@bongos/core 1.19.419 → 1.19.420

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.419",
-  "core_contract": "1.19.419",
-  "source_commit": "d433ea7793766e404ce4b09ee9f652d5c09df897",
+  "core_version": "1.19.420",
+  "core_contract": "1.19.420",
+  "source_commit": "059167905bf23b4894c42e7e705ae7a4985e44b1",
   "source_ref": "HEAD",
-  "built_at": "2026-08-29T17:21:12.343Z",
+  "built_at": "2026-08-29T17:36:00.281Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 358,
+    "docs_redacted": 359,
     "agent_docs_stubbed": 23,
-    "functional_verbatim": 1710,
+    "functional_verbatim": 1712,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2091,
-  "tree_sha256": "95da3db8c2006aa8998116a9f4679ee33c902f365d0aa3904d7af6d3412ac78d",
+  "file_count": 2094,
+  "tree_sha256": "a7b3cb6487d5d1efdfb01330f81239e7e7000cbebf3ec2ca6d8bcd13d5e9dd87",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -192,7 +192,7 @@
     {
       "path": ".claude/skills/new-project/SKILL.md",
       "mode": "0000644",
-      "sha256": "1d6f60e8fa3cbf06cc5f8901ccf21fd8cac8050f81b3296039b659d700eba242"
+      "sha256": "21ae14d681f0b8a7056b320c764ffbaa88c9cf777afc67589049e4778bf98d3b"
     },
     {
       "path": ".claude/skills/otb-character-review/SKILL.md",
@@ -352,12 +352,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "d80581bbcb2577fe16cba30d6e0e1ff4ede4ca49dd08c306d1a3bcbfdf1d2cdc"
+      "sha256": "f190d3844d06a676480e270b05f14c13bd797915a43619be0a18affa06117000"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "64cccfdbd4d3d86798bdb60dbcf336e474aeb6af3854225c0a87f9d466c86acd"
+      "sha256": "562e26ce56898840c4bacf89ab7b31f7f80b30fa393374a3f8dc9c7ef973e48f"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -367,17 +367,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "b11537927f1268e2e14d8307589fe2eb58ef01e245556decd0251efc17f707d3"
+      "sha256": "a4b6049666626ab1a99c8c30b0e8fa0ce40e11ba3e4ae61e5763c6ce6338a5e5"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "227105130a432d4e7a294b4359455e022beaaac87bcd4014855d9d34e2faeaf4"
+      "sha256": "272b28e3c36e61ad0f7d578679a6c097238807fb284f130dbcd132d618c865fb"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "aaa84ab1bc5fd8054a85d36d6c70dd4667c8103c21e1c5a027de0b3806096029"
+      "sha256": "a8ea6b45b485350bb0190839cd89429706f9a046c9d2be2a7fe99555e691b852"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1539,20 +1539,25 @@
       "mode": "0000644",
       "sha256": "72c859bdfc70fd4fc0d104439985a43eaf60cce281bbaae8b8faaffb40546973"
     },
+    {
+      "path": "docs/adr/0209-one-budget-for-the-account-existence-oracle.md",
+      "mode": "0000644",
+      "sha256": "bdf26860d1f10413a30a770ab420d49fdf58f922d75e23fb1cf9f174f7e469e4"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "0f92a7a74afdf213a1aba92da88ea5348878ba0df67c3fc9e33d06b8f7ebade9"
+      "sha256": "19b8ba0e720f3df34e710c074dfeeabb64729acb4bd42f08c0378470dbfc3c99"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "e58b3d540eeaa8f38e028c72e64f4a2373c16c4c185edabc2d2538d247da9a29"
+      "sha256": "d4295ad9e1a6e0003f804fd1e9541414b2337d61469b58844e2f8008a893413c"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "091c9eecdbec83a540fc5d92017525dfdfdf192604b39d8cf60ec2cfb3466819"
+      "sha256": "1fff6c12d94b54f129023b50fb469652e2d558b816c7de6d8906f3ae772be47b"
     },
     {
       "path": "docs/architecture.md",
@@ -1577,12 +1582,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "3e70beb03c93a71f5068c407467deeeca3c69d5271372de04399a9094fa32dd9"
+      "sha256": "09df23ba8d777ddaab052ef0362f2ab3039818915101c3d7360893ba3516ee3a"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "ae4ffbc86e556ea5463b8289754b70e9465a581e93a40f8713204c34d433e00a"
+      "sha256": "d250537ce6978a0611104b5ece649905204beaf56fc63a923cf87410ab8c5a33"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -1917,7 +1922,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "2464bcb60656e263ef00002c928a2e6f0d4b812b7a7b8183c634535f1192e58d"
+      "sha256": "3d5b793c64f79c7c867f63440fbb949022426b0c849e3536f0988ebaa38e396b"
     },
     {
       "path": "docs/handoff-template.md",
@@ -1927,7 +1932,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "793b13d001dfdb2742b623d7f43d1c5850c67df8a8b12ffb469c675f15a109e2"
+      "sha256": "c59a19d11ab8ac21bdad72060f87d43b2e8774173dd7465ad45c30187ce44016"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3237,7 +3242,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "b11537927f1268e2e14d8307589fe2eb58ef01e245556decd0251efc17f707d3"
+      "sha256": "a4b6049666626ab1a99c8c30b0e8fa0ce40e11ba3e4ae61e5763c6ce6338a5e5"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4757,7 +4762,7 @@
     {
       "path": "modules/onboarding/routes/access-requests.js",
       "mode": "0000644",
-      "sha256": "060e8c33c5182c3d11b2b39b721f485deecc07b51f735b98f97aafbcc7e7657a"
+      "sha256": "254eaab3d13d796fb19a029ddc00d429ee5e28827003c407cfdd969d9d9aab28"
     },
     {
       "path": "modules/onboarding/routes/onboarding.js",
@@ -4882,7 +4887,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "16f86cd9b5a4b934b90a0332651b18c8bd8b1ccbfdbf0c5b23fffe50dbe8d8f8"
+      "sha256": "cd9aabc9c78964de0a93387b9edd46ee03a0f7c5e6d3f1153b6274204c27a2b6"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -4932,7 +4937,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "5403d391a22cffa58722923beee730db0bf4052ee933a84ab1e11fcbab9ea5e4"
+      "sha256": "6b523f1fbecaaa29310d3439cc1e4164f7dba3d01057812ccb4ac71bca861b68"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -5004,6 +5009,11 @@
       "mode": "0000644",
       "sha256": "74c46df38eab2b8c0f59b2da423691b170e3e85a7ec9857fad239b912bca99f4"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_013_project_detail.sql",
+      "mode": "0000644",
+      "sha256": "7abe41633cd7f98712c39960fba7175f0bb3340c4568bfbfdc640af911a31e15"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -5012,7 +5022,7 @@
     {
       "path": "modules/provisioning/onboard-plan.js",
       "mode": "0000644",
-      "sha256": "9124712dbaa724d03177f1b5779ca3aad639151c7b1ef9721dd65f5374de4afe"
+      "sha256": "31f14cbf3d649c25f1f17c508ae19be2f39d9e1991fde17cdce08cb15837ffa1"
     },
     {
       "path": "modules/provisioning/pollers/liveness-sweep.js",
@@ -5022,7 +5032,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "82c2502ad0c535a1faa43b167735d988527b54149778e5e796c1306139e760f9"
+      "sha256": "b643caae4ce9e8cfa8d5f3dccbfe41e709b89ce6820ca0422aee3ac184f45a12"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -5032,7 +5042,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "bdf000da67e09dfa3bc394d7c3d7dbbd9e65fe4a653cc558291c5806f2ca46ca"
+      "sha256": "100c0f73c26c1c4858009d8ce324b99e632c30725f32df84542ff7862bd339c2"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -5042,7 +5052,7 @@
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
       "mode": "0000644",
-      "sha256": "3db404b6ad50e01de0b1d73131cefc01ab8fe939eee18157ba6aa8f28a05fb7f"
+      "sha256": "38bc7eb2f1dfd3c03f2c48f42683821ebefbe68fafec95dec491bb3df926b7e0"
     },
     {
       "path": "modules/provisioning/ui/.gitkeep",
@@ -5467,12 +5477,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9bcfa46cd421336fba313885ceb399c9f025a85f5c07759abdb9d653bbd34105"
+      "sha256": "4e7b2bce0bc55c3eba541e39d4d28348353108eb837b9469b02267bdb42e9628"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cff6d489fea88ab0fe13b221de09f4bfa4b7d95ce5d8a1386de53ce94236b44e"
+      "sha256": "173eb6f8f5be1226bd5193296aa3f0e8700b185ee850f250d8a6357cf5f3b6e6"
     },
     {
       "path": "public-docs/index.html",
@@ -5922,7 +5932,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "6d67e17827d007228c41e7d2dc7d823a5c33a81cb904f1a7e4b0849daf290974"
+      "sha256": "274377ffb14a84b47867728bfa04a8198b57f9b13bcb3e16cadcd1a6ae2810d9"
     },
     {
       "path": "public-landing/projects.probes.json",
@@ -6377,7 +6387,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "2fcc7dfa75a6fcf1ebc0fb75d0e4343dc54b9d75b88fb798f8b16674b919c1b8"
+      "sha256": "ec823ee34e55318a1bee8008658fe44c24158e43a3736065312ae931d0bab796"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -6647,7 +6657,7 @@
     {
       "path": "scripts/gds/onboard.js",
       "mode": "0000644",
-      "sha256": "71ee037f1e893a1bcbcaca95e6bdc80c5eb4f5d3e613b59b95e1272d673d3d12"
+      "sha256": "bc169c26bfcddb6789e5fd7f8c2fc53bdaccadf75b7ea4dc2a96ea81d3f92c4d"
     },
     {
       "path": "scripts/gds/onboarding-analyze.js",
@@ -6697,7 +6707,7 @@
     {
       "path": "scripts/gds/provision-net.js",
       "mode": "0000644",
-      "sha256": "18c03ffa9cb4ec417ca527928a2146fa72630eada173c7e207dbad513af70acc"
+      "sha256": "01b6ef89cbef4d898934c1802dec416c6085f0dde5ae49012bd2fa7a14bb9589"
     },
     {
       "path": "scripts/gds/provision-repo.js",
@@ -7407,7 +7417,7 @@
     {
       "path": "src/bongos/middleware/rate-limit.js",
       "mode": "0000644",
-      "sha256": "3c725bd59ff9be82850b1f68ceb5e9d0dfb2ded9371e0623fab816a6b03fc144"
+      "sha256": "cd28f4517614b4b812aba3c051674ebaff8e78fd741a2e464966b687c459a654"
     },
     {
       "path": "src/bongos/module-scope-map.js",
@@ -7477,7 +7487,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "ba9fbc7fb9d210d850578b81dd54bbbe777634988107e8d5791b37acd0fffa0d"
+      "sha256": "4c26db2cae7070a44523053d369da83a41ed38677b46292da927b061a398a4eb"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -7592,7 +7602,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d70b98299c5a454682784d75bed90dc711525c826fb861bf11c8e5126ea0e155"
+      "sha256": "f2d4f01228f6c10d90a87717756c696e1a0c37d52872f735f2e26da19ea4cb66"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7644,6 +7654,11 @@
       "mode": "0000644",
       "sha256": "4d8435e7f8b949715ee40843beddc1868105edd9c67b269cfa8f510a192e9212"
     },
+    {
+      "path": "tests/account_existence_rate_limit.mjs",
+      "mode": "0000644",
+      "sha256": "41170e6fa3bc063770a39f4fe5b21e049ae91c8c4115b3b2152a7e464420fb6f"
+    },
     {
       "path": "tests/account_privacy_flags.mjs",
       "mode": "0000644",
@@ -9367,7 +9382,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "e5bb1ae80c818eec08f3f06999037b61d176afecb850fe65e4eab6c34e97b6b1"
+      "sha256": "9b2394ce72e74a96460c6d9ef1cc2ee280dded85523fae2979d56a49fb514b85"
     },
     {
       "path": "tests/module_catalog.mjs",
@@ -9467,7 +9482,7 @@
     {
       "path": "tests/onboard.mjs",
       "mode": "0000644",
-      "sha256": "92dd484634703c5204bc88eeccfdfdf310a2b0984488fb8d065d52a246b9f998"
+      "sha256": "3065c1ef3a57e3cd53b4e18bf7193cc3fe93efa012958628e8c99d6b9bfd8eae"
     },
     {
       "path": "tests/onboarding_gate.mjs",
@@ -9632,12 +9647,12 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "16d5ed7e9d6c24b8743996e8de44674297ef1355605f90b60783cd6fba419ea0"
+      "sha256": "b4090f624c1887dede854f67dfcb5c5dd851fdd90b048f6a649fcf651f70bc27"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "9cf9882d54011ea2284cb709c02abd2228d6a073b207e255b8958e0ca54794ae"
+      "sha256": "ccf476dbf012724c8b5de2080decd322eed3febb97d4079bfda7f0e1ec2ed733"
     },
     {
       "path": "tests/promote_goal_id.mjs",
@@ -9652,7 +9667,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "32f6a64ed1da1fcfe703f16ee171592262268b24eb833a171d1b5e289ad3e804"
+      "sha256": "9744b866060ae83fc560f65e579fc30e73957ff21329994ca3d581dbe1726053"
     },
     {
       "path": "tests/provision_restart.mjs",

package/.claude/skills/new-project/SKILL.md

@@ -19,7 +19,18 @@ Interview the owner for: product name, world name, company; the **GitHub repo**
 
 **Human-only (UI-first):** have them create an **empty** GitHub repository — github.com → **New repository** → name it, leave it empty (no README), Create. That repo is where the instance's own code will live.
 
-### 2. DNS token preflight — BEFORE you commit the address (task 1980)
+### 2. Tell us about the project — OPTIONAL, and skipping it is fine (task 1002334)
+
+Ask two things, and offer the skip in the same breath — a "you can leave this blank" that arrives *after* the question reads as a test:
+
+- **What are you building?** A sentence or two. This is the project's **description**, and it is half of the publish gate ([ADR 0182](../../../docs/adr/<redacted>.md) D4: a project is on the public map iff it has a name AND a description).
+- **Who's building it?** `solo` / `small-team` / `community`. This is what the platform's setup recommendations read.
+
+Both ride the provisioning request as `description` and `detail: { team_shape }`. **Skipping is a supported default, not a failure:** the project stands up exactly the same, it just stays *dark matter* — off the public map and un-joinable — until a description exists. Say that plainly when the owner skips, and say the way back with it: `PATCH /provisioning/instances/:id/detail` fills either answer in later, and publishes the project the moment the description lands.
+
+Never gate the standup on this step, and never invent an answer the owner didn't give — a recommendation built on a guess is worse than no recommendation.
+
+### 3. DNS token preflight — BEFORE you commit the address (task 1980)
 
 Before anything is provisioned, verify the control-plane's Cloudflare token can actually manage the domain's zone (a mismatched-zone token is exactly what broke the Emersonian standup mid-flow):
 
@@ -30,12 +41,12 @@ node scripts/gds/provision.js dns-check <domain>
 - ✓ reachable → continue.
 - ✗ not reachable → **STOP and resolve it now**, don't push past it. The command prints the fix; usually: widen the Cloudflare API token to include the domain's zone (CF dashboard → My Profile → API Tokens → edit → Zone Resources → Include → the zone), then re-run `dns-check` until green. Only then proceed.
 
-### 3. `bongos init` — scaffold (greenfield) **or** `--adopt` (brownfield)
+### 4. `bongos init` — scaffold (greenfield) **or** `--adopt` (brownfield)
 
 **This is the one leg that branches** (ADR 0121 §Decision 1). Pick the mode that matches the repo:
 
 - **Greenfield** — a NEW, empty repo. The default below.
-- **Brownfield / adopt** — an EXISTING repo (code, history, a backlog). Run `node bin/bongos.js init --adopt` instead. It DETECTS the repo's stack, runs a conflict **pre-flight** (migration-namespace / fitness-boundary / protected-path / CI-check collisions) and writes **nothing until you accept** (interactive y/N, or `--accept`); a genuine BLOCK (e.g. a `core_`-prefixed migration) is a hard stop, not accept-able. On accept it LAYERS the lean config + the pinned `@cloudbongos/core` dep + `.claude/` **additively** (merges-or-leaves-and-reports; never clobbers, never the `--force` path), captures the repo's **REAL** current version/goal, and imports its existing backlog (open GitHub issues via `GITHUB_TOKEN`/`GH_TOKEN`, else a `TODO`/`ROADMAP`/`BACKLOG` file). Then **skip step 4** — adopt layered onto the existing repo, there is no empty repo to scaffold — and continue from step 5 (provision). Every other leg is identical.
+- **Brownfield / adopt** — an EXISTING repo (code, history, a backlog). Run `node bin/bongos.js init --adopt` instead. It DETECTS the repo's stack, runs a conflict **pre-flight** (migration-namespace / fitness-boundary / protected-path / CI-check collisions) and writes **nothing until you accept** (interactive y/N, or `--accept`); a genuine BLOCK (e.g. a `core_`-prefixed migration) is a hard stop, not accept-able. On accept it LAYERS the lean config + the pinned `@cloudbongos/core` dep + `.claude/` **additively** (merges-or-leaves-and-reports; never clobbers, never the `--force` path), captures the repo's **REAL** current version/goal, and imports its existing backlog (open GitHub issues via `GITHUB_TOKEN`/`GH_TOKEN`, else a `TODO`/`ROADMAP`/`BACKLOG` file). Then **skip step 5** — adopt layered onto the existing repo, there is no empty repo to scaffold — and continue from step 6 (provision). Every other leg is identical.
 
 Greenfield:
 
@@ -45,11 +56,11 @@ node bin/bongos.js init          # interview (or: init --from spec.json for non-
 
 It writes lean `config/branding.json` / `config/modules.json` / `config/hierarchy.json`, seeds the first version + its done-when goal, files the human-only kickoff tasks, and — when you opt into hosting — files a **provisioning request** (`POST /provisioning/instances`). Choose **hosting shape `standalone`**. Enable the `provisioning` module on the target so the request is honored (`config/modules.json` → `"provisioning": true`).
 
-### 4. Scaffold the standalone repo
+### 5. Scaffold the standalone repo
 
-Materialize the instance's own repo (ADR 0108): clone the empty GitHub repo to the standalone root (`${PROVISION_STANDALONE_BASE:-/srv/cloudbongos}/<slug>` on the control plane), drop in the `config/` + `.claude/` from step 3, and pin the core as a dependency (`@cloudbongos/core` in the instance `package.json`). Commit + push. This checkout is what the standalone service will run from.
+Materialize the instance's own repo (ADR 0108): clone the empty GitHub repo to the standalone root (`${PROVISION_STANDALONE_BASE:-/srv/cloudbongos}/<slug>` on the control plane), drop in the `config/` + `.claude/` from step 4, and pin the core as a dependency (`@cloudbongos/core` in the instance `package.json`). Commit + push. This checkout is what the standalone service will run from.
 
-### 5. Provision — core + DB + address + service (task 1978)
+### 6. Provision — core + DB + address + service (task 1978)
 
 The web tier only **enqueued** the request; the **control-plane runner** does the real work (it alone holds the DO/Cloudflare tokens):
 
@@ -60,7 +71,7 @@ node scripts/gds/provision.js run-intents --apply     # drains the queue
 
 For `standalone` this composes: allocate a port → `git pull` + `npm ci --omit=dev` (installs the pinned core) → `createdb` + **instance-root** migrate (`node_modules/@cloudbongos/core/scripts/migrate.sh`) → per-instance `/etc/<slug>/web.env` → a **standalone systemd unit** (runs the core package's `platform-server.js` from the instance repo) → DNS A-record UPSERT → per-instance Caddy snippet (on-demand TLS) → `/healthz`. It is idempotent + dry-run-by-default (omit `--apply` to preview). It **fail-fasts on the step-2 DNS preflight** if step 2's token check was skipped.
 
-### 6. GitHub sign-in — ONE click (App Manifest flow), or a manual OAuth app + first sign-in
+### 7. GitHub sign-in — ONE click (App Manifest flow), or a manual OAuth app + first sign-in
 
 **Recommended — one click (task 2080, ADR 0133).** GitHub has no create-an-OAuth-App API, but it *does* let us pre-fill a **GitHub App Manifest**: the owner clicks one link, approves on GitHub, and GitHub hands the control plane the credentials automatically — **no OAuth app to hand-create, no secret to copy-paste ever.** From the control-plane hall, **Start a project → “Set up GitHub sign-in”** (the button appears once the instance is requested; it needs the instance's **domain** set). Under the hood it:
 
@@ -89,7 +100,7 @@ node scripts/gds/oauth-secret.js place <slug> --client-id <id> --client-secret <
 
 **Human-only — first sign-in.** The owner opens `https://<domain>` and signs in with GitHub **once**. This seats the **founding Archon** — config alone seats no one, so this step is inherent and cannot be automated.
 
-### 7. Verify
+### 8. Verify
 
 ```bash
 curl -s https://<domain>/healthz          # → {"ok":true,"auth_configured":true}
@@ -97,11 +108,11 @@ curl -s https://<domain>/healthz          # → {"ok":true,"auth_configured":tru
 
 Confirm the owner is **Archon** (their profile / the hall roster). If `auth_configured` is `false`, re-run the `oauth-secret place` step and recheck the OAuth app values.
 
-### 8. Brand
+### 9. Brand
 
 Fill the instance **look** — theme / palette / fonts in `config/branding.json` (see `docs/branding-fill-prompt.md`). The identity strings were set at init; this is the visual layer. "Brand with your own LLM."
 
-### 9. Enter your builders hall
+### 10. Enter your builders hall
 
 The hall is the point of everything above — end there, not at brand (task 1002703):
 
@@ -118,4 +129,4 @@ A new owner has gone zero → live: their own standalone repo on a pinned core,
 - **Standalone only** (ADR 0108) — do not fall back to editing this monorepo's checkout for a new project.
 - **Never weaken the trust boundary** — the web tier enqueues; only the control-plane runner (`provision.js`) touches cloud tokens (ADR 0016 / 0111 §2).
 - **Live docs are automatic** — a standalone instance's session-log index regenerates on deploy (`provision.js` runs `regen-instance-docs.js` after migrate; `bongos init`/`upgrade` seed+refresh it), and the whole-file nav docs are gitignored so `git reset --hard` never wipes them ([ADR 0147](../../../docs/adr/<redacted>.md)). If you wire a **bespoke** deploy script for an instance, it MUST call `node node_modules/@bongos/core/scripts/gds/regen-instance-docs.js` after `git reset` + migrate — see [`docs/recipes/standalone-live-docs.md`](../../../docs/recipes/standalone-live-docs.md).
-- **Adopting an EXISTING repo** (brownfield) is the other branch of the scaffold leg (step 3) — `bongos init --adopt` ([ADR 0121](../../../docs/adr/<redacted>.md)): detect → accept-gated conflict pre-flight → additive layering (never clobbers) → real version/goal + backlog import. Built; the `bongos onboard` CLI and the hall "start a project" wizard offer the same greenfield-vs-adopt choice.
+- **Adopting an EXISTING repo** (brownfield) is the other branch of the scaffold leg (step 4) — `bongos init --adopt` ([ADR 0121](../../../docs/adr/<redacted>.md)): detect → accept-gated conflict pre-flight → additive layering (never clobbers) → real version/goal + backlog import. Built; the `bongos onboard` CLI and the hall "start a project" wizard offer the same greenfield-vs-adopt choice.

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 337 operations across 53 resource groups
+- 338 operations across 53 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -641,6 +641,8 @@ function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
+      // PATCH /provisioning/instances/{id}/detail — rank: any-builder — PATCH /provisioning/instances/:id/detail
+      patchProvisioningInstancesIdDetail: (args) => request("PATCH", "/provisioning/instances/{id}/detail", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/domain — rank: any-builder — POST /provisioning/instances/:id/domain
       postProvisioningInstancesIdDomain: (args) => request("POST", "/provisioning/instances/{id}/domain", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/force-teardown — rank: metic+archon — POST /provisioning/instances/:id/force-teardown

package/clients/bongos-client/index.cjs

@@ -640,6 +640,8 @@ function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
+      // PATCH /provisioning/instances/{id}/detail — rank: any-builder — PATCH /provisioning/instances/:id/detail
+      patchProvisioningInstancesIdDetail: (args) => request("PATCH", "/provisioning/instances/{id}/detail", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/domain — rank: any-builder — POST /provisioning/instances/:id/domain
       postProvisioningInstancesIdDomain: (args) => request("POST", "/provisioning/instances/{id}/domain", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/force-teardown — rank: metic+archon — POST /provisioning/instances/:id/force-teardown

package/clients/bongos-client/index.d.ts

@@ -166,6 +166,8 @@ export interface PatchMeSkillPrefsResponse { prefs: unknown; effective: unknown;
 export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown; effective_map: unknown; volume: unknown; defaults: unknown; known_sounds: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
+export interface PatchProvisioningInstancesIdDetailRequest { description?: string; detail?: Record<string, unknown> }
+export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown }
 export interface PatchProvisioningInstancesIdSettingsRequest { platform_visibility?: string; joinability?: string }
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; push: unknown }
 export interface PatchTaskRecommendationsIdRequest { status: "declined" | "withdrawn" }
@@ -317,7 +319,7 @@ export interface PostProvisioningInstancesIdGithubAppRequest { account?: string
 export interface PostProvisioningInstancesIdGithubAppResponse { state: unknown; account: unknown; post_url: unknown; personal_url: unknown; org_url: unknown; org_login: unknown; manifest: unknown; redirect_url: unknown; expires_at: unknown }
 export interface PostProvisioningInstancesIdRestartResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; message: unknown }
 export interface PostProvisioningInstancesIdTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; superseded: unknown; message: unknown }
-export interface PostProvisioningInstancesRequest { slug: string; target_ref?: string; hosting_shape?: string; domain?: string; no_address?: boolean; tier?: string; onboard_mode?: string; type?: string }
+export interface PostProvisioningInstancesRequest { slug: string; target_ref?: string; hosting_shape?: string; domain?: string; no_address?: boolean; tier?: string; onboard_mode?: string; type?: string; description?: string; detail?: Record<string, unknown> }
 export interface PostSearchMarkRequest { chunk_id?: StringifiableId; useful?: unknown }
 export interface PostSearchRequest { expand?: unknown; q?: string; source_kind?: string; limit?: unknown }
 export interface PostSearchResponse { expand?: unknown; chunk?: unknown; query?: unknown; count?: unknown; total_full_tokens?: unknown; results?: unknown; corpus?: unknown }
@@ -946,6 +948,8 @@ export interface BongosClient {
     postProvisioningInstances(args: RequestArgs & { body: PostProvisioningInstancesRequest }): Promise<ApiResponse>;
     /** GET /provisioning/instances/{id} — rank: any-builder */
     getProvisioningInstancesId(args?: RequestArgs): Promise<GetProvisioningInstancesIdResponse>;
+    /** PATCH /provisioning/instances/{id}/detail — rank: any-builder */
+    patchProvisioningInstancesIdDetail(args?: RequestArgs & { body?: PatchProvisioningInstancesIdDetailRequest }): Promise<PatchProvisioningInstancesIdDetailResponse>;
     /** POST /provisioning/instances/{id}/domain — rank: any-builder */
     postProvisioningInstancesIdDomain(args: RequestArgs & { body: PostProvisioningInstancesIdDomainRequest }): Promise<PostProvisioningInstancesIdDomainResponse>;
     /** POST /provisioning/instances/{id}/force-teardown — rank: metic+archon */

package/clients/bongos-client/index.mjs

@@ -637,6 +637,8 @@ export function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
+      // PATCH /provisioning/instances/{id}/detail — rank: any-builder — PATCH /provisioning/instances/:id/detail
+      patchProvisioningInstancesIdDetail: (args) => request("PATCH", "/provisioning/instances/{id}/detail", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/domain — rank: any-builder — POST /provisioning/instances/:id/domain
       postProvisioningInstancesIdDomain: (args) => request("POST", "/provisioning/instances/{id}/domain", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/force-teardown — rank: metic+archon — POST /provisioning/instances/:id/force-teardown

package/docs/adr/0209-one-budget-for-the-account-existence-oracle.md

@@ -0,0 +1,79 @@
+# 0209 — Two routes answering one question spend one budget; whether the answer itself collapses is the owner's call
+
+- **Status:** Accepted (the ceiling). The response-collapse half is **Deferred — owner decision**, filed as a blocker against the task.
+- **Date:** 2026-08-29
+- **Deciders:** Claude, building the throttle half of the account-existence task. The task body named the collapse question as an owner/Archon decision and it is left as one.
+- **Task:** task 1003339 (goal 1000045 — public builder profiles + account security, criterion `i-control-my-own-access-and-exposure`)
+- **Interacts with:** [ADR 0016](<redacted>.md) (the trust boundary — these two routes are deliberately outside it), [ADR 0083](<redacted>.md) (the published doorway a module reaches core through), [ADR 0091](<redacted>.md) §1 (what belongs in the bounded kernel), [ADR 0116](<redacted>.md) (the 429's envelope), [ADR 0194](<redacted>.md) (the membership door these routes report on), [ADR 0206](<redacted>.md) (the sibling account-security decision in this goal)
+
+## Context
+
+Two PUBLIC routes answer the same question — *does this GitHub login have an account here?*
+
+- `GET /access-requests/status?github_login=X` (`modules/onboarding/routes/access-requests.js`) returns `member | invited | pending | dismissed | none` plus `admitted`.
+- `GET /auth/web/admission-status?login=X` (`src/bongos/routes/auth.js`) returns a bare `{ admitted }`. Strictly weaker; strictly derivable from the first.
+
+Neither was throttled, and the reason is structural rather than an oversight anyone could see locally: `rateLimitMiddleware` returns early for every non-write method, so the global limiter meters writes and nothing else. The one read limiter that exists (`publicReadRateLimitMiddleware`) is mounted only under `/public/*`. Neither of these routes is under that prefix, so both were reachable at line rate by anyone.
+
+Scripted against a list of GitHub usernames, either route becomes a login→membership roster: who builds here, and confirmation that a specific named person is present. That is targeting information, and it is exactly what you would want before a phishing attempt aimed at a named builder. The `auth.js` comment had already stated the exposure plainly ("It is also NOT throttled") and deferred the remedy, correctly, on the grounds that hardening one route while its richer twin stayed open would accomplish nothing.
+
+Two separable questions sit inside that, and conflating them is what kept the task open:
+
+1. **Is unauthenticated probing throttled?** A ceiling is right under every possible answer to (2) — an enumerator is unwelcome whether or not the reply is detailed.
+2. **Should the reply itself collapse**, so a caller who is not the subject cannot tell `pending` / `dismissed` / `none` apart from a bare "not admitted"? That changes what a real applicant sees during onboarding.
+
+## Decision
+
+**Ship (1) now, as ONE budget. Do not decide (2) here — file it.**
+
+### The ceiling is one budget, not two identical ones
+
+`accountExistenceReadRateLimit` joins `src/bongos/middleware/rate-limit.js` as limiter #4: 120 reads / 60s per IP over a single bucket map, keyed on `req.ip` (the same real-client-IP resolution the write limiter uses). It is exported as **one middleware instance, not a factory**, and the same instance is mounted on both routes.
+
+That is the load-bearing part of this ADR. Two limiters configured `120/60s` each are indistinguishable from one shared limiter in a diff, in a code review, and in any test that only counts to the limit on each route separately — and they hand an enumerator 240/min, because alternating between the twins costs nothing. The routes are one oracle read two ways, so they get one budget. `tests/account_existence_rate_limit.mjs` proves the sharing behaviourally in both directions *and* by object identity, and the mutation that replaces the shared instance with per-route copies leaves the counting tests green while the sharing tests go red — which is precisely the regression worth a test.
+
+120/min is the `/public/*` posture, and it clears the honest callers with wide margin: `renderAccessPendingPage` polls the boolean probe every 3s (20/min) and `bongos login` polls the rich one every 5s (12/min).
+
+### The module reaches it through the doorway, and rate-limit.js becomes kernel
+
+The onboarding module may require exactly one core file — the published doorway (ADR 0083). So `src/module-api.js` exports the shared instance, and `src/bongos/middleware/rate-limit.js` joins `KERNEL_FILES` in `fitness.js`. The argument is `logger.js`'s, verbatim: the abuse ceiling is a trust primitive in the same sense the authz gates are — **authz decides who may ask, this decides how often**, and an unauthenticated read route has nothing else holding it. The file requires nothing at all, so joining the roster costs no boundary and buys the import-direction guarantee on a file two surfaces now trust.
+
+The alternative — the module vendoring its own copy, as `modules/platform-identity/routes/public-profile.js` had to before there was a doorway export — is the failure this export exists to prevent. It is also how you get two budgets by accident.
+
+### The response collapse is deferred, with the evidence gathered
+
+Not deferred vaguely. The consumer sweep was run first, and it is short enough to state in full:
+
+- **Route 1 has exactly one consumer in the repo**: `scripts/gds/login.js`, the `bongos login` CLI. Its `pollDecision()` maps `member`/`invited` → admitted, `dismissed` → a hard stop, and **everything else → wait**. So `pending` and `none` are *already* indistinguishable to the only thing that reads them.
+- **Route 2's only consumer reads `admitted` and nothing else** — the inline poller in `renderAccessPendingPage`. The pending-vs-stranger distinction that page needs comes from `webAdmissionStatus`'s `expectedSoon`, computed server-side from a direct query, never from route 1.
+- **The generated typed clients define wrappers for both routes with zero call sites.**
+- Therefore collapsing costs **exactly one thing**: `login.js` is the only place in the entire codebase that tells a declined applicant they were declined. Collapse the answer and that branch is unreachable — a dismissed applicant's CLI prints dots for thirty minutes and then emits an actively wrong instruction ("re-run `bongos login` once an Archon has approved you") for an approval that is never coming.
+
+That is a real, if narrow, product regression, and it lands on a person at their worst moment with this project. It is a judgement about what an applicant is owed, not an engineering detail, so it goes to the owner rather than being settled by whoever happened to hold the task. The blocker carries this evidence and a recommendation.
+
+One thing the collapse would **not** buy, and the blocker says so: it does not close the oracle. `admitted: true` still means "member or invited" on both routes. Collapsing `pending`/`dismissed`/`none` narrows what leaks about *applicants*; only removing the routes or putting them behind an authenticated identity would close membership enumeration itself, and neither is possible while a stranger with no account has to poll them.
+
+### Rejected
+
+- **A separate limiter per route, both 120/60s.** Looks identical in review, hands an enumerator double the rate, and is the exact regression the sharing tests exist to catch.
+- **A `createReadRateLimit({ scope, limit, windowMs })` factory on the doorway.** More general and more wrong: two call sites with matching config get two buckets. The generality is what loses the property.
+- **Vendoring the `public-profile.js` sliding window into the onboarding module.** A fourth copy, and copies drift. That file's own comment records that it vendored only because the core limiter was not on the doorway — this ADR removes that reason.
+- **Hardening only `admission-status`** (the smaller diff). Accomplishes nothing while its richer twin stays open; the `auth.js` comment said so before this task existed.
+- **Refactoring `publicReadRateLimitMiddleware` onto the new shared gate.** A live limiter that is not broken, on a surface this task does not own.
+- **Collapsing the response on my own judgement because "nothing much" reads it.** "Nothing much" is not "nothing" — `dismissed` has one real consumer with real user-visible copy, and the task named this an owner decision.
+- **Deciding it the other way — annotating both routes "acceptable for this community model" and closing.** Equally the owner's call, and equally not mine.
+
+## Consequences
+
+- Both account-existence probes now refuse past 120/min from one address, with the ADR 0116 envelope, `Retry-After`, and `X-RateLimit-Scope: account-existence` — the scope name is deliberately the *question*, not the route, so a caller can see the two share a budget.
+- The limiter runs ahead of the lookups, so a refused probe issues no query. The oracle is not also a free amplifier.
+- The doorway gains one export (a MINOR addition; `tests/module_api.mjs` records it). `src/bongos/middleware/rate-limit.js` is now held to the kernel import rule — it currently imports nothing, and must keep importing nothing but the kernel.
+- Behind a shared NAT, ~6 simultaneous sign-ins polling at 3s would reach the ceiling. The refusal is a 429 with `Retry-After` and both pollers already retry, so this degrades to a slower poll rather than a failed sign-in — but it is the number to raise first if a real instance reports slow admissions.
+- A leaked or exhausted budget is per-IP and in-memory: a process restart forgets it, and one abusive address cannot close the door on anybody else. Both are asserted.
+
+## When to revisit
+
+- **The owner answers the collapse question** (the blocker). If the answer is "collapse it", `login.js`'s declined branch needs a replacement — the honest option is a timeout message that stops promising an approval is coming.
+- **A real instance reports admission polling hitting the ceiling** behind a shared address. Raise the limit; do not split the budget.
+- **A third surface starts answering the same question.** It mounts this same instance. A new bucket for it would re-open exactly the hole this closed.
+- **The routes stop needing to be public.** If a would-be builder ever arrives already holding an identity, the whole oracle can go behind `requireBuilder` and the ceiling becomes belt-and-braces.