@bongos/core 1.19.352 → 1.19.353

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.352",
-  "core_contract": "1.19.352",
-  "source_commit": "e9a9e6873568180427946951f116e153cdef056f",
+  "core_version": "1.19.353",
+  "core_contract": "1.19.353",
+  "source_commit": "5bb1f8185d48f3d3d53181f4525eca45b0cef665",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T13:00:42.177Z",
+  "built_at": "2026-08-25T13:07:06.857Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 329,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1857,
-  "tree_sha256": "0a7c5bcf1b690464bce9877959778b5f611f54fedb8a6c7b9c51459d47ad7a04",
+  "tree_sha256": "3b39dee80eea8539fc0a7b82684369a69c58b09c426cac168f029815bc78270e",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4787,12 +4787,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a82b85a09d4f6e7259d1f11a8468e50b82a94a346f7cada1a1c63e09217d4a81"
+      "sha256": "0b1bb5323c63aefbe9f58e5bd5eba8cfed791c5089bf5dbae18fde4055c31299"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f371019e624fd7befd3ef764ae4cac6d7f98dc8ba3058a2ed552f361e48c5568"
+      "sha256": "c524de81eaba481839a9515c321c48d231506f677459d76c495bb51ebfd8b90c"
     },
     {
       "path": "public-docs/index.html",
@@ -5797,17 +5797,17 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "bc1b8850038c8aaa8c0cbf2d5d9881f671b7cb959533802bc5d6b23b48ba15bd"
+      "sha256": "c87cccdd63ac6fa6d38771c3ad178e5e919f8bee62ad769b9d127819f84e2750"
     },
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "6fe61c756ca409fd4e7967144cf53a064a7095ab09006f71642d5cac860e93d7"
+      "sha256": "e8a44143883403c2ff8e20107250d63f6d19a14050279e8d675480582e07c555"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "2f9e608632b147602b8e141a0cba2071bf36e27fafadd410b7fea399f448250c"
+      "sha256": "5b4f5edce415dd46db830104eb196de678214730d736ebf3ae26a7671b718c77"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -6652,7 +6652,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7433ae86603ef217160393fd3b36bb847092f0c040473a5bba43a21c14444be1"
+      "sha256": "82bd181f16c9ee484e55c879439a7f61ff056588080a57bd95a3881d89b726f3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8557,7 +8557,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "304f8d9243512672a706a1e073a4874aec2e24a43cfbed550967db1fd23a16dc"
+      "sha256": "0fc6c6626b43458c2e065322bec5a2ecd87e50a44abd2838d81ff0f0b6abeae7"
     },
     {
       "path": "tests/provisioning_default_domain.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.352",
+  "version": "1.19.353",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.352",
+      "version": "1.19.353",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.352",
+  "version": "1.19.353",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-repo.js

@@ -323,6 +323,18 @@ function alreadyScaffolded(root, mode, { fsImpl = fs } = {}) {
 //
 // Idempotent (see alreadyScaffolded) and dry-run safe (every mutation goes through the
 // injected exec/writeFile). ADR 0108 / 0121 / 0125.
+// The signed-in builder who owns the instance — the founding firstAdmin. Best-effort:
+// no db, no row, or a query error → null, and callers fall back to the repo owner in
+// target_ref. Shared by the scaffold's branding.firstAdmin and web.env's
+// <prefix>_FIRST_ADMIN (task 1003240) so the two can never disagree.
+async function ownerLoginOf(inst, db) {
+  if (!inst || !inst.owner_builder_id || !db || typeof db.query !== 'function') return null;
+  try {
+    const r = await db.query('SELECT github_login FROM builders WHERE id = $1', [inst.owner_builder_id]);
+    return r && r.rows && r.rows[0] && r.rows[0].github_login ? r.rows[0].github_login : null;
+  } catch { return null; }
+}
+
 async function scaffoldStandaloneRepo(inst, deps) {
   // The scaffold BUILDS + pushes the instance's repo (git clone, package-core,
   // `bongos init`, git push) — control-plane work that needs the packaging tools +
@@ -352,13 +364,7 @@ async function scaffoldStandaloneRepo(inst, deps) {
     : `  [scaffold] ${repo.owner}/${repo.name} → ${root} (clone → materialize → pin core ${coreV} → commit → push)`);
 
   // Owner login = the founding firstAdmin. Best-effort; the spec falls back to the repo owner.
-  let ownerLogin = null;
-  if (inst.owner_builder_id && db) {
-    try {
-      const r = await db.query('SELECT github_login FROM builders WHERE id = $1', [inst.owner_builder_id]);
-      ownerLogin = r && r.rows && r.rows[0] ? r.rows[0].github_login : null;
-    } catch { /* fall back to the repo owner */ }
-  }
+  const ownerLogin = await ownerLoginOf(inst, db);
 
   // Resolve the instance owner's OAuth token BEFORE any git network op.
   //
@@ -820,6 +826,7 @@ module.exports = {
   CORE_PKG_DIR,
   INSTANCE_GITIGNORE,
   alreadyScaffolded,
+  ownerLoginOf,
   asPostgres,
   buildCorePinRefreshCommit,
   dbCreateCmd,

package/scripts/gds/provision-units.js

@@ -153,7 +153,7 @@ function provisionedEnvPrefix() {
 // the hall on this host + OAuth uses the real callback origin — without them the pack
 // stays at neutral localhost and the hall never loads (task 1972). No domain yet
 // (bring-your-own deferred, ADR 0111 §4) ⇒ origins stay neutral until one is set.
-function webEnvBody(inst, { clientId = '', clientSecret = '', appId = null, appPem = null, federation = null } = {}) {
+function webEnvBody(inst, { clientId = '', clientSecret = '', appId = null, appPem = null, federation = null, ownerLogin = null } = {}) {
   const prefix = provisionedEnvPrefix(), { settingsEnvLines } = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
   const origin = inst.domain ? `https://${inst.domain}` : '';
   const originLines = origin
@@ -191,12 +191,12 @@ ${prefix}_OAUTH_ORIGIN=${origin}
   // demo had every origin override but no FIRST_ADMIN, so the owner could not be seated).
   // Derived from the instance repo owner (target_ref = "<owner>/<repo>"), the SAME source
   // instanceInitSpec uses for the scaffold's branding.firstAdmin — so this env override and
-  // the scaffolded config/branding.json agree. (Org-owned repo: the org login is not a
-  // sign-in identity, so it is left unset; the owner sets <prefix>_FIRST_ADMIN by hand.)
+  // the scaffolded config/branding.json agree — and, like the spec, PREFERS the signed-in
+  // builder's login when the caller resolved one (ownerLoginOf). An org-owned repo's
+  // owner is the org, which is not a sign-in identity: seating it seats nobody (task 1003240).
   const ownerRepo = parseTargetRef(inst.target_ref);
-  const firstAdminLine = ownerRepo && ownerRepo.owner
-    ? `${prefix}_FIRST_ADMIN=${ownerRepo.owner}\n`
-    : '';
+  const firstAdmin = ownerLogin || (ownerRepo && ownerRepo.owner) || null;
+  const firstAdminLine = firstAdmin ? `${prefix}_FIRST_ADMIN=${firstAdmin}\n` : '';
   // Cross-site identity federation block (ADR 0141 §4, task #1002109). Present only for
   // a HOSTED (federated) instance: flips auth.idp ON via the env override branding.js
   // reads (idpEnabled), and carries the hub origin, this instance's per-client secret

package/scripts/gds/provision.js

@@ -50,7 +50,7 @@ const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
-const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
+const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, serviceUnit, serviceUnitPath, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, shouldFederate, zoneForDomain } = require('./provision-net.js');
 
@@ -381,7 +381,7 @@ async function provisionInstance(inst, deps) {
 
   // ── step 3: config + per-instance secrets ─────────────────────────────────
   log('  [config] per-instance web.env');
-  if (local) boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation }), { mode: 0o600, sudo: true });
+  if (local) boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation, ownerLogin: await ownerLoginOf(inst, deps.db) }), { mode: 0o600, sudo: true });
   else log('    (baked into cloud-init)');
 
   // ── step 4: systemd unit + enable ─────────────────────────────────────────
@@ -588,7 +588,7 @@ async function domainAttachInstance(inst, deps) {
     : CONFIG.publicIp;
 
   log('  [config] re-write per-instance web.env (origins now carry the domain)');
-  boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation: null }), { mode: 0o600, sudo: true });
+  boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation: null, ownerLogin: await ownerLoginOf(inst, deps.db) }), { mode: 0o600, sudo: true });
   log('  [service] restart to pick up the new origins');
   boxExec(`${sudoP}systemctl restart ${inst.slug}`);
 
@@ -790,7 +790,7 @@ async function placeManifestCreds(inst, mrow, deps) {
   //    writeFile logs only a byte count; the value is base64/temp-file placed).
   log(`  [oauth-manifest] place creds in ${webEnvPath(inst)} + restart ${inst.slug}`);
   boxWriteFile(webEnvPath(inst), webEnvBody(inst, {
-    clientId: creds.clientId, clientSecret: creds.clientSecret,
+    clientId: creds.clientId, clientSecret: creds.clientSecret, ownerLogin: await ownerLoginOf(inst, deps.db),
     // The App id + private key double as the ADR 0055 publish credential (task
     // 1003049); older Apps (pre-permission manifests) return a pem too — placing
     // it is harmless and heals once the owner grants the permissions + installs.

package/src/module-api.js

@@ -1134,8 +1134,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.350 with no explicit bump. run 32850120472. (task 1002620)
 //   1.19.352 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.351 with no explicit bump. run 32850767673. (task 1002620)
+//   1.19.353 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.352 with no explicit bump. run 32851392269. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.352'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.353'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provision.mjs

@@ -238,6 +238,17 @@ t('webEnvBody: the repo target_ref seats the founding owner via <prefix>_FIRST_A
   assert.doesNotMatch(P.webEnvBody(coTenant), /_FIRST_ADMIN=/);
 });
 
+t('webEnvBody: a resolved owner login wins over the repo owner — an org-owned repo seats the signed-in builder (task 1003240)', () => {
+  // The org that owns an adopted repo is not a sign-in identity; seating it seats nobody.
+  // Same preference instanceInitSpec already applies to the scaffold's branding.firstAdmin.
+  const inst = { ...coTenant, hosting_shape: 'standalone', domain: 'mercury.example.com', target_ref: 'acme-org/mercury' };
+  const withLogin = P.webEnvBody(inst, { ownerLogin: 'octocat' });
+  assert.match(withLogin, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_FIRST_ADMIN=octocat`));
+  assert.doesNotMatch(withLogin, /_FIRST_ADMIN=acme-org/);
+  // no resolved login → the repo owner stays the fallback (a personal repo's owner IS the builder)
+  assert.match(P.webEnvBody(inst), new RegExp(`${reEsc(NEUTRAL_PREFIX)}_FIRST_ADMIN=acme-org`));
+});
+
 t('caddyBlock: a domain → on-demand-TLS reverse_proxy to the local port; no domain → a comment', () => {
   const withDomain = P.caddyBlock({ ...coTenant, domain: 'mercury.example.com' });
   assert.match(withDomain, /mercury\.example\.com \{/);
@@ -408,6 +419,21 @@ await ta('provisionInstance(standalone): the backup unit ExecStart points at the
   assert.match(svc, /Environment=GDS_BACKUP_DB=mercury/);
 });
 
+await ta('provisionInstance(standalone): web.env seats the signed-in builder, not the org that owns the repo (task 1003240)', async () => {
+  const { deps } = recorder();
+  const bodies = {};
+  deps.writeFile = (p, body) => { bodies[p] = body; return { ok: true }; };
+  // the builders lookup answers with the signed-in owner; every other query stays empty
+  deps.db = { query: async (sql) => (/FROM builders/.test(String(sql)) ? { rows: [{ github_login: 'octocat' }] } : { rows: [] }) };
+  const inst = { ...coTenant, hosting_shape: 'standalone', target_ref: 'acme-org/mercury', owner_builder_id: 7 };
+  const r = await P.provisionInstance(inst, deps);
+  assert.equal(r.ok, true);
+  const envPath = Object.keys(bodies).find((p) => p.endsWith('/web.env'));
+  assert.ok(envPath, 'wrote web.env');
+  assert.match(bodies[envPath], new RegExp(`${reEsc(NEUTRAL_PREFIX)}_FIRST_ADMIN=octocat`));
+  assert.doesNotMatch(bodies[envPath], /_FIRST_ADMIN=acme-org/);
+});
+
 await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + npm ci) + migrates from the instance root', async () => {
   const { deps, cmds, writes } = recorder();
   const r = await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'lars589/mercury' }, deps);