@bongos/core 1.19.336 → 1.19.338

package/modules/memory/routes/memory.js

@@ -61,6 +61,8 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const auth = api;
 const memory = require('../memory');
+// task 1003208: structured logging (pino via the doorway) — was console.*.
+const log = api.logger('memory');
 const db = api;
 
 // Per-builder rate limit for POST /memory/sync, layered ON TOP of the global
@@ -357,7 +359,7 @@ module.exports = function buildMemoryRouter() {
     } catch (e) {
       // A throw here means the transaction itself failed (BEGIN/COMMIT/connect),
       // not a per-file rejection — those come back inside the results array.
-      console.error('[gds] POST /memory/sync batch transaction error', { builderId, err: e });
+      log.error('[gds] POST /memory/sync batch transaction error', { builderId, err: e });
       return res.fail('store_failed', { status: 500, message: 'memory sync failed; nothing was stored' });
     }
 
@@ -397,9 +399,9 @@ module.exports = function buildMemoryRouter() {
         hint = 'Prune old memory files (the limit is per-builder, summed across all files).';
       } else if (code !== 'BAD_PATH' && code !== 'STORE_FAILED') {
         // Unknown helper error code — log for forensics, still report per-file.
-        console.error('[gds] POST /memory/sync store error', { builderId, path, code, err: e });
+        log.error('[gds] POST /memory/sync store error', { builderId, path, code, err: e });
       } else if (code === 'STORE_FAILED') {
-        console.error('[gds] POST /memory/sync unexpected error', { builderId, path, err: e });
+        log.error('[gds] POST /memory/sync unexpected error', { builderId, path, err: e });
       }
       const err = { path, code, message, ...(hint ? { hint } : {}) };
       errors.push(err);
@@ -452,7 +454,7 @@ module.exports = function buildMemoryRouter() {
         })),
       });
     } catch (err) {
-      console.error('[gds] GET /memory/files', { builderId, err });
+      log.error('[gds] GET /memory/files', { builderId, err });
       return res.fail('list_failed', { status: 500, message: 'could not list memory files' });
     }
   });
@@ -504,7 +506,7 @@ module.exports = function buildMemoryRouter() {
         created_at: row.created_at,
       });
     } catch (err) {
-      console.error('[gds] GET /memory/file', { builderId, path, err });
+      log.error('[gds] GET /memory/file', { builderId, path, err });
       return res.fail('fetch_failed', { status: 500, message: 'could not fetch memory file' });
     }
   });
@@ -537,7 +539,7 @@ module.exports = function buildMemoryRouter() {
       if (n === 0) return res.fail('not_found', 404, { path });
       return res.json({ deleted: true, builder_id: builderId, path });
     } catch (err) {
-      console.error('[gds] DELETE /memory/file', { builderId, path, err });
+      log.error('[gds] DELETE /memory/file', { builderId, path, err });
       return res.fail('delete_failed', { status: 500, message: 'could not delete memory file' });
     }
   });
@@ -568,7 +570,7 @@ module.exports = function buildMemoryRouter() {
       try {
         rows = await memory.listMemoryFiles(targetId);
       } catch (err) {
-        console.error('[gds] GET /memory/builders/:builderId/files', { targetId, err });
+        log.error('[gds] GET /memory/builders/:builderId/files', { targetId, err });
         return res.fail('list_failed', { status: 500, message: 'could not list memory files' });
       }
       // FAIL CLOSED: the audit row must land durably BEFORE we return any of the
@@ -579,7 +581,7 @@ module.exports = function buildMemoryRouter() {
       try {
         await recordForensicRead(req, { route, targetBuilderId: targetId, target: 'list', responseStatus: 200 });
       } catch (auditErr) {
-        console.error('[gds] forensic-read audit insert failed (read withheld)', {
+        log.error('[gds] forensic-read audit insert failed (read withheld)', {
           route, targetId, err: auditErr && auditErr.message ? auditErr.message : String(auditErr),
         });
         return res.fail('audit_failed', { status: 500, message: 'forensic read not served: audit could not be recorded' });
@@ -628,7 +630,7 @@ module.exports = function buildMemoryRouter() {
       try {
         row = await memory.fetchMemoryFile(targetId, path);
       } catch (err) {
-        console.error('[gds] GET /memory/builders/:builderId/file', { targetId, path, err });
+        log.error('[gds] GET /memory/builders/:builderId/file', { targetId, path, err });
         return res.fail('fetch_failed', { status: 500, message: 'could not fetch memory file' });
       }
       // FAIL CLOSED: audit the look — logged even if the path is a 404, because
@@ -640,7 +642,7 @@ module.exports = function buildMemoryRouter() {
       try {
         await recordForensicRead(req, { route, targetBuilderId: targetId, target: path, responseStatus: outcomeStatus });
       } catch (auditErr) {
-        console.error('[gds] forensic-read audit insert failed (read withheld)', {
+        log.error('[gds] forensic-read audit insert failed (read withheld)', {
           route, targetId, path, err: auditErr && auditErr.message ? auditErr.message : String(auditErr),
         });
         return res.fail('audit_failed', { status: 500, message: 'forensic read not served: audit could not be recorded' });
@@ -687,7 +689,7 @@ module.exports = function buildMemoryRouter() {
       try {
         rows = await memory.listMemoryFiles(targetId);
       } catch (err) {
-        console.error('[gds] GET /memory/bfg/builders/:builderId/files', { targetId, err });
+        log.error('[gds] GET /memory/bfg/builders/:builderId/files', { targetId, err });
         return res.fail('list_failed', { status: 500, message: 'could not list memory files' });
       }
       // FAIL CLOSED: the audit row must land before any of the target's data is
@@ -695,7 +697,7 @@ module.exports = function buildMemoryRouter() {
       try {
         await recordForensicRead(req, { route, targetBuilderId: targetId, target: 'list', responseStatus: 200, action: 'bfg_memory_read' });
       } catch (auditErr) {
-        console.error('[gds] bfg-read audit insert failed (read withheld)', { route, targetId, err: auditErr && auditErr.message ? auditErr.message : String(auditErr) });
+        log.error('[gds] bfg-read audit insert failed (read withheld)', { route, targetId, err: auditErr && auditErr.message ? auditErr.message : String(auditErr) });
         return res.fail('audit_failed', { status: 500, message: 'read not served: audit could not be recorded' });
       }
       res.set('Cache-Control', 'no-store');
@@ -731,14 +733,14 @@ module.exports = function buildMemoryRouter() {
       try {
         row = await memory.fetchMemoryFile(targetId, path);
       } catch (err) {
-        console.error('[gds] GET /memory/bfg/builders/:builderId/file', { targetId, path, err });
+        log.error('[gds] GET /memory/bfg/builders/:builderId/file', { targetId, path, err });
         return res.fail('fetch_failed', { status: 500, message: 'could not fetch memory file' });
       }
       const outcomeStatus = row ? 200 : 404;
       try {
         await recordForensicRead(req, { route, targetBuilderId: targetId, target: path, responseStatus: outcomeStatus, action: 'bfg_memory_read' });
       } catch (auditErr) {
-        console.error('[gds] bfg-read audit insert failed (read withheld)', { route, targetId, path, err: auditErr && auditErr.message ? auditErr.message : String(auditErr) });
+        log.error('[gds] bfg-read audit insert failed (read withheld)', { route, targetId, path, err: auditErr && auditErr.message ? auditErr.message : String(auditErr) });
         return res.fail('audit_failed', { status: 500, message: 'read not served: audit could not be recorded' });
       }
       if (!row) return res.fail('not_found', 404, { builder_id: targetId, path });
@@ -830,7 +832,7 @@ module.exports = function buildMemoryRouter() {
       try {
         target = await db.getBuilderById(targetId);
       } catch (err) {
-        console.error('[gds] bfg-write target lookup', { targetId, err });
+        log.error('[gds] bfg-write target lookup', { targetId, err });
         return res.fail('lookup_failed', 500);
       }
       if (!target) return res.fail('target_not_found', 404);
@@ -893,7 +895,7 @@ module.exports = function buildMemoryRouter() {
           // own assertBfgPath guard mapped to a clean 400 for any direct caller.
           return res.fail('bad_path', 400, { code });
         }
-        console.error('[gds] POST /memory/builders/:builderId/bfg-write', e);
+        log.error('[gds] POST /memory/builders/:builderId/bfg-write', e);
         return res.fail('bfg_write_failed', 500);
       }
     }

package/modules/platform-identity/routes/sso.js

@@ -19,6 +19,8 @@ const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const hubKeys = require('../hub-keys');
 const hubDevice = require('../hub-device');
+// task 1003208: structured logging (pino via the doorway) — was console.*.
+const log = api.logger('platform-identity');
 
 const { pool, validateOrRespond, resolveSession } = api;
 
@@ -65,12 +67,12 @@ async function notifyInstanceLogout(membership, githubId) {
         body: JSON.stringify({ logout_token: token }),
         signal: ac.signal,
       });
-      if (!resp.ok) console.warn(`[platform-identity] SLO: ${origin} returned ${resp.status}`);
+      if (!resp.ok) log.warn(`[platform-identity] SLO: ${origin} returned ${resp.status}`);
     } finally {
       clearTimeout(timer);
     }
   } catch (err) {
-    console.warn(`[platform-identity] SLO: notifying ${origin} failed (non-blocking):`, err && err.message ? err.message : err);
+    log.warn(`[platform-identity] SLO: notifying ${origin} failed (non-blocking):`, err && err.message ? err.message : err);
   }
 }
 
@@ -90,7 +92,7 @@ async function fanOutBackchannelLogout(githubId) {
     const targets = (memberships || []).filter((m) => m.project_origin && m.client_id);
     await Promise.allSettled(targets.map((m) => notifyInstanceLogout(m, githubId)));
   } catch (err) {
-    console.error('[platform-identity] SLO fan-out failed (non-blocking):', err && err.message ? err.message : err);
+    log.error('[platform-identity] SLO fan-out failed (non-blocking):', err && err.message ? err.message : err);
   }
 }
 
@@ -149,7 +151,7 @@ module.exports = function ssoRoutes() {
     try {
       client = await pi.getClient(clientId, { pool });
     } catch (err) {
-      console.error('[platform-identity] /sso/authorize getClient', err);
+      log.error('[platform-identity] /sso/authorize getClient', err);
       return res.status(500).type('text/html').send(errorPage('Internal error resolving the project.'));
     }
     if (!client || client.status !== 'active') {
@@ -171,7 +173,7 @@ module.exports = function ssoRoutes() {
     try {
       session = await resolveSession(req);
     } catch (err) {
-      console.error('[platform-identity] /sso/authorize resolveSession', err);
+      log.error('[platform-identity] /sso/authorize resolveSession', err);
       return res.status(500).type('text/html').send(errorPage('Internal error checking your hub session.'));
     }
     const usable = pi.sessionUsableForFederation(session);
@@ -213,7 +215,7 @@ module.exports = function ssoRoutes() {
       if (state) u.searchParams.set('state', state);
       return res.redirect(302, u.toString());
     } catch (err) {
-      console.error('[platform-identity] /sso/authorize mint', err);
+      log.error('[platform-identity] /sso/authorize mint', err);
       return res.status(500).type('text/html').send(errorPage('Could not complete the sign-in handoff.'));
     }
   });
@@ -261,7 +263,7 @@ module.exports = function ssoRoutes() {
         avatar_url: identity.avatar_url,
       });
     } catch (err) {
-      console.error('[platform-identity] POST /sso/token', err);
+      log.error('[platform-identity] POST /sso/token', err);
       return res.fail('token_exchange_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -302,7 +304,7 @@ module.exports = function ssoRoutes() {
       const out = await hubDevice.startHubGithubDevice(client.client_id);
       res.json(out);
     } catch (err) {
-      console.error('[platform-identity] /sso/device/start', err);
+      log.error('[platform-identity] /sso/device/start', err);
       // 424, not 502: Cloudflare replaces origin 5xx bodies with its own page, so a
       // proxied upstream refusal must ride a 4xx to keep its JSON diagnosis readable
       // externally (finding W2, task 1003052 — the core device/start twin).
@@ -345,7 +347,7 @@ module.exports = function ssoRoutes() {
       });
       res.json({ state: 'ok', assertion });
     } catch (err) {
-      console.error('[platform-identity] /sso/device/poll', err);
+      log.error('[platform-identity] /sso/device/poll', err);
       // 424, matching the core device/poll (finding W2, task 1003052): this catch
       // proxies the hub's GitHub poll refusals, and a 5xx body never survives
       // Cloudflare. (The !out.client_id branch above keeps its 500: an internal
@@ -399,7 +401,7 @@ module.exports = function ssoRoutes() {
       await pi.upsertMembership({ clientId: client_id, githubId: github_id, membershipKind }, { pool });
       res.json({ ok: true });
     } catch (err) {
-      console.error('[platform-identity] /sso/membership/check-in', err);
+      log.error('[platform-identity] /sso/membership/check-in', err);
       res.fail('checkin_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -453,7 +455,7 @@ module.exports = function ssoRoutes() {
       }, { pool });
       res.json({ ok: true });
     } catch (err) {
-      console.error('[platform-identity] /sso/activity/rollup', err);
+      log.error('[platform-identity] /sso/activity/rollup', err);
       res.fail('rollup_failed', { status: 500, message: 'internal error' });
     }
   });

package/modules/provisioning/routes/provisioning.js

@@ -34,6 +34,8 @@ const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
+// task 1003208: structured logging (pino via the doorway) — was console.*.
+const log = api.logger('provisioning');
 
 // How long a GitHub-App-Manifest `state` token is valid — the owner must click the
 // pre-filled link + approve on GitHub within this window (task 2080). Comfortably
@@ -144,7 +146,9 @@ code{font-family:"Fira Code",ui-monospace,SFMono-Regular,monospace;background:rg
 // land. Deliberately contains NO backticks and NO ${...} so it survives the outer
 // template literal verbatim; the only server data it reads is the JSON config block
 // written just above it. Fails soft — a poll hiccup just retries; a long wait reveals a
-// manual "open" button rather than ever falsely erroring.
+// manual "open" button rather than ever falsely erroring. The auto-open countdown runs
+// ONLY when this page is the wizard's pop-up; a same-tab return (pop-up blocked) keeps
+// the founder here with the door and a way back to the checklist (task 1003236).
 const CALLBACK_SCRIPT = `
 (function(){
   var cfg=window.__CB_SETUP__||{};
@@ -153,12 +157,18 @@ const CALLBACK_SCRIPT = `
   var target='https://'+domain;
   var pollUrl=location.pathname.replace('/callback','/status')+'?state='+encodeURIComponent(state);
   var steps=document.getElementById('steps'),statusEl=document.getElementById('status');
-  var cta=document.getElementById('cta'),go=document.getElementById('go'),foot=document.getElementById('foot');
+  var cta=document.getElementById('cta'),go=document.getElementById('go'),foot=document.getElementById('foot'),back=document.getElementById('back');
+  /* Opened from the wizard as a pop-up (window.opener alive, or the tab still carries the name the wizard gave it):
+     the checklist is in the other tab, so this one may auto-open the instance. Same-tab fallback (pop-up blocked,
+     form target=_self): this IS the founder's checklist tab — never navigate it away; offer both doors (task 1003236). */
+  var popup=!!window.opener||window.name==='ghAppSetup';
   var finished=false,tries=0,manual=false;
   function dot(n){return steps.querySelector('[data-step="'+n+'"]');}
   function setActive(n){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active','done');if(i<n){el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}else if(i===n){el.classList.add('active');}}}
   function allDone(){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active');el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}}
-  function ready(){if(finished)return;finished=true;allDone();statusEl.textContent='Your instance is ready \\u2014 sign in with GitHub to claim it as owner.';cta.classList.remove('hidden');var n=4;(function tick(){if(n<=0){location.href=target;return;}go.textContent='Opening '+domain+' in '+n+'\\u2026';n--;setTimeout(tick,1000);})();}
+  function ready(){if(finished)return;finished=true;allDone();statusEl.textContent='Your instance is ready \\u2014 sign in with GitHub to claim it as owner.';cta.classList.remove('hidden');
+    if(!popup){go.textContent='Open '+domain+' \\u2192';if(back)back.classList.remove('hidden');if(foot)foot.textContent='Your setup checklist is waiting where you left it \\u2014 finish it first, or open your instance now.';return;}
+    var n=4;(function tick(){if(n<=0){location.href=target;return;}go.textContent='Opening '+domain+' in '+n+'\\u2026';n--;setTimeout(tick,1000);})();}
   function failed(){if(finished)return;finished=true;statusEl.textContent='Setup didn\\u2019t finish. Open your instance page and start the GitHub sign-in setup again.';cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';}
   function revealManual(){if(manual||finished)return;manual=true;cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';if(foot)foot.textContent='This is taking a little longer than usual \\u2014 you can open your instance now, or keep waiting.';}
   function schedule(){if(!finished)setTimeout(poll,3000);}
@@ -195,6 +205,7 @@ function callbackPage({ ok, title, body, state, domain }) {
   </div>
   <p class="status-line" id="status">Hang tight — keep this tab open while we finish.</p>
   <div class="cta hidden" id="cta"><a class="btn" id="go" href="https://${esc(domain)}">Open ${esc(domain)} →</a></div>
+  <p class="muted hidden" id="back"><a href="/projects?view=new">Finish your remaining setup steps →</a></p>
   <p class="muted" id="foot">This page opens <code>${esc(domain)}</code> for you the moment it’s ready.</p>
   <noscript><p class="muted">When setup finishes, open <a href="https://${esc(domain)}">${esc(domain)}</a> and sign in with GitHub — that first sign-in makes you the owner.</p></noscript>
 </main>
@@ -270,7 +281,7 @@ module.exports = function provisioningRoutes() {
       const rows = await provisioning.listAllInstances(pool, { status });
       res.json({ instances: rows.map(fleetInstance) });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/fleet', err);
+      log.error('[provisioning] GET /provisioning/fleet', err);
       res.fail('fleet_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -285,7 +296,7 @@ module.exports = function provisioningRoutes() {
       const out = await provisioning.costLedger(pool, { limit });
       res.json(out);
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/fleet/cost-ledger', err);
+      log.error('[provisioning] GET /provisioning/fleet/cost-ledger', err);
       res.fail('cost_ledger_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -338,7 +349,7 @@ module.exports = function provisioningRoutes() {
       res.json({ ok: true, queued: r.created, action: 'teardown', status: inst.status, superseded: r.superseded,
         message: r.created ? 'The instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
     } catch (err) {
-      console.error('[provisioning] POST /provisioning/instances/:id/force-teardown', err);
+      log.error('[provisioning] POST /provisioning/instances/:id/force-teardown', err);
       res.fail('teardown_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -513,7 +524,7 @@ module.exports = function provisioningRoutes() {
         ...(typeIgnored ? { type_ignored: typeIgnored } : {}),
       });
     } catch (err) {
-      console.error('[provisioning] POST /provisioning/instances', err);
+      log.error('[provisioning] POST /provisioning/instances', err);
       res.fail('request_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -561,7 +572,7 @@ module.exports = function provisioningRoutes() {
       // disclosure this route has no reason to make.
       res.json({ slug, available: reason === null, reason, address: address || null });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/slug-available', err);
+      log.error('[provisioning] GET /provisioning/slug-available', err);
       res.fail('check_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -581,7 +592,7 @@ module.exports = function provisioningRoutes() {
       }
       res.json({ instances });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/instances', err);
+      log.error('[provisioning] GET /provisioning/instances', err);
       res.fail('list_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -613,7 +624,7 @@ module.exports = function provisioningRoutes() {
         open_intent: open ? { action: open.action, state: open.state } : null,
       });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/instances/:id', err);
+      log.error('[provisioning] GET /provisioning/instances/:id', err);
       res.fail('read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -635,7 +646,7 @@ module.exports = function provisioningRoutes() {
       if (instanceAccessDenied(inst, req.builder)) return res.fail('instance_not_found', 404);
       res.json({ ok: true, settings: provisioning.effectiveSettings(inst), options: provisioning.SETTINGS_VOCAB });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/instances/:id/settings', err);
+      log.error('[provisioning] GET /provisioning/instances/:id/settings', err);
       res.fail('settings_read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -670,7 +681,7 @@ module.exports = function provisioningRoutes() {
       }).catch(() => {});
       res.json({ ok: true, settings: provisioning.effectiveSettings(updated) });
     } catch (err) {
-      console.error('[provisioning] PATCH /provisioning/instances/:id/settings', err);
+      log.error('[provisioning] PATCH /provisioning/instances/:id/settings', err);
       res.fail('settings_update_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -707,7 +718,7 @@ module.exports = function provisioningRoutes() {
       res.json({ ok: true, queued: r.created, action: 'teardown', status: inst.status, superseded: r.superseded,
         message: r.created ? 'Your instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
     } catch (err) {
-      console.error('[provisioning] POST /provisioning/instances/:id/teardown', err);
+      log.error('[provisioning] POST /provisioning/instances/:id/teardown', err);
       res.fail('teardown_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -832,7 +843,7 @@ module.exports = function provisioningRoutes() {
           ? 'Your instance is being wired to its new address — this card will show whether it answers.'
           : 'Address recorded — it will be wired when the instance is provisioned.' });
     } catch (err) {
-      console.error('[provisioning] POST /provisioning/instances/:id/domain', err);
+      log.error('[provisioning] POST /provisioning/instances/:id/domain', err);
       res.fail('domain_attach_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -890,7 +901,7 @@ module.exports = function provisioningRoutes() {
         expires_at: expiresAt,
       });
     } catch (err) {
-      console.error('[provisioning] POST /provisioning/instances/:id/github-app', err);
+      log.error('[provisioning] POST /provisioning/instances/:id/github-app', err);
       res.fail('github_app_manifest_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -946,7 +957,7 @@ module.exports = function provisioningRoutes() {
       const ok = await provisioning.isProvisionedHostname(pool, req.query.domain);
       return res.status(ok ? 200 : 404).json({ ok });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/tls-check', err);
+      log.error('[provisioning] GET /provisioning/tls-check', err);
       return res.status(503).json({ ok: false, error: 'check_failed' });
     }
   });
@@ -980,7 +991,7 @@ module.exports = function provisioningRoutes() {
         app_slug: row.app_slug || null,
       });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/github-app/status', err);
+      log.error('[provisioning] GET /provisioning/github-app/status', err);
       return res.status(500).json({ ok: false, error: 'status_check_failed' });
     }
   });
@@ -1030,7 +1041,7 @@ module.exports = function provisioningRoutes() {
         : callbackPage({ ok: true, title: 'GitHub app created',
           body: '<p>Nice — GitHub created the app. We’re placing its credentials on your instance now; this finishes on its own within a few minutes.</p><p class="muted">You can close this tab.</p>' }));
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/github-app/callback', err);
+      log.error('[provisioning] GET /provisioning/github-app/callback', err);
       return sendPage(500, callbackPage({ ok: false, title: 'Something went wrong',
         body: '<p>We couldn’t record GitHub’s response. Try starting the sign-in setup again from your instance’s page.</p>' }));
     }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.336",
+  "version": "1.19.338",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.336",
+      "version": "1.19.338",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.336",
+  "version": "1.19.338",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -488,6 +488,12 @@ const KERNEL_FILES = [
   'src/bongos/goal-scope-check.js',          // goal create-gate scope wall (composes the 3 matchers above; ADR 0086 §3, BV1.R60)
   'src/bongos/secret-box.js',                // AES-256-GCM per-builder secret box
   'src/bongos/pool.js',                      // the singleton Postgres pool accessor
+  // task 1003208: the structured logger is kernel infrastructure in the same sense
+  // the pool is — src/module-api.js hands every module a child of it, so it sits
+  // BELOW the module boundary, not beside a domain. It imports only node built-ins
+  // and pino, so joining the roster costs nothing and buys the import-direction
+  // guarantee on the file every module now logs through.
+  'src/bongos/logger.js',                    // pino + request correlation + ADR 0022 redaction
   'src/bongos/db-kernel.js',                 // the kernel db slice — identity/audit/rank/withTx (BV1.R69)
   'src/bongos/routes/_helpers.js',           // shared request validators the doorway re-exports
   // config / identity (host context a module reads, never hardcodes)

package/src/bongos/auth-admission.js

@@ -29,6 +29,9 @@ const seams = require('../module-seams');
 const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 const { loadIdpConfig } = require('./auth-config.js');
+// task 1003208: structured logging — was console.*. A core file logs through
+// the kernel logger directly; only MODULES go via api.logger (the doorway).
+const log = require('./logger').logger.child({ src: 'auth-admission' });
 
 function membershipKind({ githubLogin } = {}) {
   const fa = firstAdminLogin();
@@ -70,7 +73,7 @@ async function reportMembershipCheckIn({ githubId, githubLogin, displayName, ava
       }),
     });
   } catch (err) {
-    console.log('[auth] hub membership check-in failed (non-blocking):', err.message);
+    log.info('[auth] hub membership check-in failed (non-blocking):', err.message);
   }
 }
 
@@ -107,7 +110,7 @@ async function reportActivityRollup({ builderId, githubId }) {
       }),
     });
   } catch (err) {
-    console.log('[auth] hub activity rollup failed (non-blocking):', err.message);
+    log.info('[auth] hub activity rollup failed (non-blocking):', err.message);
   }
 }
 
@@ -180,7 +183,7 @@ async function webAdmissionStatus(login) {
     // A DB hiccup must not turn the waiting page into a false "you're in".
     // Fail closed on `admitted`; still let a firstAdmin keep polling, since
     // that is the bootstrap window this page exists for.
-    console.error('[auth] webAdmissionStatus', err);
+    log.error('[auth] webAdmissionStatus', err);
     return { admitted: false, expectedSoon: isFirstAdmin };
   }
 
@@ -213,11 +216,11 @@ async function maybeSeatFirstAdmin(builder) {
   try {
     const seated = await seatFirstAdminIfUnclaimed(builder.id, builder.github_login);
     if (seated) {
-      console.log(`[auth] first-admin bootstrap: seated ${builder.github_login} as Archon (configured firstAdmin, no prior Archon).`);
+      log.info(`[auth] first-admin bootstrap: seated ${builder.github_login} as Archon (configured firstAdmin, no prior Archon).`);
       return { ...builder, rank: 'archon' };
     }
   } catch (err) {
-    console.error('[auth] first-admin bootstrap failed (non-fatal):', err.message);
+    log.error('[auth] first-admin bootstrap failed (non-fatal):', err.message);
   }
   return builder;
 }
@@ -246,7 +249,7 @@ async function safeSyncRankRole(builder) {
     await seams.resolveOptional('government.rankSync')
       ?.syncRank(null, { builderId: builder.id, rank: builder.rank });
   } catch (err) {
-    console.error('[auth] rank-role sync failed (non-fatal):', err.message);
+    log.error('[auth] rank-role sync failed (non-fatal):', err.message);
   }
 }