@bongos/core 1.19.352 → 1.19.354

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.352",
-  "core_contract": "1.19.352",
-  "source_commit": "e9a9e6873568180427946951f116e153cdef056f",
+  "core_version": "1.19.354",
+  "core_contract": "1.19.354",
+  "source_commit": "b3914da0290b60c5eb6ce4f3c7c32b6f9ae07e1f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T13:00:42.177Z",
+  "built_at": "2026-08-25T13:13:49.790Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 329,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1857,
-  "tree_sha256": "0a7c5bcf1b690464bce9877959778b5f611f54fedb8a6c7b9c51459d47ad7a04",
+  "tree_sha256": "4765f579b8f7f2e758fb27b63db2088b1dab283f54ada499fcaff84c0c86d920",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "8a03a6a6fa27ca367cef614e2d03bdf8c2363b50e5a11eca3b9e6faa803080f7"
+      "sha256": "f32214ef80ab2e05d032e35da07b84e7300a490001dd39a7f7d0ff1997053836"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1452,7 +1452,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "86c346871a6181f8396b8daa5dcaa59180109a414162389786a23a43b51b93d6"
+      "sha256": "03a8b40f27b4ad5bd8219d4a755eb18c7b925feee465c6d97d3cb1b8c372651f"
     },
     {
       "path": "docs/architecture.md",
@@ -4477,7 +4477,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "862fa78c7272a28cdc644debfd8ec364b80b635e8b9a6f41afb76b93312f27dd"
+      "sha256": "ff156c4c0252240026a5ce98547efa76d585d6f0fd88c5b0b95c5598901865ab"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -4487,7 +4487,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "5e9b3d225f06ab2d92b1f85d0d338ae6fa9aaae31afad92b043172e048455895"
+      "sha256": "026234f2c2c212a7ecc3808380bd3ea0cca81e2efc39c619968c505099830e5c"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -4787,12 +4787,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a82b85a09d4f6e7259d1f11a8468e50b82a94a346f7cada1a1c63e09217d4a81"
+      "sha256": "0e7087b6c93131c62fbe40e9b626df9e4a4ec2719b1de4fc48e428d00a3a7e7b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f371019e624fd7befd3ef764ae4cac6d7f98dc8ba3058a2ed552f361e48c5568"
+      "sha256": "9ef59eab6d6debaa99f34c64cc37bf26ccd2db1dcf08fa89682eb02590da29ca"
     },
     {
       "path": "public-docs/index.html",
@@ -5052,7 +5052,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "6d57b80519977cc23b3da231164e20b645ced2b6bbf97ebd3e64f3f9b393321b"
+      "sha256": "42ddc3ecf96a31919f0e700f2cd0092d8225858c78ef4d231e4b3ac301b5b318"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5797,17 +5797,17 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "bc1b8850038c8aaa8c0cbf2d5d9881f671b7cb959533802bc5d6b23b48ba15bd"
+      "sha256": "c87cccdd63ac6fa6d38771c3ad178e5e919f8bee62ad769b9d127819f84e2750"
     },
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "6fe61c756ca409fd4e7967144cf53a064a7095ab09006f71642d5cac860e93d7"
+      "sha256": "e8a44143883403c2ff8e20107250d63f6d19a14050279e8d675480582e07c555"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "2f9e608632b147602b8e141a0cba2071bf36e27fafadd410b7fea399f448250c"
+      "sha256": "5b4f5edce415dd46db830104eb196de678214730d736ebf3ae26a7671b718c77"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -6652,7 +6652,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7433ae86603ef217160393fd3b36bb847092f0c040473a5bba43a21c14444be1"
+      "sha256": "534d2a2ac4a67829ae4589161a0900ee08b1312d512ef18fb4a136419b465f0d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8542,7 +8542,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "4f8b786e8704b418354d2551d20466e4d9ca705ca7ac39d00cd2dc83e3080032"
+      "sha256": "919caac313f78c8c88e7ecca1a49ff2f1da53e443acda434f0648a9b5215f24d"
     },
     {
       "path": "tests/promote_goal_id.mjs",
@@ -8557,7 +8557,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "304f8d9243512672a706a1e073a4874aec2e24a43cfbed550967db1fd23a16dc"
+      "sha256": "0fc6c6626b43458c2e065322bec5a2ecd87e50a44abd2838d81ff0f0b6abeae7"
     },
     {
       "path": "tests/provisioning_default_domain.mjs",
@@ -8582,7 +8582,7 @@
     {
       "path": "tests/provisioning_settings.mjs",
       "mode": "0000644",
-      "sha256": "a525fdcfa2fde8edd2be3198ca7213b9b6bc43a12f748a718a570b7f993972b6"
+      "sha256": "7b6aa958f626054746e5272113bb314a118073507d5baed65f52cafdc25f7085"
     },
     {
       "path": "tests/provisioning_settings_env.mjs",

package/clients/bongos-client/index.d.ts

@@ -81,7 +81,7 @@ export interface GetProjectsResponse { projects: unknown }
 export interface GetProvisioningFleetResponse { instances: unknown }
 export interface GetProvisioningGithubAppStatusResponse { ok: boolean; status: unknown; ready: unknown; terminal: unknown; domain: unknown; instance_status: unknown; app_slug: unknown }
 export interface GetProvisioningHealthResponse { module: unknown; ok: boolean; coreVersion: unknown }
-export interface GetProvisioningInstancesIdResponse { instance: unknown; open_intent: unknown }
+export interface GetProvisioningInstancesIdResponse { instance: unknown; open_intent: unknown; github_app: unknown }
 export interface GetProvisioningInstancesIdSettingsResponse { ok: boolean; settings: unknown; options: unknown }
 export interface GetProvisioningInstancesResponse { instances: unknown }
 export interface GetProvisioningOnboardPlanResponse { mode: unknown; steps: unknown }

package/docs/api/openapi.json

@@ -14994,11 +14994,13 @@
         "type": "object",
         "properties": {
           "instance": {},
-          "open_intent": {}
+          "open_intent": {},
+          "github_app": {}
         },
         "required": [
           "instance",
-          "open_intent"
+          "open_intent",
+          "github_app"
         ]
       },
       "GetProvisioningInstancesIdSettingsResponse": {

package/modules/provisioning/provisioning.js

@@ -232,6 +232,18 @@ function publicInstance(row) {
   };
 }
 
+// The GitHub-App manifest leg's truth for an instance, as the read surface carries
+// it (task 1003235): the latest attempt's lifecycle status + the App's public slug.
+// Same vocabulary as GET /github-app/status ('pending' | 'code_received' |
+// 'converting' | 'done' | 'error' | 'expired'), so the wizard can seed its
+// `live.manifest` from a plain instance read after a reload, a second tab, or
+// another device — no sessionStorage bridge needed. null = no attempt ever made.
+// PURE: an allow-list projection of the manifest row, never the row itself.
+function publicGithubApp(manifestRow) {
+  if (!manifestRow || !manifestRow.status) return null;
+  return { status: String(manifestRow.status), app_slug: manifestRow.app_slug || null };
+}
+
 // The instance's EFFECTIVE settings: the defaults overlaid with the stored,
 // on-vocabulary keys. An off-vocabulary or unknown stored value falls back to
 // its default rather than leaking into the read surface. PURE.
@@ -812,7 +824,7 @@ module.exports = {
   isValidSlug, costEstimateUsd, publicInstance, normalizeHostname,
   defaultDomainForSlug, isReservedHostname, effectiveSettings,
   // pure — GitHub App Manifest flow (task 2080)
-  githubAppName, buildGithubAppManifest, manifestPostUrl,
+  githubAppName, buildGithubAppManifest, manifestPostUrl, publicGithubApp,
   // data access
   isProvisionedHostname,
   getInstanceById, getInstanceBySlug, getInstanceByDomain, listInstancesForOwner, listAllInstances,

package/modules/provisioning/routes/provisioning.js

@@ -619,9 +619,13 @@ module.exports = function provisioningRoutes() {
         return res.fail('instance_not_found', 404);
       }
       const open = await provisioning.getOpenIntent(pool, id);
+      // The GitHub-App leg's truth rides the same read (task 1003235), so the done
+      // panel recovers it from server state after a reload — not from sessionStorage.
+      const manifest = await provisioning.getLatestOAuthManifestForInstance(pool, id);
       res.json({
         instance: provisioning.publicInstance(inst),
         open_intent: open ? { action: open.action, state: open.state } : null,
+        github_app: provisioning.publicGithubApp(manifest),
       });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id', err);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.352",
+  "version": "1.19.354",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.352",
+      "version": "1.19.354",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.352",
+  "version": "1.19.354",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -3555,6 +3555,18 @@ summary{min-height:24px;padding:3px 0;}
             var inst = data.instance;
             if (inst) inst.open_intent = data.open_intent || null;   /* F22: the strip reads intents */
             if (inst) watchFlow = inst.torn_down_at ? 'revive' : 'standup';
+            /* server-derived manifest truth (task 1003235): a reload, a second tab
+               or another device re-learns the GitHub-App leg from this same read.
+               A live manifest poll owns live.manifest while it runs, so the seed
+               yields to it. */
+            var ga = data.github_app;
+            if (ga && ga.status && !manifestPollTimer) {
+              var seeded = ga.status === 'done' ? 'done' : ga.status;
+              var seedChanged = seeded !== live.manifest || (!!ga.app_slug && ga.app_slug !== live.appSlug);
+              if (ga.app_slug) live.appSlug = ga.app_slug;
+              live.manifest = seeded;
+              if (seedChanged) { rememberManifest(undefined, live.manifest, live.appSlug || undefined); renderSteps(); }
+            }
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
                5s tick never clobbers an open dropdown or mid-flight button) */

package/scripts/gds/provision-repo.js

@@ -323,6 +323,18 @@ function alreadyScaffolded(root, mode, { fsImpl = fs } = {}) {
 //
 // Idempotent (see alreadyScaffolded) and dry-run safe (every mutation goes through the
 // injected exec/writeFile). ADR 0108 / 0121 / 0125.
+// The signed-in builder who owns the instance — the founding firstAdmin. Best-effort:
+// no db, no row, or a query error → null, and callers fall back to the repo owner in
+// target_ref. Shared by the scaffold's branding.firstAdmin and web.env's
+// <prefix>_FIRST_ADMIN (task 1003240) so the two can never disagree.
+async function ownerLoginOf(inst, db) {
+  if (!inst || !inst.owner_builder_id || !db || typeof db.query !== 'function') return null;
+  try {
+    const r = await db.query('SELECT github_login FROM builders WHERE id = $1', [inst.owner_builder_id]);
+    return r && r.rows && r.rows[0] && r.rows[0].github_login ? r.rows[0].github_login : null;
+  } catch { return null; }
+}
+
 async function scaffoldStandaloneRepo(inst, deps) {
   // The scaffold BUILDS + pushes the instance's repo (git clone, package-core,
   // `bongos init`, git push) — control-plane work that needs the packaging tools +
@@ -352,13 +364,7 @@ async function scaffoldStandaloneRepo(inst, deps) {
     : `  [scaffold] ${repo.owner}/${repo.name} → ${root} (clone → materialize → pin core ${coreV} → commit → push)`);
 
   // Owner login = the founding firstAdmin. Best-effort; the spec falls back to the repo owner.
-  let ownerLogin = null;
-  if (inst.owner_builder_id && db) {
-    try {
-      const r = await db.query('SELECT github_login FROM builders WHERE id = $1', [inst.owner_builder_id]);
-      ownerLogin = r && r.rows && r.rows[0] ? r.rows[0].github_login : null;
-    } catch { /* fall back to the repo owner */ }
-  }
+  const ownerLogin = await ownerLoginOf(inst, db);
 
   // Resolve the instance owner's OAuth token BEFORE any git network op.
   //
@@ -820,6 +826,7 @@ module.exports = {
   CORE_PKG_DIR,
   INSTANCE_GITIGNORE,
   alreadyScaffolded,
+  ownerLoginOf,
   asPostgres,
   buildCorePinRefreshCommit,
   dbCreateCmd,

package/scripts/gds/provision-units.js

@@ -153,7 +153,7 @@ function provisionedEnvPrefix() {
 // the hall on this host + OAuth uses the real callback origin — without them the pack
 // stays at neutral localhost and the hall never loads (task 1972). No domain yet
 // (bring-your-own deferred, ADR 0111 §4) ⇒ origins stay neutral until one is set.
-function webEnvBody(inst, { clientId = '', clientSecret = '', appId = null, appPem = null, federation = null } = {}) {
+function webEnvBody(inst, { clientId = '', clientSecret = '', appId = null, appPem = null, federation = null, ownerLogin = null } = {}) {
   const prefix = provisionedEnvPrefix(), { settingsEnvLines } = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
   const origin = inst.domain ? `https://${inst.domain}` : '';
   const originLines = origin
@@ -191,12 +191,12 @@ ${prefix}_OAUTH_ORIGIN=${origin}
   // demo had every origin override but no FIRST_ADMIN, so the owner could not be seated).
   // Derived from the instance repo owner (target_ref = "<owner>/<repo>"), the SAME source
   // instanceInitSpec uses for the scaffold's branding.firstAdmin — so this env override and
-  // the scaffolded config/branding.json agree. (Org-owned repo: the org login is not a
-  // sign-in identity, so it is left unset; the owner sets <prefix>_FIRST_ADMIN by hand.)
+  // the scaffolded config/branding.json agree — and, like the spec, PREFERS the signed-in
+  // builder's login when the caller resolved one (ownerLoginOf). An org-owned repo's
+  // owner is the org, which is not a sign-in identity: seating it seats nobody (task 1003240).
   const ownerRepo = parseTargetRef(inst.target_ref);
-  const firstAdminLine = ownerRepo && ownerRepo.owner
-    ? `${prefix}_FIRST_ADMIN=${ownerRepo.owner}\n`
-    : '';
+  const firstAdmin = ownerLogin || (ownerRepo && ownerRepo.owner) || null;
+  const firstAdminLine = firstAdmin ? `${prefix}_FIRST_ADMIN=${firstAdmin}\n` : '';
   // Cross-site identity federation block (ADR 0141 §4, task #1002109). Present only for
   // a HOSTED (federated) instance: flips auth.idp ON via the env override branding.js
   // reads (idpEnabled), and carries the hub origin, this instance's per-client secret

package/scripts/gds/provision.js

@@ -50,7 +50,7 @@ const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
-const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
+const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, serviceUnit, serviceUnitPath, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, shouldFederate, zoneForDomain } = require('./provision-net.js');
 
@@ -381,7 +381,7 @@ async function provisionInstance(inst, deps) {
 
   // ── step 3: config + per-instance secrets ─────────────────────────────────
   log('  [config] per-instance web.env');
-  if (local) boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation }), { mode: 0o600, sudo: true });
+  if (local) boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation, ownerLogin: await ownerLoginOf(inst, deps.db) }), { mode: 0o600, sudo: true });
   else log('    (baked into cloud-init)');
 
   // ── step 4: systemd unit + enable ─────────────────────────────────────────
@@ -588,7 +588,7 @@ async function domainAttachInstance(inst, deps) {
     : CONFIG.publicIp;
 
   log('  [config] re-write per-instance web.env (origins now carry the domain)');
-  boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation: null }), { mode: 0o600, sudo: true });
+  boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation: null, ownerLogin: await ownerLoginOf(inst, deps.db) }), { mode: 0o600, sudo: true });
   log('  [service] restart to pick up the new origins');
   boxExec(`${sudoP}systemctl restart ${inst.slug}`);
 
@@ -790,7 +790,7 @@ async function placeManifestCreds(inst, mrow, deps) {
   //    writeFile logs only a byte count; the value is base64/temp-file placed).
   log(`  [oauth-manifest] place creds in ${webEnvPath(inst)} + restart ${inst.slug}`);
   boxWriteFile(webEnvPath(inst), webEnvBody(inst, {
-    clientId: creds.clientId, clientSecret: creds.clientSecret,
+    clientId: creds.clientId, clientSecret: creds.clientSecret, ownerLogin: await ownerLoginOf(inst, deps.db),
     // The App id + private key double as the ADR 0055 publish credential (task
     // 1003049); older Apps (pre-permission manifests) return a pem too — placing
     // it is harmless and heals once the owner grants the permissions + installs.

package/src/module-api.js

@@ -1134,8 +1134,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.350 with no explicit bump. run 32850120472. (task 1002620)
 //   1.19.352 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.351 with no explicit bump. run 32850767673. (task 1002620)
+//   1.19.353 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.352 with no explicit bump. run 32851392269. (task 1002620)
+//   1.19.354 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.353 with no explicit bump. run 32852045058. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.352'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.354'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub_pre_uat.mjs

@@ -484,3 +484,17 @@ test('control nits: orb cursor, caret under reduced motion, mode label, home lab
   assert.match(HUB, /\.again\{[^}]*padding:6px 2px;min-height:24px;/);
   assert.match(HUB, /\nsummary\{min-height:24px;padding:3px 0;\}/, 'every fold is a 24px target; the disclosure marker stays');
 });
+
+/* ── server-derived manifest truth (task 1003235) ── */
+test('the done panel re-learns the GitHub-App leg from the instance read, yielding to a live manifest poll', () => {
+  /* the seed lives in startProgress's nested tick(), past where fn() stops — read the script */
+  const sp = SCRIPT.slice(SCRIPT.indexOf('function startProgress('));
+  assert.match(sp, /var ga = data\.github_app;\n\s*if \(ga && ga\.status && !manifestPollTimer\) \{/, 'seeded from the same 5s read; a running manifest poll owns live.manifest');
+  assert.match(sp, /var seeded = ga\.status === 'done' \? 'done' : ga\.status;/, 'the status route’s vocabulary, verbatim');
+  assert.match(sp, /if \(ga\.app_slug\) live\.appSlug = ga\.app_slug;\n\s*live\.manifest = seeded;/);
+  assert.match(sp, /if \(seedChanged\) \{ rememberManifest\(undefined, live\.manifest, live\.appSlug \|\| undefined\); renderSteps\(\); \}/, 'change-only: an identical tick neither rewrites the bridge nor re-renders');
+  const seedAt = sp.indexOf('var ga = data.github_app;');
+  const statusAt = sp.indexOf("if (inst && inst.status !== live.instStatus)");
+  assert.ok(seedAt > 0 && seedAt < statusAt, 'the manifest seed lands before the status re-render, so one renderSteps() paints both');
+  assert.match(fn('enter'), /if \(created\.manifest\) \{ live\.manifest = created\.manifest; live\.appSlug = created\.app_slug \|\| null; \}/, 'the sessionStorage bridge stays as the pre-first-tick seed');
+});

package/tests/provision.mjs

@@ -238,6 +238,17 @@ t('webEnvBody: the repo target_ref seats the founding owner via <prefix>_FIRST_A
   assert.doesNotMatch(P.webEnvBody(coTenant), /_FIRST_ADMIN=/);
 });
 
+t('webEnvBody: a resolved owner login wins over the repo owner — an org-owned repo seats the signed-in builder (task 1003240)', () => {
+  // The org that owns an adopted repo is not a sign-in identity; seating it seats nobody.
+  // Same preference instanceInitSpec already applies to the scaffold's branding.firstAdmin.
+  const inst = { ...coTenant, hosting_shape: 'standalone', domain: 'mercury.example.com', target_ref: 'acme-org/mercury' };
+  const withLogin = P.webEnvBody(inst, { ownerLogin: 'octocat' });
+  assert.match(withLogin, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_FIRST_ADMIN=octocat`));
+  assert.doesNotMatch(withLogin, /_FIRST_ADMIN=acme-org/);
+  // no resolved login → the repo owner stays the fallback (a personal repo's owner IS the builder)
+  assert.match(P.webEnvBody(inst), new RegExp(`${reEsc(NEUTRAL_PREFIX)}_FIRST_ADMIN=acme-org`));
+});
+
 t('caddyBlock: a domain → on-demand-TLS reverse_proxy to the local port; no domain → a comment', () => {
   const withDomain = P.caddyBlock({ ...coTenant, domain: 'mercury.example.com' });
   assert.match(withDomain, /mercury\.example\.com \{/);
@@ -408,6 +419,21 @@ await ta('provisionInstance(standalone): the backup unit ExecStart points at the
   assert.match(svc, /Environment=GDS_BACKUP_DB=mercury/);
 });
 
+await ta('provisionInstance(standalone): web.env seats the signed-in builder, not the org that owns the repo (task 1003240)', async () => {
+  const { deps } = recorder();
+  const bodies = {};
+  deps.writeFile = (p, body) => { bodies[p] = body; return { ok: true }; };
+  // the builders lookup answers with the signed-in owner; every other query stays empty
+  deps.db = { query: async (sql) => (/FROM builders/.test(String(sql)) ? { rows: [{ github_login: 'octocat' }] } : { rows: [] }) };
+  const inst = { ...coTenant, hosting_shape: 'standalone', target_ref: 'acme-org/mercury', owner_builder_id: 7 };
+  const r = await P.provisionInstance(inst, deps);
+  assert.equal(r.ok, true);
+  const envPath = Object.keys(bodies).find((p) => p.endsWith('/web.env'));
+  assert.ok(envPath, 'wrote web.env');
+  assert.match(bodies[envPath], new RegExp(`${reEsc(NEUTRAL_PREFIX)}_FIRST_ADMIN=octocat`));
+  assert.doesNotMatch(bodies[envPath], /_FIRST_ADMIN=acme-org/);
+});
+
 await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + npm ci) + migrates from the instance root', async () => {
   const { deps, cmds, writes } = recorder();
   const r = await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'lars589/mercury' }, deps);

package/tests/provisioning_settings.mjs

@@ -42,6 +42,8 @@ provisioning.updateInstanceSettings = async (_db, id, patch) => {
 };
 provisioning.recordEvent = async (_db, e) => { events.push(e); };
 provisioning.getOpenIntent = async () => null;
+let manifest = null;            // the latest manifest attempt the read surfaces (task 1003235)
+provisioning.getLatestOAuthManifestForInstance = async () => manifest;
 
 const api = require('../src/module-api.js');
 let builder = { id: 7, github_login: 'owner', rank: 'thetes' };
@@ -106,6 +108,31 @@ await ta('owner reads their own instance', async () => {
   assert.equal(r.body.instance.slug, 'spike');
 });
 
+await ta('the read carries the GitHub-App leg\'s truth — github_app {status, app_slug} from the latest manifest attempt (task 1003235)', async () => {
+  reset();
+  manifest = { id: 3, instance_id: 18, status: 'done', app_slug: 'spike-bongos', github_code: 'never-surfaced', state: 'never-surfaced' };
+  const r = await get('/provisioning/instances/18');
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.github_app, { status: 'done', app_slug: 'spike-bongos' }, 'an allow-list projection — the code and the state token never ride the read');
+  assert.equal(r.body.instance.slug, 'spike', 'the instance projection is untouched');
+});
+
+await ta('no manifest attempt yet → github_app is null, not absent (a reload can tell "never started" from "unknown")', async () => {
+  reset();
+  manifest = null;
+  const r = await get('/provisioning/instances/18');
+  assert.equal(r.status, 200, r.raw);
+  assert.ok('github_app' in r.body, 'the key is always present');
+  assert.equal(r.body.github_app, null);
+});
+
+await ta('publicGithubApp is a pure allow-list projection with the status route\'s vocabulary', async () => {
+  assert.equal(provisioning.publicGithubApp(null), null);
+  assert.equal(provisioning.publicGithubApp({ app_slug: 'x' }), null, 'a row with no status is no truth');
+  assert.deepEqual(provisioning.publicGithubApp({ status: 'pending', github_code: 'secret' }), { status: 'pending', app_slug: null });
+  assert.deepEqual(provisioning.publicGithubApp({ status: 'code_received', app_slug: 'mercury-bongos' }), { status: 'code_received', app_slug: 'mercury-bongos' });
+});
+
 await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {
   reset({ as: { id: 8, github_login: 'stranger', rank: 'thetes' } });
   const r = await get('/provisioning/instances/18');