@bongos/core 1.19.376 → 1.19.378

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.376",
-  "core_contract": "1.19.376",
-  "source_commit": "a431d7ef6e3018eeb8b16fbf2616b7b99ec4d5d5",
+  "core_version": "1.19.378",
+  "core_contract": "1.19.378",
+  "source_commit": "71bcea42aeb104d9931a45ea2fdc5b1816bead92",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T23:21:03.279Z",
+  "built_at": "2026-08-27T00:03:57.043Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 335,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1557,
+    "functional_verbatim": 1565,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1914,
-  "tree_sha256": "6c7b5981caac40dce57dfecbee01587f18c3b4e5b4cb8fa65ebde70c9869ef53",
+  "file_count": 1922,
+  "tree_sha256": "0a04e3d05efdc0ba120a60c0d163afc0c7ac5075cf143d082d047fe6c56fcd16",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "28f456a1b259b898b4bfc0d353c9877b5f10828beae478c2ee6aa1a66e64c33a"
+      "sha256": "e9a6dd8d60741347814d184016bb3eaae1b319ba299121e7a39a55367bc12e56"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1477,12 +1477,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "96e9749fd1a6061c3ae96edf1da81a42fc6f89144bca6844870e5abcc7aeb7fe"
+      "sha256": "1d40e3666f05b4b28d7b9433e84c0ae4bfccc907660053006694814799365bf0"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "a743ea7c9fbe29419a6efc5978472c8fa27da2178eef34edbc988574990733f8"
+      "sha256": "57b66bbfe0c1d7aa8274a43d813c77c83986a3e4cf43046e9e0a637ac4fe308d"
     },
     {
       "path": "docs/architecture.md",
@@ -4077,7 +4077,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "94b785f970615056c9c3e896009868ef762fe78ab9f640889b9286ccef46fcf0"
+      "sha256": "745663b0a264ae742702919fc9486f49723010dd797e1fe7151de5d65b98bf21"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -4087,7 +4087,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "70448ebd079d5167bcf0c9c2b4473d46e996a54202f09f5a8ebc30980aba4166"
+      "sha256": "b7f0d36dc13ebad0206b94879262e661e6c2524539732f31e7cec25f61fd9fd6"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -4154,6 +4154,16 @@
       "mode": "0000644",
       "sha256": "0027e5e8a3b718a16dcae5ad4387b4773525d429944e712228fbd38a5335e23a"
     },
+    {
+      "path": "modules/lifecycle/kickoff-checklist.js",
+      "mode": "0000644",
+      "sha256": "829dd13fb87033dba1db8d3003a0359e1be8bb97198df419edb2617558bfd984"
+    },
+    {
+      "path": "modules/lifecycle/kickoff-seed.js",
+      "mode": "0000644",
+      "sha256": "f26a507ea55169df9f4841edb2347610f3dea9b7eac729c034c038a0edd1c7af"
+    },
     {
       "path": "modules/lifecycle/lifecycle.js",
       "mode": "0000644",
@@ -4187,7 +4197,7 @@
     {
       "path": "modules/lifecycle/module.json",
       "mode": "0000644",
-      "sha256": "30653b4064be8933894679ac4e272711edcc629e151d87017e2b2e45be96d78f"
+      "sha256": "401e4121a3f335ae0ae532b6b7ccff63e668b3a53520a0ff3f0d1a4223b02020"
     },
     {
       "path": "modules/lifecycle/pollers/publish-reconciler.js",
@@ -4244,6 +4254,11 @@
       "mode": "0000644",
       "sha256": "0e9430101ce99d0a84f1893d13bcf1434af13325c2ce531e693b6bce42cb9385"
     },
+    {
+      "path": "modules/lifecycle/routes/kickoff-seed.js",
+      "mode": "0000644",
+      "sha256": "f5090caaf0d0f32feff5bf4263e65ecf831ad6fd10ae5b053788c987e1a86399"
+    },
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
       "mode": "0000644",
@@ -4262,7 +4277,7 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "4ef343018b69528ab9518683ba0c6878bfcf5b9398ee7a2ade21780c20218538"
+      "sha256": "10313e3a6bd619fe2cf5cd691927032914fcb25d52ba743e8ae16d51d8d97d5c"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
@@ -4927,12 +4942,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0cdd9747593cc2fb83327041cf2d869234271cf7e3dcc7ecfb626c43ed262155"
+      "sha256": "f96269625487590e9dc70bff805db37a0f00592178fc6614f6c82b4610ec3c0d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "00ff5e9289bc25cc0e6d1a7226259b52b906eaf887c9dd417067d41193877d7c"
+      "sha256": "40e93caa20eab8a0602a3fe4a1073e63aca106888f5afcbe28627200e17d84f6"
     },
     {
       "path": "public-docs/index.html",
@@ -5627,7 +5642,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "95f116e70ba6d6e890705ff862a5c5011002c42a58ba60553c50ec2d656dcf3b"
+      "sha256": "4dec7f6bee219ca3c11dbf5b9c3380de286264a66830fd8e2d37018a989eb83e"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5747,7 +5762,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "bde86f3f65cdd4a1ad0e143c58f6517328dd7cdee7c1194c0fa614aaf9df56f6"
+      "sha256": "280197b62032374c11824c4f97ec713725e28e2b57cfd6c8aa42d493b02c4ed7"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -6399,6 +6414,11 @@
       "mode": "0000644",
       "sha256": "88b9b721b3911957b13aa5e8023e6d41534e34afd4bbc70f40435efc52e2017b"
     },
+    {
+      "path": "scripts/gds/test-path-guard.js",
+      "mode": "0000644",
+      "sha256": "d3e542cf977f9aadad8f856defa6d809f3604e184cd261fbee7738aa1da736ea"
+    },
     {
       "path": "scripts/gds/triage.js",
       "mode": "0000644",
@@ -6542,7 +6562,7 @@
     {
       "path": "src/bongos/auth-admission.js",
       "mode": "0000644",
-      "sha256": "0d2e4aaf4b99ac4b1122c182f279ae622f53d8896baa31d796c5bb0f4ef6532c"
+      "sha256": "9978b10e2e675b6f7c1211dd74c8cf302395b2f47062eba5df376203ee77d341"
     },
     {
       "path": "src/bongos/auth-config.js",
@@ -6817,7 +6837,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "94c29ffd7acffe072f72060e6bf7deb322031a3521e935f77f4069cf7da1a699"
+      "sha256": "f291431298b7e0b6369f71f944d87c5fcf67a651da063a6a7af0f4935d99e33a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7694,6 +7714,11 @@
       "mode": "0000644",
       "sha256": "5466ddf0b7e0298206d46da7b84cfd3826e0f549395088bf5ed91397d15f1746"
     },
+    {
+      "path": "tests/first_admin_kickoff_seed.mjs",
+      "mode": "0000644",
+      "sha256": "8006f4696e6bae21b84c9e8ec25cb7a7d34c5899f187d2ac59b2a6dcbb6f92d1"
+    },
     {
       "path": "tests/first_run_engine_check.mjs",
       "mode": "0000644",
@@ -8374,6 +8399,16 @@
       "mode": "0000644",
       "sha256": "db9ad86df4c9593db89f91ef2306c30eb33ae56bebe5b210a4b3a1912f67d42c"
     },
+    {
+      "path": "tests/kickoff_checklist.mjs",
+      "mode": "0000644",
+      "sha256": "d0849053675cb4705fe6774b1a8ac6b3edb5b43a758775446fad257be6cb9ba3"
+    },
+    {
+      "path": "tests/kickoff_seed.mjs",
+      "mode": "0000644",
+      "sha256": "416d413757a13fbddb5841ea8a2c503077d7e6067bc1c58ce1f4d416b8d8487f"
+    },
     {
       "path": "tests/known_failing_ratchet.mjs",
       "mode": "0000644",
@@ -8497,7 +8532,7 @@
     {
       "path": "tests/migration_allocation.mjs",
       "mode": "0000644",
-      "sha256": "7b0e40f4b3e348a45ccdc543dd1f3dfd78113ae86348823001e4eabb78f126de"
+      "sha256": "e2f03570b76b4d5af7af3c87a2a4989827eb71d1b50c92ab546a456e85c4024e"
     },
     {
       "path": "tests/migration_namespace.mjs",
@@ -8832,7 +8867,7 @@
     {
       "path": "tests/provisioning_onboard_mode.mjs",
       "mode": "0000644",
-      "sha256": "7749df454ac3cca7c7e5ea1acc94ead15d1c9f87b38fe2028a1c93c8adf31bcf"
+      "sha256": "97d04ee39cc06b720d4a5b42f3e3cc614f64d9462b27471a1af7598b5e2929be"
     },
     {
       "path": "tests/provisioning_settings.mjs",
@@ -9057,7 +9092,7 @@
     {
       "path": "tests/search_ingest.mjs",
       "mode": "0000644",
-      "sha256": "504a855803d88468667663f663656dfd8e25726b90a412e34bcf55da0ad57d5e"
+      "sha256": "8d685a46ab9f4cf9aaa71b9ee78774d95c16daa27c15a229b8628a97688b9a55"
     },
     {
       "path": "tests/search_ingest_db.mjs",
@@ -9192,7 +9227,7 @@
     {
       "path": "tests/setup_smoke.mjs",
       "mode": "0000644",
-      "sha256": "919541c9444b7dc60f33a1e56b2f7defaf07ea1da5fb4b0c9760ca1bb9e7f1e0"
+      "sha256": "c55f6c506758d973b7cbe750a873e8c38d02006e1495f027fedb0ebfc84c7186"
     },
     {
       "path": "tests/ship_api_client_pathspec.mjs",
@@ -9459,6 +9494,11 @@
       "mode": "0000644",
       "sha256": "3ff18b286a68b244a272b3f2606ae33b298622347aae97305152f235ca57b330"
     },
+    {
+      "path": "tests/test_path_guard.mjs",
+      "mode": "0000644",
+      "sha256": "bbb0b063bffc6e394114bc4895da5006d8797a0317ed38f1c7f9b989841d5eab"
+    },
     {
       "path": "tests/tool-scan-fixtures/README.md",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -163,7 +163,7 @@ export interface PatchProvisioningInstancesIdSettingsRequest { platform_visibili
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; push: unknown }
 export interface PatchTaskRecommendationsIdRequest { status: "declined" | "withdrawn" }
 export interface PatchTaskRecommendationsIdResponse { ok: boolean; recommendation: unknown }
-export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; description?: string; status?: unknown }
+export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; description?: string; title?: string; status?: unknown }
 export interface PostAccessRequestsInviteRequest { github_login: string }
 export interface PostAccessRequestsInviteResponse { ok: boolean; already_invited?: boolean; github_login?: unknown; request?: unknown }
 export interface PostAccessRequestsRequest { github_login: string; display_name?: string; note?: string }

package/docs/api/openapi.json

@@ -16737,6 +16737,11 @@
             "minLength": 1,
             "maxLength": 50000
           },
+          "title": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200
+          },
           "status": {}
         },
         "additionalProperties": false

package/docs/api-reference.md

@@ -542,7 +542,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/tasks` | `any-builder` | — |  |
 | POST | `/api/bongos/tasks` | `metic+archon` | `version_id`, `title`, `description`, `status`, `touches`, `est_minutes`, `est_cost_usd`, `manual_degree`, `priority`, `automation_tag`, `credits_reward`, `source`, `source_ref`, `value_summary`, `kind`, `discipline`, `parallel_safe`, `newcomer_friendly`, `security_sensitive`, `requires_rank`, `auto_detect_touches`, `criterion_ids`, `module_key`, `goal_id` | Task create/promote/edit (plan/scope mutation) is Metic+ as of ADR 0090 (owner decision 2026-06-26): a Metic who can run idea-triage may … |
 | GET | `/api/bongos/tasks/:id` | `any-builder` | — | single-task read; preserved per CRITICAL §4 (supervisor hot path). |
-| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `description`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
+| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `description`, `title`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
 | POST | `/api/bongos/tasks/:id/abandon` | `metic+archon` | `reason` | POST /tasks/:id/abandon — terminal "retire this task" transition (task 987). |
 | POST | `/api/bongos/tasks/:id/attest-gate` | `any-builder` | `head_sha` | POST /tasks/:id/attest-gate — body: { head_sha }. |
 | POST | `/api/bongos/tasks/:id/confirm` | `any-builder` | `verified` |  |

package/modules/lifecycle/db-tasks.js

@@ -203,7 +203,7 @@ async function findTaskBySourceRef({ source, sourceRef } = {}, deps = {}) {
 
 const TASK_SETTER_COLUMNS = new Set([
   'kind', 'discipline', 'newcomer_friendly', 'security_sensitive', 'parallel_safe', 'automation_tag',
-  'needs_migration', 'module_key', 'description',
+  'needs_migration', 'module_key', 'description', 'title',
 ]);
 
 async function updateTaskColumn(id, column, value) {
@@ -264,6 +264,12 @@ async function updateTaskKind(id, kind) { return updateTaskColumn(id, 'kind', ki
 // write-audit middleware captures each edit's new body in audit_log.
 async function updateTaskDescription(id, description) { return updateTaskColumn(id, 'description', description); }
 
+// task 1002792: the title is the MORE visible half of that same prompt — what
+// /builder-start lists and the hall shows — and was write-once at every rank,
+// so a wrong title (two seeded briefs naming tables that hard-fail CI, task
+// 1002791) was permanent. Same permission, same audit trail as the body.
+async function updateTaskTitle(id, title) { return updateTaskColumn(id, 'title', title); }
+
 
 async function updateTaskDiscipline(id, discipline) { return updateTaskColumn(id, 'discipline', discipline); }
 
@@ -853,6 +859,7 @@ module.exports = {
   taskTouchesProtectedPath,
   updateTaskAutomationTag,
   updateTaskDescription,
+  updateTaskTitle,
   updateTaskDiscipline,
   updateTaskGoal,
   updateTaskKind,

package/modules/lifecycle/db.js

@@ -112,6 +112,7 @@ const {
   taskTouchesProtectedPath,
   updateTaskAutomationTag,
   updateTaskDescription,
+  updateTaskTitle,
   updateTaskDiscipline,
   updateTaskGoal,
   updateTaskKind,
@@ -244,6 +245,7 @@ module.exports = {
   createCriterion,
   updateTaskKind,
   updateTaskDescription,
+  updateTaskTitle,
   updateTaskDiscipline,
   updateTaskNewcomerFriendly,
   updateTaskRequiresRank,

package/modules/lifecycle/kickoff-checklist.js

@@ -0,0 +1,138 @@
+// modules/lifecycle/kickoff-checklist.js — the kickoff checklist: the launch steps a fresh
+// instance needs that the platform CANNOT do for its owner, as task specs (task 1003239).
+//
+// ONE list, two filers. `bongos init` files it at scaffold time on the self-host path
+// (scripts/gds/init.js kickoffTasks); the lifecycle module files it at the founder's
+// FIRST SIGN-IN on the control-plane path (modules/lifecycle/kickoff-seed.js), where
+// the scaffold ran `init --no-seed` and no Archon existed to file anything — walk
+// finding W4: the founder reached an empty board. Moved here from init.js so both
+// filers read the same steps and the copy cannot drift. It lives with the lifecycle
+// module because tasks are its domain and the kernel doorway must not grow a domain
+// import (ADR 0091 §1); init is a core CLI and, like abandon.js or audit-deps.js,
+// may require module code directly. Pure — imports nothing.
+//
+// Each step becomes a real, claimable task so it is tracked, never silently skipped
+// (grounded in the onboarding/deploy surfaces; the task 1204 mapping pass). Per-module
+// prerequisites are appended only for the modules the owner enabled.
+
+'use strict';
+
+// The one kickoff step the provisioning module AUTOMATES (ADR 0111 §3): standing up
+// production hosting/TLS/DNS/managed-DB. Kept as a named builder so init can either
+// FILE it (no provisioning requested, or the request couldn't be enqueued) or OMIT
+// it (a request went in — the control-plane runner covers this leg).
+function productionTopologyKickoff() {
+  return {
+    title: 'Production topology: TLS, real origins, managed Postgres',
+    kind: 'infra',
+    description: 'For a real (non-localhost) launch: front the instance with TLS (Caddy/Cloudflare/nginx), point ' +
+      'publicOrigin/buildersOrigin/statusOrigin at the real domain (the OAuth callback depends on this), and move off the bundled container DB volume to managed/backed-up Postgres.',
+  };
+}
+
+// The admission step as the SELF-HOST owner meets it: an env flag on their own box.
+const ADMISSION_SELF_HOST = {
+  title: 'Set the admission posture and invite the first builders',
+  kind: 'infra',
+  description: 'Enrollment is invite-only by default. Beyond you, no one can join until you approve an access request ' +
+    'or set <ENVPREFIX>_OPEN_XENOS_ENROLLMENT=1. Decide who can join and invite/approve the first builders.',
+};
+
+// The same decision as a HUB-PROVISIONED founder meets it: the door is the project's
+// "How people join" setting on the hub (task 1003044), never an env var they cannot
+// reach; invites are the Watch page's "Invite by GitHub username". Names only surfaces
+// that exist — a blank board is better than untrue copy (task 1003239).
+const ADMISSION_AT_FIRST_SIGN_IN = {
+  title: 'Decide how people join, and invite the first builders',
+  kind: 'infra',
+  description: 'Unless you opened the door when you created the project, nobody beyond you can join until you invite them. ' +
+    'Set "How people join" (open / apply to join / invite-only) from your project\'s manage page on the hub, ' +
+    'and invite the first builders by GitHub username from your project\'s Watch page.',
+};
+
+const MERGE_GATE = {
+  title: 'Arm the merge gate before a second builder joins (ci deploy mode)',
+  kind: 'infra',
+  description: 'For a shared instance on ci deploy mode, enable branch protection on main + required checks ' +
+    '(unit / secret-scan / gate-review), so untrusted builders cannot push straight to production. No review requirement — gates are CI checks, not human approvals (ADR 0162). Skippable for a solo/local instance.',
+};
+
+const INSTANCE_LOOK = {
+  title: 'Fill the instance look with your own LLM',
+  // 'ideator' is a DISCIPLINE, not a kind — tasks_kind_check rejects it as a
+  // kind and the task silently vanished from the checklist (the one non-infra
+  // kickoff step). Deciding the instance look is a decision by an ideator.
+  kind: 'decision',
+  discipline: 'ideator',
+  description: 'init wrote a lean config/branding.json and left the LOOK to you (a locked project rule: brand with your ' +
+    'own LLM, not a generator). Hand docs/branding-fill-prompt.md to your AI to design a palette/fonts/wordmark, or keep the vanilla look.',
+};
+
+// Steps that are already TRUE the moment a hub-provisioned founder signs in: auth
+// works (they just used it), the sign-in is this one, and the scaffold bound the repo
+// and chose the deploy mode. Filed on the self-host path only.
+function selfHostOnlySteps(spec, origin) {
+  return [
+    {
+      title: 'Register a GitHub OAuth app and set its credentials',
+      kind: 'infra',
+      description: 'Auth is the hard prerequisite for every sign-in — without it the server returns 503 ' +
+        'auth_not_configured and nobody (including you) can log in. Create a GitHub OAuth app, set ' +
+        `<ENVPREFIX>_GITHUB_CLIENT_ID/SECRET, tick "Enable Device Flow" (a separate save), and set the callback URL to ${origin}/api/gds/auth/web/callback.`,
+    },
+    {
+      title: `Sign in once as ${spec.firstAdmin} to seat the founding owner`,
+      kind: 'infra',
+      description: `A fresh database has no owner. Signing in as the configured firstAdmin (${spec.firstAdmin}) ` +
+        'the first time auto-seats that account as the founding Archon (owner). Config alone does nothing — you must actually sign in.',
+    },
+    {
+      title: 'Confirm the GitHub repo binding and deploy mode',
+      kind: 'infra',
+      description: `This instance ships work to ${spec.repo.owner}/${spec.repo.name}. Confirm the git remote / repo binding ` +
+        'and pick deploy mode in config/deploy.json (ci = server-mediated PR auto-merge, or laptop). A wrong/absent repo binding lets a task grade but never merge.',
+    },
+  ];
+}
+
+// Per-module prerequisites — a key the module cannot run without.
+function moduleKeySteps(spec) {
+  const enabled = new Set(Array.isArray(spec.modules) ? spec.modules : []);
+  const tasks = [];
+  if (enabled.has('art-pipeline')) {
+    tasks.push({ title: 'Provide a Google Gemini API key for the art pipeline', kind: 'infra',
+      description: 'The art-pipeline module needs a Google AI Studio (Gemini) key (GOOGLE_AI_STUDIO_KEY, a shared key, or per-builder keys) or it cannot generate art.' });
+  }
+  if (enabled.has('discord')) {
+    tasks.push({ title: 'Provide Discord bot token + webhooks', kind: 'infra',
+      description: 'The discord module needs a bot token + webhook URLs + DISCORD_BOT_ENABLED=true. Note: outbound/link surfaces fire on credentials even if the module flag is later turned off.' });
+  }
+  if (enabled.has('dev-box')) {
+    tasks.push({ title: 'Provide a DigitalOcean API token for dev boxes', kind: 'infra',
+      description: 'The dev-box module needs a DigitalOcean API token (and optionally Cloudflare) on the operator control plane before any builder box can be provisioned.' });
+  }
+  return tasks;
+}
+
+// kickoffChecklist(spec, opts) → task specs ({ title, kind, description[, discipline] }).
+//   provisioned — the owner opted into provisioning at init: the control-plane runner
+//                 covers production topology, so that step is omitted (ADR 0111 §3).
+//   firstSignIn — filed the moment the founder of a hub-provisioned project is seated:
+//                 only the steps still true after the standup, with the admission door
+//                 described as the hub setting it now is.
+// Pure — no I/O; the caller files them.
+function kickoffChecklist(spec = {}, { provisioned = false, firstSignIn = false } = {}) {
+  const origin = (spec.domains && spec.domains.publicOrigin) || 'http://localhost:3000';
+  const tasks = firstSignIn ? [] : selfHostOnlySteps(spec, origin);
+  tasks.push(firstSignIn ? ADMISSION_AT_FIRST_SIGN_IN : ADMISSION_SELF_HOST);
+  tasks.push(MERGE_GATE);
+  // Production topology is either AUTOMATED (the owner opted into provisioning — the
+  // control-plane runner stands up TLS/DNS/managed-DB) or a tracked manual step.
+  // Keep it in its infra slot, before the look step, when it's still manual.
+  if (!provisioned && !firstSignIn) tasks.push(productionTopologyKickoff());
+  tasks.push(INSTANCE_LOOK);
+  tasks.push(...moduleKeySteps(spec));
+  return tasks.map((t) => ({ ...t }));
+}
+
+module.exports = { kickoffChecklist, productionTopologyKickoff };

package/modules/lifecycle/kickoff-seed.js

@@ -0,0 +1,69 @@
+// modules/lifecycle/kickoff-seed.js — file the kickoff checklist at the founder's first
+// sign-in (task 1003239; behind the `lifecycle.kickoffSeed` port).
+//
+// WHY HERE, WHY THEN. `bongos init` files the kickoff checklist as tasks — but the
+// control-plane scaffold runs `init --no-seed` (scripts/gds/provision-repo.js), and a
+// hub-provisioned project has no Archon until its founder signs in, so nothing could
+// be filed earlier: the founder reached an EMPTY board (walk finding W4). The kernel's
+// first-admin seating (src/bongos/auth-admission.js) resolves this port the moment the
+// owner is seated — the first moment the checklist CAN be filed.
+//
+// IDEMPOTENT BY EMPTINESS, not by path. It seeds only when the tasks table is empty:
+// the self-host path already filed its checklist before anyone signed in, so it is
+// skipped there with no "was I provisioned" marker to keep true. The caller treats a
+// failure as best-effort — a seed hiccup must never fail the sign-in that just seated
+// the owner.
+//
+// THE BOUNDARY (ADR 0093 §1): core is reached only through ../../src/module-api.js.
+
+'use strict';
+
+const api = require('../../src/module-api');
+const db = require('./db');
+const { kickoffChecklist } = require('./kickoff-checklist');
+
+// The spec the checklist reads, from the instance's own branding pack. `modules` is
+// empty on purpose: a hub-provisioned project is scaffolded with every optional module
+// off, and its founder cannot have enabled one before their first sign-in.
+function specFromBranding(b = api.branding()) {
+  return {
+    firstAdmin: b.firstAdmin,
+    repo: b.repo || {},
+    domains: { publicOrigin: b.domains && b.domains.publicOrigin },
+    modules: [],
+  };
+}
+
+// The version the checklist lands under: the building one, else the first by id. The
+// scaffold seeds exactly one (provision-repo.js seedFirstVersionCmd).
+const FIRST_VERSION_SQL = `SELECT id FROM versions ORDER BY (status = 'building') DESC, id ASC LIMIT 1`;
+
+// seedKickoffIfEmpty({ builderId }, deps) → { seeded, versionId } | { seeded: 0, skipped }.
+// deps.pool / deps.createTask / deps.spec are test seams; production reads the doorway.
+async function seedKickoffIfEmpty({ builderId = null } = {}, deps = {}) {
+  const pool = deps.pool || api.pool;
+  const insert = deps.createTask || ((row) => db.createTask(row));
+  const { rows: [{ n }] } = await pool.query('SELECT count(*)::int AS n FROM tasks');
+  if (n > 0) return { seeded: 0, skipped: 'tasks_exist' };
+  const { rows: versions } = await pool.query(FIRST_VERSION_SQL);
+  if (!versions.length) return { seeded: 0, skipped: 'no_version' };
+  const versionId = versions[0].id;
+  const steps = kickoffChecklist(deps.spec || specFromBranding(), { firstSignIn: true });
+  let seeded = 0;
+  for (const t of steps) {
+    await insert({
+      versionId,
+      title: t.title,
+      description: t.description || '',
+      status: 'ready',
+      kind: t.kind || 'infra',
+      discipline: t.discipline || 'engineer',
+      source: 'first-sign-in',
+      createdBy: builderId,
+    });
+    seeded += 1;
+  }
+  return { seeded, versionId };
+}
+
+module.exports = { seedKickoffIfEmpty, specFromBranding, FIRST_VERSION_SQL };

package/modules/lifecycle/module.json

@@ -21,14 +21,16 @@
       "help-requests",
       "recommendations",
       "closeness",
-      "visuals"
+      "visuals",
+      "kickoff-seed"
     ],
     "pollers": [
       "publish-reconciler"
     ]
   },
   "provides": [
-    "lifecycle"
+    "lifecycle",
+    "lifecycle.kickoffSeed"
   ],
   "consumes": []
 }

package/modules/lifecycle/routes/kickoff-seed.js

@@ -0,0 +1,29 @@
+'use strict';
+
+// modules/lifecycle/routes/kickoff-seed.js — registers the `lifecycle.kickoffSeed` port
+// (task 1003239): the founder's first board, filed the moment the kernel seats them.
+//
+// Resolved by ONE caller — the first-admin bootstrap in src/bongos/auth-admission.js —
+// through resolveOptional, so an instance without this module signs in exactly as
+// before. A route factory for a routeless capability, for the reason routes/lifecycle.js
+// and routes/rank-sync.js give: mountModuleRoutes is the boot hook that runs in the live
+// server AND whenever a test rebuilds the router. The router stays EMPTY — seeding has
+// no HTTP surface, and an endpoint here would let anyone re-file a founder's checklist.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const seed = require('../kickoff-seed');
+
+// Delegates at call time (never spreads) so a stubbed seed still bites.
+const kickoffSeedPort = {
+  seedIfEmpty: (...a) => seed.seedKickoffIfEmpty(...a),
+};
+
+module.exports = function buildLifecycleKickoffSeedRouter() {
+  if (!api.hasProvider('lifecycle.kickoffSeed')) {
+    api.registerProvider('lifecycle.kickoffSeed', kickoffSeedPort);
+  }
+  return express.Router();
+};
+
+module.exports.kickoffSeedPort = kickoffSeedPort;

package/modules/lifecycle/routes/task-write-routes.js

@@ -285,6 +285,11 @@ module.exports = function registerTaskWriteRoutes(router) {
       // can be rewritten, never blanked (and null is refused by the type check).
       // Each edit's new body lands in audit_log via the write-audit middleware.
       description: { type: 'string', minLength: 1, maxLength: LIMITS.DESCRIPTION },
+      // task 1002792: the title — the more visible half of the same prompt — was
+      // write-once at every rank, so a wrong one was permanent (task 1002791's two
+      // briefs naming tables that hard-fail CI). Same shape as create, same
+      // task.edit permission, same audit_log trail as a description edit.
+      title: { type: 'string', minLength: 1, maxLength: LIMITS.TITLE },
       // task 1002614 (map D-18): DECLARED so strict-mode admits the request far
       // enough to reach the deliberate status_not_patchable hint below (#514) —
       // the hint had been unreachable dead code behind unknown_field since the
@@ -311,6 +316,7 @@ module.exports = function registerTaskWriteRoutes(router) {
     const hasModuleKey = Object.prototype.hasOwnProperty.call(body, 'module_key');
     const hasGoalId = Object.prototype.hasOwnProperty.call(body, 'goal_id');
     const hasDescription = Object.prototype.hasOwnProperty.call(body, 'description');
+    const hasTitle = Object.prototype.hasOwnProperty.call(body, 'title');
     // #514: status is a lifecycle field, not a PATCH-able column — it moves only
     // through the dedicated transition routes. The #506 session tried
     // `PATCH status=ready`, got the generic no_supported_fields error, and had
@@ -322,8 +328,8 @@ module.exports = function registerTaskWriteRoutes(router) {
     if (Object.prototype.hasOwnProperty.call(body, 'status')) {
       return res.fail('status_not_patchable', { status: 400, message: STATUS_HINT });
     }
-    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasNeedsMigration && !hasRequiresRank && !hasModuleKey && !hasGoalId && !hasDescription) {
-      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, description, parallel_safe, security_sensitive, automation_tag, needs_migration, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
+    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasNeedsMigration && !hasRequiresRank && !hasModuleKey && !hasGoalId && !hasDescription && !hasTitle) {
+      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, title, description, parallel_safe, security_sensitive, automation_tag, needs_migration, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
     }
     // ---- task 1002609 (G-22): settle EVERY gate and validation before the ----
     // ---- FIRST write. The previous shape validated-and-wrote per field in ----
@@ -478,6 +484,15 @@ module.exports = function registerTaskWriteRoutes(router) {
         return res.fail('patch_failed', { status: 500, message: 'internal error' });
       }
     }
+    if (hasTitle) {
+      try {
+        updated = await db.updateTaskTitle(id, body.title.trim());
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        log.error('[gds] PATCH /tasks/:id title', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
     if (hasGoalId) {
       try {
         updated = await db.updateTaskGoal(id, body.goal_id);