@bongos/core 1.19.376 → 1.19.378

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.376",
+  "version": "1.19.378",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.376",
+      "version": "1.19.378",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.376",
+  "version": "1.19.378",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1308,6 +1308,7 @@ const CHECKS = [
   require('./routine-schedule.js').checkRoutineCadencesScheduled, // Check 25 — task 1003209: a routine that declares a cadence must have a scheduler firing it AT that period (ADR 0188)
   require('./baseline-staleness.js').checkBaselineFloors, // Check 26 — task 1003210: a shrink-only baseline that never shrinks is unmanaged debt; a floor exempting one must say why
   require('./client-baseurl-guard.js').checkClientBaseUrl,
+  require('./test-path-guard.js').checkTestsUseFileUrlToPath, // Check 30 — task 1002889: a test builds its repo root with fileURLToPath, never URL.pathname (a %20 or a Windows drive slash makes require() throw at load; CI's spaceless checkout can't see it)
   // Check 29 — task 1003275 / ADR 0189: a work category ORIENTS a human and steers
   // Claude; it authorises nothing. The owner said so twice, and the goal's own prose
   // predicts the failure: a second thing that looks like a hierarchy gets mistaken

package/scripts/gds/init.js

@@ -218,18 +218,11 @@ function provisioningRequest(spec) {
   return body;
 }
 
-// The one kickoff step the provisioning module AUTOMATES (ADR 0111 §3): standing up
-// production hosting/TLS/DNS/managed-DB. Kept as a named builder so init can either
-// FILE it (no provisioning requested, or the request couldn't be enqueued) or OMIT
-// it (a request went in — the control-plane runner covers this leg).
-function productionTopologyKickoff() {
-  return {
-    title: 'Production topology: TLS, real origins, managed Postgres',
-    kind: 'infra',
-    description: 'For a real (non-localhost) launch: front the instance with TLS (Caddy/Cloudflare/nginx), point ' +
-      'publicOrigin/buildersOrigin/statusOrigin at the real domain (the OAuth callback depends on this), and move off the bundled container DB volume to managed/backed-up Postgres.',
-  };
-}
+// The kickoff checklist itself (and the production-topology step the provisioning
+// module can automate) now live in modules/lifecycle/kickoff-checklist.js — ONE list shared
+// with the lifecycle module, which files the same steps at the founder's first
+// sign-in on the control-plane path (task 1003239). init keeps its names.
+const { kickoffChecklist, productionTopologyKickoff } = require('../../modules/lifecycle/kickoff-checklist');
 
 // The lean instance branding.json: ONLY the fields the owner supplied. Everything
 // else (theme, copy, rank labels, box subdomain pattern) resolves from
@@ -325,74 +318,11 @@ function mergeCoreDependency(pkg, { corePkg = CORE_PKG, coreRange, name = 'cloud
   return { pkg: next, action: 'added' };
 }
 
-// The kickoff checklist, as tasks. These are the steps init CANNOT do for you —
-// the human-only setup a fresh instance needs to actually launch (grounded in
-// the onboarding/deploy surfaces; see the task 1204 mapping pass). Each becomes
-// a real, claimable task so it's tracked, never silently skipped. Per-module
-// prerequisites are appended only for the modules the owner enabled.
+// The kickoff checklist, as tasks — the steps init CANNOT do for you (the shared
+// list, self-host shape). Production topology is omitted when the owner opted into
+// provisioning: the control-plane runner covers that leg (ADR 0111 §3).
 function kickoffTasks(spec) {
-  const origin = (spec.domains && spec.domains.publicOrigin) || 'http://localhost:3000';
-  const tasks = [
-    {
-      title: 'Register a GitHub OAuth app and set its credentials',
-      kind: 'infra',
-      description: 'Auth is the hard prerequisite for every sign-in — without it the server returns 503 ' +
-        'auth_not_configured and nobody (including you) can log in. Create a GitHub OAuth app, set ' +
-        `<ENVPREFIX>_GITHUB_CLIENT_ID/SECRET, tick "Enable Device Flow" (a separate save), and set the callback URL to ${origin}/api/gds/auth/web/callback.`,
-    },
-    {
-      title: `Sign in once as ${spec.firstAdmin} to seat the founding owner`,
-      kind: 'infra',
-      description: `A fresh database has no owner. Signing in as the configured firstAdmin (${spec.firstAdmin}) ` +
-        'the first time auto-seats that account as the founding Archon (owner). Config alone does nothing — you must actually sign in.',
-    },
-    {
-      title: 'Confirm the GitHub repo binding and deploy mode',
-      kind: 'infra',
-      description: `This instance ships work to ${spec.repo.owner}/${spec.repo.name}. Confirm the git remote / repo binding ` +
-        'and pick deploy mode in config/deploy.json (ci = server-mediated PR auto-merge, or laptop). A wrong/absent repo binding lets a task grade but never merge.',
-    },
-    {
-      title: 'Set the admission posture and invite the first builders',
-      kind: 'infra',
-      description: 'Enrollment is invite-only by default. Beyond you, no one can join until you approve an access request ' +
-        'or set <ENVPREFIX>_OPEN_XENOS_ENROLLMENT=1. Decide who can join and invite/approve the first builders.',
-    },
-    {
-      title: 'Arm the merge gate before a second builder joins (ci deploy mode)',
-      kind: 'infra',
-      description: 'For a shared instance on ci deploy mode, enable branch protection on main + required checks ' +
-        '(unit / secret-scan / gate-review), so untrusted builders cannot push straight to production. No review requirement — gates are CI checks, not human approvals (ADR 0162). Skippable for a solo/local instance.',
-    },
-  ];
-  // Production topology is either AUTOMATED (the owner opted into provisioning — the
-  // control-plane runner stands up TLS/DNS/managed-DB) or a tracked manual step.
-  // Keep it in its infra slot, before the look step, when it's still manual. (ADR 0111 §3)
-  if (!provisioningRequest(spec)) tasks.push(productionTopologyKickoff());
-  tasks.push({
-    title: 'Fill the instance look with your own LLM',
-    // 'ideator' is a DISCIPLINE, not a kind — tasks_kind_check rejects it as a
-    // kind and the task silently vanished from the checklist (the one non-infra
-    // kickoff step). Deciding the instance look is a decision by an ideator.
-    kind: 'decision',
-    discipline: 'ideator',
-    description: 'init wrote a lean config/branding.json and left the LOOK to you (a locked project rule: brand with your ' +
-      'own LLM, not a generator). Hand docs/branding-fill-prompt.md to your AI to design a palette/fonts/wordmark, or keep the vanilla look.',
-  });
-  const enabled = new Set(Array.isArray(spec.modules) ? spec.modules : []);
-  if (enabled.has('art-pipeline')) {
-    tasks.push({ title: 'Provide a Google Gemini API key for the art pipeline', kind: 'infra',
-      description: 'The art-pipeline module needs a Google AI Studio (Gemini) key (GOOGLE_AI_STUDIO_KEY, a shared key, or per-builder keys) or it cannot generate art.' });
-  }
-  if (enabled.has('discord')) {
-    tasks.push({ title: 'Provide Discord bot token + webhooks', kind: 'infra',
-      description: 'The discord module needs a bot token + webhook URLs + DISCORD_BOT_ENABLED=true. Note: outbound/link surfaces fire on credentials even if the module flag is later turned off.' });
-  }
-  if (enabled.has('dev-box')) {
-    tasks.push({ title: 'Provide a DigitalOcean API token for dev boxes', kind: 'infra',
-      description: 'The dev-box module needs a DigitalOcean API token (and optionally Cloudflare) on the operator control plane before any builder box can be provisioned.' });
-  }
-  return tasks;
+  return kickoffChecklist(spec, { provisioned: !!provisioningRequest(spec) });
 }
 
 // Normalize a raw spec (from --from or the interview) to canonical shape +

package/scripts/gds/test-path-guard.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+// scripts/gds/test-path-guard.js — a test must not build a filesystem path from
+// `URL.pathname` (task 1002889).
+//
+// THE BUG THIS EXISTS TO STOP. `new URL('..', import.meta.url).pathname` is a URL
+// path, not a filesystem path: percent-encoding survives (a space stays `%20`) and
+// on Windows it carries a leading slash before the drive letter. Handed to
+// require() or fs it resolves nowhere — four tests threw MODULE_NOT_FOUND at load
+// on the owner's checkout, whose path has a space in it.
+//
+// WHY A FITNESS CHECK AND NOT A TEST. CI checks out to a path with no space, so the
+// broken form passes there and the suite reads green while being unrunnable on a
+// Windows dev machine. CI can never catch the regression on its own; a static scan
+// at a different altitude can.
+//
+// THE FIX IT POINTS AT. `fileURLToPath(new URL('..', import.meta.url))` from
+// node:url (tests/fitness.mjs), or a plain relative require through
+// createRequire(import.meta.url) (tests/provisioning_teardown_intent.mjs).
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const NAME = 'a test builds its repo root with fileURLToPath, never URL.pathname (task 1002889)';
+
+// `import.meta.url).pathname` — the URL-path-as-filesystem-path defect, in both its
+// forms: new URL('..', import.meta.url).pathname and new URL(import.meta.url).pathname.
+const PATHNAME_ROOT = /import\.meta\.url\s*\)\s*\.pathname\b/;
+
+// Every tracked test file. Only tests use import.meta.url this way; source is CJS.
+function trackedTestFiles() {
+  try {
+    const out = execFileSync('git', ['ls-files', 'tests/*.mjs', 'tests/*.js', 'tests/**/*.mjs', 'tests/**/*.js'],
+      { cwd: REPO_ROOT, encoding: 'utf8' });
+    return [...new Set(out.split('\n').map((s) => s.trim()).filter(Boolean))];
+  } catch {
+    return [];
+  }
+}
+
+function scanTests(files, read) {
+  const violations = [];
+  let scanned = 0;
+  for (const rel of files) {
+    const src = read(rel);
+    if (src == null) continue;
+    scanned += 1;
+    const lines = src.split('\n');
+    for (let i = 0; i < lines.length; i += 1) {
+      if (!PATHNAME_ROOT.test(lines[i])) continue;
+      violations.push(
+        `${rel}:${i + 1} builds a filesystem path from URL.pathname — a space becomes %20 and a Windows `
+        + 'drive gains a leading slash, so require()/fs throw MODULE_NOT_FOUND at load. Use '
+        + "fileURLToPath(new URL('..', import.meta.url)) from node:url, or a relative require via "
+        + 'createRequire(import.meta.url).',
+      );
+    }
+  }
+  return { violations, scanned };
+}
+
+function checkTestsUseFileUrlToPath({ files, read } = {}) {
+  const list = files || trackedTestFiles();
+  if (!list.length) {
+    return {
+      name: NAME, ok: false, hardFail: true,
+      violations: ['scan defect — enumerated 0 tracked test files; a broken enumeration, not a clean result.'],
+      warnings: [], note: 'static scan of tests/ for a URL.pathname used as a filesystem path.',
+    };
+  }
+  const reader = read || ((rel) => {
+    try { return fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8'); } catch { return null; }
+  });
+  const { violations, scanned } = scanTests(list, reader);
+  return {
+    name: NAME,
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} test file(s) scanned: none may hand \`import.meta.url).pathname\` to require()/fs — `
+      + 'it keeps %20 and a Windows drive slash, so the file is unrunnable on a checkout with a space '
+      + 'in its path while CI (no space) stays green. fileURLToPath() or a relative require is the form.',
+  };
+}
+
+function main() {
+  const r = checkTestsUseFileUrlToPath();
+  for (const v of r.violations) console.error(`✗ ${v}`);
+  console.log(`${r.hardFail ? 'FAIL' : 'PASS'}  ${r.note}`);
+  process.exit(r.hardFail ? 1 : 0);
+}
+
+if (require.main === module) main();
+
+module.exports = { checkTestsUseFileUrlToPath, scanTests, trackedTestFiles, PATHNAME_ROOT };

package/src/bongos/auth-admission.js

@@ -261,6 +261,7 @@ async function maybeSeatFirstAdmin(builder) {
     const seated = await seatFirstAdminIfUnclaimed(builder.id, builder.github_login);
     if (seated) {
       log.info(`[auth] first-admin bootstrap: seated ${builder.github_login} as Archon (configured firstAdmin, no prior Archon).`);
+      await seedKickoffChecklist(builder.id);
       return { ...builder, rank: 'archon' };
     }
   } catch (err) {
@@ -269,6 +270,27 @@ async function maybeSeatFirstAdmin(builder) {
   return builder;
 }
 
+// seedKickoffChecklist — the founder's first board (task 1003239). A hub-provisioned
+// project reaches its first sign-in with an EMPTY tasks table (the scaffold ran init
+// --no-seed; no Archon existed to file anything), so the moment the founder is seated
+// is the first moment the kickoff checklist CAN be filed. Resolved through the
+// `lifecycle.kickoffSeed` port — this is a KERNEL_FILE and may not require a module
+// (ADR 0083 / ADR 0091 §1); the port itself skips a board that already has tasks.
+// BEST-EFFORT: a seed hiccup must never fail the sign-in that just seated the owner.
+// deps.port is a test seam; production resolves the seam registry.
+async function seedKickoffChecklist(builderId, deps = {}) {
+  const port = deps.port !== undefined ? deps.port : seams.resolveOptional('lifecycle.kickoffSeed');
+  if (!port) return null;
+  try {
+    const r = await port.seedIfEmpty({ builderId });
+    if (r && r.seeded) log.info(`[auth] first-admin bootstrap: filed ${r.seeded} kickoff task(s) under ${r.versionId} — the founder's first board.`);
+    return r;
+  } catch (err) {
+    log.error(`[auth] first-admin bootstrap: kickoff seed failed (non-fatal): ${err.message}`);
+    return null;
+  }
+}
+
 // safeSyncRankRole — give a builder the seeded rank-role matching their rank at
 // REGISTRATION (BV1.R95b, ADR 0151). governance_002's builder→role backfill is
 // run-once, so before this every builder admitted after that migration had no role
@@ -303,6 +325,7 @@ module.exports = {
   firstTimeAdmissionBlocked,
   joinabilityMode,
   maybeSeatFirstAdmin,
+  seedKickoffChecklist,
   membershipKind,
   openEnrollmentEnabled,
   reportActivityRollup,

package/src/module-api.js

@@ -1192,8 +1192,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.374 with no explicit bump. run 32909701598. (task 1002620)
 //   1.19.376 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.375 with no explicit bump. run 32910331206. (task 1002620)
+//   1.19.377 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.376 with no explicit bump. run 33025011131. (task 1002620)
+//   1.19.378 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.377 with no explicit bump. run 33025512093. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.376'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.378'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/first_admin_kickoff_seed.mjs

@@ -0,0 +1,56 @@
+// tests/first_admin_kickoff_seed.mjs — the kernel side of task 1003239: the first-admin
+// bootstrap files the founder's first board through the `lifecycle.kickoffSeed` port,
+// and NOTHING about that can fail the sign-in that just seated the owner.
+//
+// DB-free: the helper is exercised with an injected port (deps.port), the same seam the
+// production call resolves from the registry. Covers the three shapes the port can take
+// at runtime — absent (an instance without the lifecycle module), throwing, seeding.
+//
+// Run:  node --test tests/first_admin_kickoff_seed.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { seedKickoffChecklist } = require('../src/bongos/auth-admission.js');
+const seams = require('../src/module-seams.js');
+
+test('no port registered → a quiet null, never a throw (an instance without lifecycle signs in as before)', async () => {
+  assert.equal(seams.hasProvider('lifecycle.kickoffSeed'), false, 'nothing in-process registered the port');
+  assert.equal(await seedKickoffChecklist(1), null);
+});
+
+test('an absent port passed explicitly is the same quiet null', async () => {
+  assert.equal(await seedKickoffChecklist(1, { port: null }), null);
+});
+
+test('a throwing port is swallowed — best-effort, the seat stands', async () => {
+  const port = { seedIfEmpty: async () => { throw new Error('db went away'); } };
+  assert.equal(await seedKickoffChecklist(1, { port }), null);
+});
+
+test('a seeding port is handed the seated builder id and its result flows back', async () => {
+  const calls = [];
+  const port = { seedIfEmpty: async (arg) => { calls.push(arg); return { seeded: 3, versionId: 'V1' }; } };
+  const r = await seedKickoffChecklist(42, { port });
+  assert.deepEqual(calls, [{ builderId: 42 }]);
+  assert.deepEqual(r, { seeded: 3, versionId: 'V1' });
+});
+
+test('a skipping port (board already populated) flows back untouched', async () => {
+  const port = { seedIfEmpty: async () => ({ seeded: 0, skipped: 'tasks_exist' }) };
+  assert.deepEqual(await seedKickoffChecklist(42, { port }), { seeded: 0, skipped: 'tasks_exist' });
+});
+
+test('production resolves the port from the seam registry', async () => {
+  const calls = [];
+  seams.registerProvider('lifecycle.kickoffSeed', { seedIfEmpty: async (arg) => { calls.push(arg); return { seeded: 1, versionId: 'V1' }; } });
+  try {
+    const r = await seedKickoffChecklist(9);
+    assert.deepEqual(calls, [{ builderId: 9 }]);
+    assert.equal(r.seeded, 1);
+  } finally {
+    seams._reset();
+  }
+});

package/tests/kickoff_checklist.mjs

@@ -0,0 +1,107 @@
+// tests/kickoff_checklist.mjs — the shared kickoff checklist (task 1003239).
+//
+// One list, two filers: `bongos init` at scaffold time (self-host) and the lifecycle
+// module at the founder's first sign-in (hub-provisioned, where init ran --no-seed).
+// The first-sign-in shape must contain only what is still TRUE after a hub standup,
+// and must never name a surface that does not exist — the task's own rule: a blank
+// board beats untrue copy.
+//
+// Run:  node --test tests/kickoff_checklist.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { kickoffChecklist, productionTopologyKickoff } = require('../modules/lifecycle/kickoff-checklist.js');
+const { VALID_KINDS, VALID_DISCIPLINES } = require('../modules/lifecycle/task-classifier.js');
+
+const spec = () => ({
+  firstAdmin: 'founder', repo: { owner: 'o', name: 'n' },
+  domains: { publicOrigin: 'https://p.example' }, modules: [],
+});
+
+test('default (self-host): the seven owner-manual steps, topology included', () => {
+  const t = kickoffChecklist(spec());
+  assert.equal(t.length, 7);
+  assert.ok(t.some((x) => /OAuth/i.test(x.title)), 'OAuth app step');
+  assert.ok(t.some((x) => /founding owner/i.test(x.title)), 'first sign-in step');
+  assert.ok(t.some((x) => /repo binding/i.test(x.title)), 'repo binding step');
+  assert.ok(t.some((x) => /Production topology/i.test(x.title)), 'topology step');
+  assert.ok(t.every((x) => x.title && x.description), 'every step has a title + description');
+});
+
+test('provisioned: only the topology step is omitted', () => {
+  const t = kickoffChecklist(spec(), { provisioned: true });
+  assert.equal(t.length, 6);
+  assert.ok(!t.some((x) => /Production topology/i.test(x.title)));
+  assert.ok(t.some((x) => /OAuth/i.test(x.title)), 'the self-host owner still registers their OAuth app');
+});
+
+test('firstSignIn: only what is still true after a hub standup', () => {
+  const t = kickoffChecklist(spec(), { firstSignIn: true });
+  assert.deepEqual(
+    t.map((x) => x.title),
+    [
+      'Decide how people join, and invite the first builders',
+      'Arm the merge gate before a second builder joins (ci deploy mode)',
+      'Fill the instance look with your own LLM',
+    ],
+  );
+  for (const x of t) {
+    assert.ok(!/OAuth|founding owner|repo binding|topology/i.test(x.title + x.description),
+      `"${x.title}" names a step the standup already did`);
+  }
+});
+
+test('firstSignIn: the admission step points at surfaces that exist, never an env var', () => {
+  const join = kickoffChecklist(spec(), { firstSignIn: true })[0];
+  assert.ok(!/ENVPREFIX|OPEN_XENOS_ENROLLMENT|config\//.test(join.description), 'no env var or config file a hub founder cannot reach');
+  assert.match(join.description, /How people join/, 'the hub setting (task 1003044)');
+  assert.match(join.description, /manage page/, 'where the setting lives');
+  assert.match(join.description, /Watch page/, 'where invites live');
+  assert.match(join.description, /GitHub username/, 'how an invite is addressed');
+});
+
+test('firstSignIn: per-module keys still follow the enabled modules', () => {
+  const t = kickoffChecklist({ ...spec(), modules: ['art-pipeline', 'discord'] }, { firstSignIn: true });
+  assert.equal(t.length, 5);
+  assert.ok(t.some((x) => /Gemini/i.test(x.title)));
+  assert.ok(t.some((x) => /Discord/i.test(x.title)));
+});
+
+test('firstSignIn: never reads spec.repo or spec.firstAdmin (the steps that need them are omitted)', () => {
+  assert.doesNotThrow(() => kickoffChecklist({}, { firstSignIn: true }));
+  assert.equal(kickoffChecklist({}, { firstSignIn: true }).length, 3);
+});
+
+test('every variant satisfies the DB CHECK vocabulary (tasks_kind_check / tasks_discipline_check)', () => {
+  const full = { ...spec(), modules: ['art-pipeline', 'discord', 'dev-box'] };
+  const all = [
+    ...kickoffChecklist(full),
+    ...kickoffChecklist(full, { provisioned: true }),
+    ...kickoffChecklist(full, { firstSignIn: true }),
+    productionTopologyKickoff(),
+  ];
+  for (const t of all) {
+    assert.ok(VALID_KINDS.has(t.kind), `"${t.title}": kind '${t.kind}' violates tasks_kind_check`);
+    if (t.discipline !== undefined) {
+      assert.ok(VALID_DISCIPLINES.has(t.discipline), `"${t.title}": discipline '${t.discipline}' violates tasks_discipline_check`);
+    }
+  }
+});
+
+test('the look step is a decision BY an ideator in every variant', () => {
+  for (const opts of [{}, { provisioned: true }, { firstSignIn: true }]) {
+    const look = kickoffChecklist(spec(), opts).find((t) => /instance look/i.test(t.title));
+    assert.ok(look, `look step present for ${JSON.stringify(opts)}`);
+    assert.equal(look.kind, 'decision');
+    assert.equal(look.discipline, 'ideator');
+  }
+});
+
+test('returns fresh objects — a filer mutating one cannot poison the next call', () => {
+  const a = kickoffChecklist(spec(), { firstSignIn: true });
+  a[0].title = 'mutated';
+  assert.notEqual(kickoffChecklist(spec(), { firstSignIn: true })[0].title, 'mutated');
+});

package/tests/kickoff_seed.mjs

@@ -0,0 +1,93 @@
+// tests/kickoff_seed.mjs — the lifecycle module files the kickoff checklist at the
+// founder's first sign-in, and only onto an EMPTY board (task 1003239).
+//
+// The seed is idempotent by emptiness, not by path: the self-host path already filed
+// its checklist before anyone signed in, so it must be skipped there without any
+// "was I provisioned" marker. Every case runs against an in-memory pool + insert —
+// no database.
+//
+// Run:  node --test tests/kickoff_seed.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { seedKickoffIfEmpty, specFromBranding } = require('../modules/lifecycle/kickoff-seed.js');
+const buildRouter = require('../modules/lifecycle/routes/kickoff-seed.js');
+const api = require('../src/module-api.js');
+
+const spec = { firstAdmin: 'founder', repo: { owner: 'o', name: 'n' }, domains: { publicOrigin: 'https://p.example' }, modules: [] };
+
+function fakePool({ taskCount, versions }) {
+  const queries = [];
+  return {
+    queries,
+    query: async (sql) => {
+      queries.push(sql);
+      if (/FROM tasks/.test(sql)) return { rows: [{ n: taskCount }] };
+      if (/FROM versions/.test(sql)) return { rows: versions };
+      throw new Error(`unexpected query: ${sql}`);
+    },
+  };
+}
+
+test('an empty board gets the first-sign-in checklist, as ready tasks attributed to the founder', async () => {
+  const inserted = [];
+  const pool = fakePool({ taskCount: 0, versions: [{ id: 'V1' }] });
+  const r = await seedKickoffIfEmpty({ builderId: 7 }, { pool, spec, createTask: async (row) => { inserted.push(row); return row; } });
+  assert.deepEqual(r, { seeded: 3, versionId: 'V1' });
+  assert.equal(inserted.length, 3);
+  for (const row of inserted) {
+    assert.equal(row.versionId, 'V1');
+    assert.equal(row.status, 'ready', 'claimable from the first board, not backlog');
+    assert.equal(row.source, 'first-sign-in');
+    assert.equal(row.createdBy, 7);
+    assert.ok(row.title && row.description);
+  }
+  assert.match(inserted[0].title, /how people join/i);
+});
+
+test('a board that already has tasks is left alone (the self-host path seeded at init)', async () => {
+  const inserted = [];
+  const pool = fakePool({ taskCount: 12, versions: [{ id: 'V1' }] });
+  const r = await seedKickoffIfEmpty({ builderId: 7 }, { pool, spec, createTask: async (row) => inserted.push(row) });
+  assert.deepEqual(r, { seeded: 0, skipped: 'tasks_exist' });
+  assert.equal(inserted.length, 0);
+  assert.ok(!pool.queries.some((q) => /FROM versions/.test(q)), 'never even looks for a version');
+});
+
+test('no version to file under → skipped, nothing inserted', async () => {
+  const inserted = [];
+  const pool = fakePool({ taskCount: 0, versions: [] });
+  const r = await seedKickoffIfEmpty({ builderId: 7 }, { pool, spec, createTask: async (row) => inserted.push(row) });
+  assert.deepEqual(r, { seeded: 0, skipped: 'no_version' });
+  assert.equal(inserted.length, 0);
+});
+
+test('the version query prefers the building one, then the first by id', async () => {
+  const pool = fakePool({ taskCount: 0, versions: [{ id: 'V1' }] });
+  await seedKickoffIfEmpty({ builderId: 1 }, { pool, spec, createTask: async () => {} });
+  const q = pool.queries.find((s) => /FROM versions/.test(s));
+  assert.match(q, /status = 'building'/);
+  assert.match(q, /LIMIT 1/);
+});
+
+test('specFromBranding reads the instance pack and keeps modules empty', () => {
+  const s = specFromBranding({ firstAdmin: 'f', repo: { owner: 'a', name: 'b' }, domains: { publicOrigin: 'https://x' } });
+  assert.deepEqual(s, { firstAdmin: 'f', repo: { owner: 'a', name: 'b' }, domains: { publicOrigin: 'https://x' }, modules: [] });
+  assert.deepEqual(specFromBranding({}).repo, {});
+});
+
+test('the route factory registers the port once, returns an empty router, and the port delegates', async () => {
+  const before = api.hasProvider('lifecycle.kickoffSeed');
+  const router = buildRouter();
+  buildRouter(); // a rebuild must not trip the single-provider guard
+  assert.ok(api.hasProvider('lifecycle.kickoffSeed'));
+  assert.equal(typeof router, 'function');
+  assert.equal(router.stack.length, 0, 'seeding has no HTTP surface');
+  const port = api.resolveOptional('lifecycle.kickoffSeed');
+  const r = await port.seedIfEmpty({ builderId: 3 }, { pool: fakePool({ taskCount: 1, versions: [] }), spec });
+  assert.deepEqual(r, { seeded: 0, skipped: 'tasks_exist' });
+  assert.equal(before, false, 'this test registered it, nothing else in-process had');
+});

package/tests/migration_allocation.mjs

@@ -203,6 +203,7 @@ function shouldReserveMigrationNumber(task) {
         [() => db.updateTaskNeedsMigration(1, false), 'needs_migration'],
         [() => db.updateTaskModuleKey(1, null), 'module_key'],
         [() => db.updateTaskDescription(1, 'edited body'), 'description'], // task 1002647
+        [() => db.updateTaskTitle(1, 'corrected title'), 'title'], // task 1002792
       ];
       for (const [call, column] of setters) {
         const before = seen.length;
@@ -218,6 +219,16 @@ function shouldReserveMigrationNumber(task) {
     }
   });
 
+  await test('PATCH /tasks/:id accepts title so a wrong title is correctable (task 1002792)', () => {
+    assert.ok(
+      /title: \{ type: 'string', minLength: 1, maxLength: LIMITS\.TITLE \}/.test(routesSrc),
+      'the PATCH schema must declare title with the create-time limits — a title can be rewritten, never blanked'
+    );
+    assert.ok(/const hasTitle = Object\.prototype\.hasOwnProperty\.call\(body, 'title'\)/.test(routesSrc), 'title is gated like every other field');
+    assert.ok(/&& !hasTitle\) \{/.test(routesSrc), 'a title-only PATCH is a supported request, not no_supported_fields');
+    assert.ok(/db\.updateTaskTitle\(id, body\.title\.trim\(\)\)/.test(routesSrc), 'the write goes through the allowlisted setter');
+  });
+
   await test('PATCH /tasks/:id accepts needs_migration so a wrong flag is correctable', () => {
     assert.ok(
       /needs_migration: \{ type: 'boolean' \}/.test(routesSrc),

package/tests/provisioning_onboard_mode.mjs

@@ -21,9 +21,8 @@ import { createRequire } from 'node:module';
 import http from 'node:http';
 
 const require = createRequire(import.meta.url);
-const ROOT = new URL('..', import.meta.url).pathname;
 
-const provisioning = require(`${ROOT}/modules/provisioning/provisioning.js`);
+const provisioning = require('../modules/provisioning/provisioning.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -99,11 +98,11 @@ provisioning.enqueueIntent = async () => ({ intent: { id: 1, state: 'pending' },
 provisioning.recordEvent = async () => {};
 provisioning.getInstanceBySlug = async () => null;
 
-const api = require(`${ROOT}/src/module-api.js`);
+const api = require('../src/module-api.js');
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
 
 const express = require('express');
-const provisioningRoutes = require(`${ROOT}/modules/provisioning/routes/provisioning.js`);
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
 const app = express();
 app.use(express.json());
 app.use((_req, res, next) => {

package/tests/search_ingest.mjs

@@ -11,6 +11,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ingest = require('../scripts/gds/search-ingest-md.js');
@@ -61,7 +62,7 @@ test('SENSITIVE_DOC_GLOBS is the curated source of truth (subtrees end with /)',
 
 test('collectMarkdown finds the repo corpus but excludes node_modules/.git/worktrees/public', () => {
   const path = require('node:path');
-  const repoRoot = path.resolve(new URL('..', import.meta.url).pathname);
+  const repoRoot = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
   const real = collectMarkdown(repoRoot, repoRoot);
   // Assert on paths RELATIVE to the repo root — the suite may run from inside a
   // git worktree (…/.claude/worktrees/<name>/…), so the ABSOLUTE paths would all
@@ -77,7 +78,7 @@ test('collectMarkdown finds the repo corpus but excludes node_modules/.git/workt
 
 test('chunkFile yields well-formed rows (source_kind doc, hash, rank, sequential index)', () => {
   const path = require('node:path');
-  const repoRoot = path.resolve(new URL('..', import.meta.url).pathname);
+  const repoRoot = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
   const rows = chunkFile(path.join(repoRoot, 'docs', 'adr', '0016-trust-boundary-server-enforced-permissions.md'));
   assert.ok(rows.length > 0);
   rows.forEach((r, i) => {