshOpts: process.env.PROVISION_SSH_OPTS || '-o BatchMode=yes -o StrictHostKeyChecking=accept-new',
 };
 
+// task 1002757 — the provisioner's git identity resolves from the instance's own
+// apex (env → bot@<apex> → neutral), never the hub's address hardcoded.
+const { provisionerBotEmail } = require('./instance-apex');
+
 const MAX_INTENT_ATTEMPTS = numEnv('PROVISION_INTENT_MAX_ATTEMPTS', 3);
 
 // Manifest-placement verification budget (task 1002720 / QA-walk F23): a child
@@ -709,7 +713,7 @@ async function scaffoldStandaloneRepo(inst, deps) {
       writeFile(giPath, INSTANCE_GITIGNORE);
     }
     exec(`git -C ${root} config user.name "Cloud Bongos"`);
-    exec(`git -C ${root} config user.email "bot@cloudbongos.com"`);
+    exec(`git -C ${root} config user.email "${provisionerBotEmail()}"`);
     exec(`git -C ${root} add -A`);
     const commitMsg = mode === 'adopt'
       ? `chore: adopt Cloud Bongos onto ${inst.slug} on a pinned @bongos/core ${coreV} (provision.js, ADR 0121)`
@@ -939,7 +943,7 @@ function buildCorePinRefreshCommit({ root, fromVersion, toVersion, repo, ownerTo
   return {
     config: [
       `git -C ${root} config user.name "Cloud Bongos"`,
-      `git -C ${root} config user.email "bot@cloudbongos.com"`,
+      `git -C ${root} config user.email "${provisionerBotEmail()}"`,
     ],
     add: `git -C ${root} add -A`,
     commit: `git -C ${root} commit -m "${msg}"`,
@@ -2477,7 +2481,7 @@ async function main() {
 if (require.main === module) main();
 
 module.exports = {
-  CONFIG, MAX_INTENT_ATTEMPTS,
+  CONFIG, MAX_INTENT_ATTEMPTS, provisionerBotEmail,
   // pure step generators (tested directly)
   dbName, dbCreateCmd, migrateCmd, seedFirstVersionCmd, serviceUnit, serviceUnitPath, webEnvBody, webEnvPath,
   backupUnitName, backupServicePath, backupTimerPath, backupScriptPath, backupService, backupTimer,