@bongos/core 1.19.509 → 1.19.510

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.509",
-  "core_contract": "1.19.509",
-  "source_commit": "9605bf28928f63695da44f2f5033d52569701f0c",
+  "core_version": "1.19.510",
+  "core_contract": "1.19.510",
+  "source_commit": "bf4b829a050e1e59d80f4669559d33aff1ca021e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T18:27:19.784Z",
+  "built_at": "2026-09-03T18:34:17.437Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 427,
+    "docs_redacted": 428,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1949,
+    "functional_verbatim": 1951,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2400,
-  "tree_sha256": "8caa606e95cdf39a34d1b4f654b3b415dc9e699d7c1a058a9281097e297ae916",
+  "file_count": 2403,
+  "tree_sha256": "50673e10faee37607acac515c28140b876d8838c656e49115440b31f3d2ae42a",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -362,12 +362,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "7904ca2bfec8710c90bd846edb4c0b50436eebc29fcb87897eea69fea09d1001"
+      "sha256": "146ce9d114ec7d5a90413713b8604843c42eac060dd943648412868e214a1a6e"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "4f6b441e36573c71d391a24b76247df79db02a46bf719965bee22051a90c916f"
+      "sha256": "0e3fb901fd7110352e0edb686cfd8824d71687b88bd7e42269d0fe855177ac9f"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -377,17 +377,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "193252b5fb3be984786b23507a400564dfd6ad1899b0778b436882b8b28de39e"
+      "sha256": "19f11ecf8c9eda49cd1f2ac2425f1d3d9772ad46495305d9ae4bdeadf4695ea2"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "2507501215b31032378a856f4a26791921b3e618baedaaa1d6934df458d3023b"
+      "sha256": "4ced11579608e8fdb481a07b5555c41b3cbf3018cb3a8bd7697fb58368283bf0"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "1bf4942a3074fa90887b3efdcff39bde587abc6d8b70b4b83a2dea149beaa85a"
+      "sha256": "3d5868d134bce56923b8f0270fbb2e988dea5b6a5ea1a00b96ff8bcde06bb40e"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1689,20 +1689,25 @@
       "mode": "0000644",
       "sha256": "87b350049a0ed1b7be0c58fc2ae6ecd18a077b21ca689563a8763f925a37eef6"
     },
+    {
+      "path": "docs/adr/0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md",
+      "mode": "0000644",
+      "sha256": "10534e533c2c70baf670048fb38e18ddedb36925312806afbae9941a9c958667"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "16d284a7a9b1b70f1ba2aa3550a380ed76ace41b985c5f6a309c9899acf6b5f8"
+      "sha256": "e6b0e3bc8becec5ed9c7384596e205cc5a78e6145da244c8d6d2c1d5a4514380"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "91a31987ff13dd0757ec86db23b6cf86ea4cb95833d702ac7070b75ed4354b49"
+      "sha256": "f9a893262b5112e48a8bffa455c8e1a7ce8aed663e34141ef9c48117882a2ad7"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "42d2388b2d327331b2e78f29dfdbf6db517c9625238a93606a050de74d03ecec"
+      "sha256": "ec2d400cae26a7b89f644e978840927fd0fb88fc0b7b94e9f0d00dd19955aaf2"
     },
     {
       "path": "docs/architecture.md",
@@ -2577,7 +2582,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "52cb03d41b0eb38da33a436b0ca2912d2b087b33ab3675aca404a77767fdeb34"
+      "sha256": "8a8c8b3fa575b33ef7221af26b78a3cbe649f3cbf6b23e398da4d44e2a826096"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3947,7 +3952,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "193252b5fb3be984786b23507a400564dfd6ad1899b0778b436882b8b28de39e"
+      "sha256": "19f11ecf8c9eda49cd1f2ac2425f1d3d9772ad46495305d9ae4bdeadf4695ea2"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -5977,7 +5982,12 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "aafd317ed353c3aa6b28fc6432d13758f3305fb7593aaaa8271555b658245a01"
+      "sha256": "338e135f492e584aa4539d4a64d7c881b964c9ffa8428ff3359ad96d80b82a5c"
+    },
+    {
+      "path": "modules/provisioning/starter-bundles.js",
+      "mode": "0000644",
+      "sha256": "760382a3e361692f9d8457f88122fda498eb6bccecd37b351837fa5c4fa5e6f4"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -7232,12 +7242,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "da37c28e1647b70c11a589446419029d7dd7f05218cf88b0f357599aa1903836"
+      "sha256": "473153ee377e541a11f94f2b68604221d7cc56b75ce228745a71c094a6db32be"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d468e341086d86826eccaa2a062e84c3199ae2e7169bb1e97dfa46a7e00e4589"
+      "sha256": "24b60ab686b6e4edfefbbaecd284c9916d5090f8754a6020cba487a66e9c1441"
     },
     {
       "path": "public-docs/index.html",
@@ -8907,7 +8917,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fc08dfd1d74b0e89c903f8365f1e969286dbe2af19b75cf0a75f47e54d97fd0a"
+      "sha256": "27eb92e570f6572c875f3c0ab7cffee29fca5c49395167fe4ed7a1d8e466a32e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11179,6 +11189,11 @@
       "mode": "0000644",
       "sha256": "1623d2dff20d7b5843f9fd39dd91c35e4a8ebe10b60cf798e01a7fbc4b0202cf"
     },
+    {
+      "path": "tests/provisioning_starter_bundles.mjs",
+      "mode": "0000644",
+      "sha256": "0d3dadff4425e8d014cca29c66c31ff094e78ffbf2fd246f56ba11c5e1cefc93"
+    },
     {
       "path": "tests/provisioning_teardown_intent.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 345 operations across 53 resource groups
+- 346 operations across 53 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -671,6 +671,8 @@ function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
+      // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
+      getProvisioningStarterBundles: (args) => request("GET", "/provisioning/starter-bundles", { hasBody: false }, args),
       // GET /provisioning/tls-check — rank: public — GET /provisioning/tls-check
       getProvisioningTlsCheck: (args) => request("GET", "/provisioning/tls-check", { hasBody: false }, args),
     },

package/clients/bongos-client/index.cjs

@@ -670,6 +670,8 @@ function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
+      // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
+      getProvisioningStarterBundles: (args) => request("GET", "/provisioning/starter-bundles", { hasBody: false }, args),
       // GET /provisioning/tls-check — rank: public — GET /provisioning/tls-check
       getProvisioningTlsCheck: (args) => request("GET", "/provisioning/tls-check", { hasBody: false }, args),
     },

package/clients/bongos-client/index.d.ts

@@ -98,6 +98,7 @@ export interface GetProvisioningInstancesIdSettingsResponse { ok: boolean; setti
 export interface GetProvisioningInstancesResponse { instances: unknown }
 export interface GetProvisioningOnboardPlanResponse { mode: unknown; steps: unknown }
 export interface GetProvisioningSlugAvailableResponse { slug: unknown; available: unknown; reason: unknown; address: unknown }
+export interface GetProvisioningStarterBundlesResponse { core: unknown; bundles: unknown }
 export interface GetPublicBlockersIdResponse { blocker: unknown }
 export interface GetPublicBountyTableResponse { table: unknown; currency: unknown }
 export interface GetPublicGradesResponse { window_days: unknown; rolling: unknown; trend: unknown; attempts: unknown; threshold: unknown; grader_version: unknown }
@@ -981,6 +982,8 @@ export interface BongosClient {
     getProvisioningOnboardPlan(args?: RequestArgs): Promise<GetProvisioningOnboardPlanResponse>;
     /** GET /provisioning/slug-available — rank: any-builder */
     getProvisioningSlugAvailable(args?: RequestArgs): Promise<GetProvisioningSlugAvailableResponse>;
+    /** GET /provisioning/starter-bundles — rank: public */
+    getProvisioningStarterBundles(args?: RequestArgs): Promise<GetProvisioningStarterBundlesResponse>;
     /** GET /provisioning/tls-check — rank: public */
     getProvisioningTlsCheck(args?: RequestArgs): Promise<ApiResponse>;
   };

package/clients/bongos-client/index.mjs

@@ -667,6 +667,8 @@ export function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
+      // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
+      getProvisioningStarterBundles: (args) => request("GET", "/provisioning/starter-bundles", { hasBody: false }, args),
       // GET /provisioning/tls-check — rank: public — GET /provisioning/tls-check
       getProvisioningTlsCheck: (args) => request("GET", "/provisioning/tls-check", { hasBody: false }, args),
     },

package/docs/adr/0237-a-starter-bundle-is-a-preset-over-the-always-on-core-keyed-by-declared-type.md

@@ -0,0 +1,137 @@
+# 0237 — A starter bundle is a preset over the always-on core, keyed by the declared project type
+
+- **Status:** Accepted
+- **Date:** 2026-09-03
+- **Tasks:** [#1002338](https://cloudbongos.com/builders#/task/1002338) (this decision — BV1.R19)
+- **Goal:** [#1000046](https://cloudbongos.com/builders#/goal/1000046) — Project creation: visibility and
+  customization, criterion `proj-module-select` ("during setup a default set of modules is pre-selected…")
+- **Related:** [ADR 0083](<redacted>.md) (the one-way import rule that
+  keeps this file pure), [ADR 0107](<redacted>.md) +
+  [ADR 0167](<redacted>.md) (the module catalog a bundle names into),
+  [ADR 0182](<redacted>.md) D4 (the publish bar a bundle may not join),
+  task [#1002772](https://cloudbongos.com/builders#/task/1002772) (the declared project type),
+  task [#1002334](https://cloudbongos.com/builders#/task/1002334) (R15, the detail interview)
+
+## 1. The problem
+
+Criterion `proj-module-select` opens with "during setup a default set of modules is
+pre-selected." Every Cloud Bongos instance already boots with the same always-on
+core — the sixteen `default: true` modules a project cannot sensibly run without —
+so "pre-selected" can only mean the **opt-in** modules layered on top. An owner
+creating their first project has met none of them, and asking them to read a
+twenty-one-row catalog before they have a repo is the version of customization
+that gets skipped.
+
+R19 is the data that answers it. R20 ([#1002339](https://cloudbongos.com/builders#/task/1002339))
+renders the picker, R21 searches the catalog, R17/R22 recommend from the interview
+answers, R23 adds modules later — four consumers, one table underneath.
+
+## 2. Keyed by the DECLARED type, not by anything inferred
+
+The task text (seeded 2026-07-17) names three bundles: *Game / SaaS-Tool /
+Community*. That vocabulary was superseded four weeks later. Task
+[#1002772](https://cloudbongos.com/builders#/task/1002772) settled the closed
+project-type set by owner decision on 2026-08-13 — **`game` · `research` ·
+`business` · `non-profit` · `not-sure`** — and it is the live one: a CHECK on
+`platform_identity_projects.type`, a matching CHECK on
+`provisioning_instances.type`, `PROJECT_TYPES` in both modules, and five buttons in
+the create wizard. "Community" survives, but as a **team shape**
+(`PROJECT_DETAIL_VOCAB.team_shape ∈ solo | small-team | community`), not a project
+type. Bundles key off the shipped vocabulary; the seeded triple is recorded here as
+history so the divergence is not read later as an omission.
+
+Two constraints come with that key and neither is negotiable:
+
+- **The arrow runs type → modules, never back.** Task 1002772 explicitly rejected
+  deriving a project's type from its enabled module set, because flags flip all
+  through setup and a half-configured project would show a confidently wrong type.
+- **The interview does not ask a second time.** R15 wrote that into its own
+  vocabulary comment: "the module bundle R19 recommends comes off the
+  separately-declared `type`, so the interview deliberately does not ask it a
+  second time." So R19 adds no key to `PROJECT_DETAIL_VOCAB` and no migration —
+  the `detail` jsonb column stays reserved for answers an owner actually gave.
+
+`not-sure` and *undeclared* resolve to the same modules (the core, nothing else)
+and are deliberately **not** the same answer: `type` is nullable because every row
+predates the field and must never be back-filled with a guess, so `bundleForProjectType(null)`
+returns `type: null` with its own copy. A picker can tell "the owner said not sure"
+from "nobody asked yet"; conflating them would be the same invention the nullable
+column exists to prevent.
+
+## 3. A declaration pinned by a test, not a read of the live catalog
+
+The natural implementation is to resolve bundles against
+`src/module-loader/catalog.js` — the one model the hall's Modules tab and
+`bongos module list` both build from, so they cannot drift (ADR 0167). A module may
+not import it: `src/module-api.js` is the only core file a module may require (ADR
+0083's one-way rule) and the doorway exposes no catalog.
+
+So `modules/provisioning/starter-bundles.js` **declares** its module keys and stays
+pure — no I/O, no core import, no sibling import — exactly like `onboard-plan.js`
+beside it. The link back to the catalog is a test, not a runtime read:
+`tests/provisioning_starter_bundles.mjs` reads every `modules/*/module.json` off
+disk and fails the build if a bundle names a module that does not exist, if
+`ALWAYS_ON_CORE` drifts from the manifests' `default: true` set, if a bundle names
+an always-on module (a preselect that toggles nothing but reads to the owner as a
+choice), or if it names one of the two hub-only modules. A test is the right
+enforcement point here because the failure is a *build-time* fact — the manifests
+are in the same commit as the declaration — and buying it at runtime would cost the
+purity that lets a script, a route and a test all read the same answer.
+
+## 4. What the bundles are, and why they are short
+
+| type | bundle (opt-in additions) |
+|---|---|
+| `game` | `dev-box`, `discord` |
+| `research` | `agents` |
+| `business` | `agents`, `dev-box` |
+| `non-profit` | `discord` |
+| `not-sure` | — |
+
+Today's opt-in catalog is genuinely three modules wide (`agents`, `dev-box`,
+`discord`; `platform-identity` and `provisioning` are the control plane's own and
+are refused by construction). That is why this is a **declaration and not a rule
+engine** — a bundle grows as the catalog does, and R17/R22 own the layer that
+reasons. A preselect an owner has to audit is worse than none.
+
+`dev-box` is preselected on two types despite costing money to *use*: enabling the
+module opens the door, it provisions nothing and bills nothing until a builder asks
+for a box, and the picker toggles it off in one click.
+
+## 5. The read surface
+
+`GET /provisioning/starter-bundles` returns `{ core, bundles }` — the always-on
+floor once, then every type resolved as
+`{ type, label, summary, core, bundle, modules }`. The whole table in one read,
+because the picker re-preselects as the owner flips the type question and must not
+refetch to do it, and because R17's recommendations and R20's preselect reading the
+same shape is what stops them naming different modules.
+
+`rank: public`, the same (absent) gate as `GET /provisioning/onboard-plan` — the
+signed-out wizard reads it while choosing a type, it writes nothing, and the module
+catalog it names into is already public at `GET /public/modules`.
+
+## 6. Consequences
+
+- **A bundle is never a publish precondition.** [ADR 0182](<redacted>.md)
+  D4 fixes the bar at identity alone — a name and a description, "not tagline, art,
+  modules, governance, or a completed interview." Taking or declining a bundle
+  cannot move a project's dark-matter state.
+- **Nothing is stored yet.** R19 defines and serves; where a chosen selection lands
+  is R20's decision, and there is still no module-selection column on any table.
+- **Adding a module to the catalog is now a two-file change** if it belongs in a
+  bundle — the manifest and this declaration — and the integrity test says so out
+  loud when a manifest flips its `default`.
+
+## 7. Rejected
+
+- **Resolving against the live catalog at runtime** — costs the purity and breaks
+  the one-way rule for a fact that is fixed at build time.
+- **A `bundle` key in `PROJECT_DETAIL_VOCAB`** — R15 already ruled the interview
+  must not re-ask what `type` declares.
+- **Inferring the bundle from the free-text description** — that is the deferred
+  AI/semantic layer ([#1003500](https://cloudbongos.com/builders#/task/1003500)), and
+  the goal's own text pins the near term as rule-based.
+- **Naming the seeded Game / SaaS-Tool / Community triple** — three of those five
+  live types would then have no bundle, and two of the three names match nothing an
+  owner can pick.

package/docs/adr/README.md

@@ -324,5 +324,6 @@ This keeps the decision history honest and traceable.
 | 0234 | [**Idea routing: capture-time promotion, the landing matrix, and the homeless-only inbox** ([task 1003064](https://cloudbongos.com/builders#/task/1003064) · goal 1000071, "Idea routing"). Idea 1000771 named the failure: Discord `#bugs` created tasks DIRECTLY against a hardcoded, already-shipped version — no `captured_by`, no lineage, so the ideator-credit lane had nothing to pay against — while every other open idea sat waiting for a human triage pass that dropped its promotion into a version catch-all, because nothing in capture ever named a goal. Records what R01/R02/R05/R07/R13 shipped. `captureIdea` (`modules/ideas/inbox.js`) stays the ONE capture chokepoint — routing is one optional `goalId` argument, never a second creation door — and when the matrix routes, `routeIdeaToGoal` writes the idea row, the task (via the `lifecycle.createTask` port) and an `ideas_task_lineage` row (`origin='route'`) in ONE transaction, so a route can never mint attribution-free work the way `#bugs` did. `modules/ideas/routing.js`'s `decideLanding` is PURE and fail-closed: a bug from a Metic+ filer hard-lands `ready`, a sub-Metic bug or any other kind with a goal soft-lands `backlog`, a Full Idea or `criterion-proposal`/`decision` never routes, no goal named stays the pre-routing inbox path. `authorizeRoutedLanding` is the BINDING gate underneath the matrix's decision — a goal reaching protected scope raises the task's rank floor to Metic and REFUSES a sub-Metic filer outright, while membership is deliberately NOT required (reporting isn't authoring). `core_222`'s `suggested_goal_id` is an advisory hint only — the real home is `tasks.goal_id`, set by construction — and `/idea-triage` (`scripts/gds/triage.js`) now sends `goal_id` on promotion, so the inbox is homeless-only. Divergence recorded: R11 (Discord `#bugs`) hard-lands a linked Metic+ builder's bug immediately through the SAME shared matrix rather than the spec's "always soft-land, pending queue" design, because a local copy of the rank split would only drift from the one definition; and R12 (Discord `#ideas` hints) is NOT YET SHIPPED, so `#ideas` carries no goal hint today despite the interview decision that it should, hint-only, never route.](<redacted>.md) | ideas / lifecycle |
 | 0235 | [**A fix category is `kind='bug'` under a goal, not a new column** ([task 1003215](https://cloudbongos.com/builders#/task/1003215) · goal 1000071, "Idea routing" — the structural half of idea 1000828; task 1003214 shipped the advisory's first quiet case, task 1003157 extended it). A fix for something that should already work needs a home under an existing goal WITHOUT a new goal being born and WITHOUT a stored column restating what `tasks.kind` already says. Not a global "Bugs" goal either: a goal spanning every module makes the [ADR 0086](<redacted>.md) scope wall either everything or nothing, and a goal that can never reach `achieved` (a bug container never finishes) pollutes the exact signal [ADR 0183](<redacted>.md)'s auto-satisfy depends on. Not [ADR 0192 "a category orients and authorises nothing"](<redacted>.md) either, despite the structural resemblance: that decision forbids any gate from branching on a goal's category, while THIS decision is two decision surfaces deliberately branching on `kind='bug'` — `adviseGoal()` (`modules/lifecycle/goal-advisory.js`) goes silent for a bug under all three of its reasons (`no_goal`, `catch_all`, `no_criterion_link` — "a fix is the goal's 'fix category', not a delivery against one of its stated outcomes," its own doc comment) and `countTasksWithoutCriterionLink()` (`modules/lifecycle/db-deps-criteria.js`, surfaced on the hall's goal detail view) excludes `kind='bug'` from its count for the same reason. No hall/status change was needed for GROUPING bugs under a goal: every task card already renders its `kind` as a visible tag and the goal detail view's Filters already offer a `Kind` lens with `bug` as a value — verified against the live code, not built new. Rejected: a `tasks.category`/`fix_category` column or enum, a global cross-module "Bugs" goal, a bug-specific grouping widget beside the general-purpose kind facility that already works.](<redacted>.md) | ideas / lifecycle |
 | 0236 | [**Many ideas → one task: the lineage key is the pair** ([task 1003515](https://cloudbongos.com/builders#/task/1003515) · goal 1000071, "Idea routing" — promoted from idea 1000815; the table was built by [task 1002997](https://cloudbongos.com/builders#/task/1002997)). `ideas_task_lineage.task_id` was the PRIMARY KEY on the reasoning that "a task descends from at most one idea", and `linkIdeaTask` wrote `ON CONFLICT (task_id) DO UPDATE SET idea_id = EXCLUDED.idea_id` — so promoting a SECOND idea into a task that already had a link **silently replaced the first idea's lineage**: no error, no warning, no log line. Two ordinary triage promotes at one task were enough, and it happened on prod on 2026-08-21 (ideas 1000811 + 1000812 → task 1003150). Because this table is the rail [ADR 0172](<redacted>.md) stream 1 pays against, an overwritten row is an **ideator not paid** for work their idea produced, with nothing recording it — and it makes merging duplicate reports into one task a LOSSY move, which is the triage the inbox exists to encourage. The R01 grader named this shape and was told it was unreachable; it was unreachable on the ROUTING path examined and fully reachable on the ordinary PROMOTE path. **Decision: many ideas → one task is a real relation, so the key is the pair** — `ideas_006` re-adds `ideas_task_lineage_pkey` as `PRIMARY KEY (task_id, idea_id)` and both INSERT sites `DO UPDATE SET origin`, never `idea_id`. Refusing the second link would turn a legitimate merge into an error; logging the replacement keeps a lossy ledger. **Where one row is still required the EARLIEST link wins** (`ORDER BY created_at, idea_id`, stated in SQL rather than left to the planner): `sourceIdeaForTask`, `credits.awardIdeaTaskShipCredit`, and the nod queue's one-row-per-task predicate — one constant shared by the list and its count, so the pill can never disagree with the rows. Consequences: a task subsumed from N ideas **counts once toward each idea's** shipped-task credit (and cannot double-count within one — the pair is unique); the per-ship payout still names one idea, the earliest, because paying every co-source ideator is a decision about total worth, not a bug fix; the migration **backfills** from `idea_inbox.promoted_to_task_id`, the weaker pointer that survived each overwrite, labelling restored rows `origin='promote'`; and `updateIdea` still swallows a lineage failure but now reports it as a `LINEAGE GAP` through `api.logger` — a silent swallow on top of a silent overwrite was two layers of one mistake.](<redacted>.md) | ideas / economy |
+| 0237 | [**A starter bundle is a preset over the always-on core, keyed by the declared project type** ([task 1002338](https://cloudbongos.com/builders#/task/1002338) · goal 1000046, criterion `proj-module-select`). "During setup a default set of modules is pre-selected" can only mean the OPT-IN modules, since every instance already boots with the same sixteen `default: true` core-domain ones — so a bundle is a short list of opt-in module keys layered on that floor, preselected and freely toggled off by R20's picker ([task 1002339](https://cloudbongos.com/builders#/task/1002339)). **The key is the DECLARED type, and the seeded vocabulary is stale:** the task text (2026-07-17) names *Game / SaaS-Tool / Community*, but task [1002772](https://cloudbongos.com/builders#/task/1002772)'s owner decision (2026-08-13) fixed the live closed set as `game · research · business · non-profit · not-sure` — two CHECK constraints, two `PROJECT_TYPES` constants and five wizard buttons — and "community" survives only as a `team_shape`. Two constraints ride the key: the arrow runs **type → modules, never back** (1002772 rejected inferring type from module flags, which flip all through setup), and the R15 interview must **not re-ask** what `type` declares, so R19 adds no `PROJECT_DETAIL_VOCAB` key and no migration. `not-sure` and *undeclared* resolve to the same modules but are deliberately different answers — `type` is nullable precisely so "nobody said" is never back-filled with a guess, and the resolver returns `type: null` with its own copy. **The declaration is pinned by a test, not a runtime catalog read:** a module may not import `src/module-loader/catalog.js` (the one-way rule, [ADR 0083](<redacted>.md)), so `modules/provisioning/starter-bundles.js` stays PURE like `onboard-plan.js` beside it and `tests/provisioning_starter_bundles.mjs` reads every `modules/*/module.json` off disk — failing the build if a bundle names a module that does not exist, if `ALWAYS_ON_CORE` drifts from the manifests' `default: true` set, if a bundle names an always-on module (a preselect that toggles nothing), or if it names one of the two hub-only modules. The bundles are `game → dev-box, discord`; `research → agents`; `business → agents, dev-box`; `non-profit → discord`; `not-sure → —`, and they are SHORT because today's opt-in catalog is three modules wide and a preselect an owner must audit is worse than none. Served whole at public `GET /provisioning/starter-bundles` (`{ core, bundles }`, same absent gate as `onboard-plan`) so the picker re-preselects without a refetch and R17's recommendations read the same shape. A bundle is **never a publish precondition** — [ADR 0182](<redacted>.md) D4 fixes that bar at name + description alone. Rejected: a runtime catalog read, a `bundle` key in the interview vocabulary, inferring the bundle from the description (the deferred AI layer, [task 1003500](https://cloudbongos.com/builders#/task/1003500)), and keeping the seeded Game/SaaS-Tool/Community triple.](<redacted>.md) | provisioning / project creation |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.

package/docs/api/openapi.json

@@ -11728,6 +11728,34 @@
         ]
       }
     },
+    "/provisioning/starter-bundles": {
+      "get": {
+        "operationId": "get_provisioning_starter_bundles",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/starter-bundles",
+        "description": "GET /provisioning/starter-bundles — the curated module preset for each declared project type (BV1.R19, task 1002338; goal 1000046 criterion `proj-module-select`). Returns the always-on core once, then one resolved bundle per type: `{ type, label, summary, core, bundle, modules }`. The whole table in one read, because the creation picker (R20, task 1002339) re-preselects as the owner flips the type question and must not refetch to do it; R17's rule engine reads the same shape so a recommendation and a preselect can never name different modules. A DECLARATION, not a query — modules/provisioning/starter-bundles.js is pure, so this route touches no database and no per-request state. rank: public — the signed-out hub wizard (/projects?view=new) reads it while choosing a type, exactly like onboard-plan above; no write, no secret, and the module catalog it names is already public at GET /public/modules.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProvisioningStarterBundlesResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
     "/provisioning/tls-check": {
       "get": {
         "operationId": "get_provisioning_tls_check",
@@ -16984,6 +17012,17 @@
           "address"
         ]
       },
+      "GetProvisioningStarterBundlesResponse": {
+        "type": "object",
+        "properties": {
+          "core": {},
+          "bundles": {}
+        },
+        "required": [
+          "core",
+          "bundles"
+        ]
+      },
       "GetPublicBlockersIdResponse": {
         "type": "object",
         "properties": {
@@ -21758,9 +21797,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 345,
-  "x-schema-count": 377,
+  "x-endpoint-count": 346,
+  "x-schema-count": 378,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 257,
+  "x-response-schemas": 258,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 345 endpoints across 56 route files.
+> **Generated from the live route files** — the route file is authoritative. 346 endpoints across 56 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -442,7 +442,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/projects/featured` | `public` | — | a curated public showcase; no auth by design. |
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | invite a builder into a project (ADR 0141 §5, task #1002115). |
 
-## `provisioning` (19)
+## `provisioning` (20)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -464,6 +464,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/provisioning/instances/:id/teardown` | `any-builder` | — | POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. |
 | GET | `/api/bongos/provisioning/onboard-plan` | `public` | — | GET /provisioning/onboard-plan?mode=greenfield\|adopt&domain=<host> — the CANONICAL onboarding step sequence (task 2085; goal 35 / criteri… |
 | GET | `/api/bongos/provisioning/slug-available` | `any-builder` | — | GET /provisioning/slug-available?slug=<handle> — is this handle free to create under? rank: any authenticated builder (same gate as the c… |
+| GET | `/api/bongos/provisioning/starter-bundles` | `public` | — | GET /provisioning/starter-bundles — the curated module preset for each declared project type (BV1.R19, task 1002338; goal 1000046 criteri… |
 | GET | `/api/bongos/provisioning/tls-check` | `public` | — | GET /provisioning/tls-check?domain=<host> — the Caddy on-demand-TLS ALLOW-LIST (ADR 0111 §4, task P4 task 1945). |
 
 ## `public` (18)

package/docs/module-api-changelog.md

@@ -1455,5 +1455,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.507 with no explicit bump. run 33790206682. (task 1002620)
   1.19.509 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.508 with no explicit bump. run 33790542026. (task 1002620)
+  1.19.510 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.509 with no explicit bump. run 33791237400. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -670,6 +670,8 @@ function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
+      // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
+      getProvisioningStarterBundles: (args) => request("GET", "/provisioning/starter-bundles", { hasBody: false }, args),
       // GET /provisioning/tls-check — rank: public — GET /provisioning/tls-check
       getProvisioningTlsCheck: (args) => request("GET", "/provisioning/tls-check", { hasBody: false }, args),
     },

package/modules/provisioning/routes/provisioning.js

@@ -21,6 +21,8 @@
 //     POST   /provisioning/instances/:id/force-teardown — tear down ANY instance
 //   public:
 //     GET    /provisioning/health                   — liveness + core version
+//     GET    /provisioning/onboard-plan             — the canonical onboarding step sequence
+//     GET    /provisioning/starter-bundles          — the curated module preset per project type
 //
 // Reaches core ONLY through the doorway src/module-api.js (the one-way rule, ADR
 // 0083); it requires this module's own provisioning.js (same-dir), never a sibling.
@@ -33,6 +35,7 @@ const auth = api;
 const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const { onboardPlan, stepsForShape } = require('../onboard-plan');
+const { ALWAYS_ON_CORE, allStarterBundles } = require('../starter-bundles');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('provisioning');
@@ -1263,6 +1266,22 @@ module.exports = function provisioningRoutes() {
     res.json({ mode, steps: stepsForShape(onboardPlan(mode, { domain }), shape) });
   });
 
+  // GET /provisioning/starter-bundles — the curated module preset for each declared
+  // project type (BV1.R19, task 1002338; goal 1000046 criterion `proj-module-select`).
+  // Returns the always-on core once, then one resolved bundle per type:
+  // `{ type, label, summary, core, bundle, modules }`. The whole table in one read,
+  // because the creation picker (R20, task 1002339) re-preselects as the owner flips
+  // the type question and must not refetch to do it; R17's rule engine reads the same
+  // shape so a recommendation and a preselect can never name different modules.
+  // A DECLARATION, not a query — modules/provisioning/starter-bundles.js is pure, so
+  // this route touches no database and no per-request state.
+  // rank: public — the signed-out hub wizard (/projects?view=new) reads it while
+  // choosing a type, exactly like onboard-plan above; no write, no secret, and the
+  // module catalog it names is already public at GET /public/modules.
+  router.get('/provisioning/starter-bundles', (req, res) => {
+    res.json({ core: [...ALWAYS_ON_CORE], bundles: allStarterBundles() });
+  });
+
   // GET /provisioning/tls-check?domain=<host> — the Caddy on-demand-TLS ALLOW-LIST
   // (ADR 0111 §4, task P4 #1945). Caddy's global `on_demand_tls { ask … }` calls
   // this before fetching a Let's Encrypt cert for an SNI it doesn't already have:

package/modules/provisioning/starter-bundles.js

@@ -0,0 +1,159 @@
+// modules/provisioning/starter-bundles.js — the curated STARTER BUNDLE for each
+// declared project type (BV1.R19, task 1002338; goal 1000046 criterion
+// `proj-module-select`).
+//
+// WHY. Every Cloud Bongos instance boots with the same always-on core — the
+// methodology modules a project cannot sensibly run without. What differs between
+// a game, a research project and a business is the handful of OPT-IN modules on
+// top, and an owner creating their first project has no way to know which of
+// those they want before they have used any of them. A bundle is that opinion,
+// written down once: a project type maps to a short list of opt-in module keys,
+// PRESELECTED for the owner and freely toggled off in the creation picker (R20,
+// task 1002339). It is the answer the flow STARTS from, never a decision it makes
+// on the owner's behalf, and never a thing an owner is stuck with — modules are
+// added and removed after creation too (R23, task 1002342).
+//
+// THE ARROW RUNS TYPE -> MODULES, NEVER BACK. Task 1002772 rejected inferring a
+// project's type from its enabled module set: flags flip all through setup, so a
+// half-configured project would show a confidently wrong type. The type is
+// DECLARED at creation and everything downstream reads off that declaration. R15
+// wrote the same rule into the interview's vocabulary — "the module bundle R19
+// recommends comes off the separately-declared `type`, so the interview
+// deliberately does not ask it a second time" (PROJECT_DETAIL_VOCAB in
+// provisioning.js beside this file).
+//
+// A BUNDLE IS NOT A PUBLISH PRECONDITION. ADR 0182 D4 fixes the publish bar at
+// identity alone — a name and a description, "not tagline, art, modules,
+// governance, or a completed interview" — so taking or declining a bundle must
+// never change whether a project is on the map.
+//
+// PURE — no I/O, no core imports, no sibling-module imports; safe to require from
+// a route, a script or a test, exactly like onboard-plan.js beside it. That purity
+// is why the module keys below are DECLARED here rather than read off the live
+// catalog (src/module-loader/catalog.js, which a module may not import — the
+// one-way rule, ADR 0083). tests/provisioning_starter_bundles.mjs is the pin that
+// keeps the declaration true: it reads every modules/*/module.json off disk and
+// fails the build if a bundle names a module that does not exist, if a bundle
+// names an always-on module (a preselect that toggles nothing), or if
+// ALWAYS_ON_CORE drifts from the manifests' `default: true` set.
+
+'use strict';
+
+// The modules every instance gets whichever type it declares — the manifests'
+// `default: true` set (docs/modules-contract.md: "core-domain modules that are
+// `default: true` (always on unless disabled)"). They are the FLOOR a bundle
+// layers on, not part of any bundle, and they are listed here so a creation form
+// can show an owner what they already have without a second round trip.
+const ALWAYS_ON_CORE = Object.freeze([
+  'autonomy',
+  'builder-settings',
+  'copy-desk',
+  'economy',
+  'government',
+  'grading',
+  'hall-ui',
+  'ideas',
+  'lifecycle',
+  'memory',
+  'onboarding',
+  'public-landing',
+  'security',
+  'sessions',
+  'status-ui',
+  'ui-design',
+]);
+
+// The control plane's own modules. `platform-identity` is the hub identity
+// provider ("enabled ONLY on the hub instance") and `provisioning` is the surface
+// that stands other instances up — a project created THROUGH the hub is a
+// consumer of both, never a second copy of them. Named so the integrity test can
+// refuse them by construction rather than by anyone remembering.
+const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning']);
+
+// The curated presets, keyed by the declared project type (the closed vocabulary
+// owner-decided 2026-08-13 and mirrored in provisioning.PROJECT_TYPES + the
+// provisioning_007 CHECK). `label` and `summary` are the owner-facing copy the
+// picker renders — plain language, no module jargon, because the owner choosing
+// here has not met any of these modules yet.
+//
+// The lists are SHORT on purpose. A preselect an owner has to audit is worse than
+// none, and today's opt-in catalog is genuinely small (`agents`, `dev-box`,
+// `discord`); a bundle grows as the catalog does, which is exactly why this is a
+// declaration and not a rule engine. Enabling `dev-box` opens the door to a cloud
+// dev environment — it provisions nothing and bills nothing until a builder asks
+// for a box — so preselecting it costs the owner nothing but a toggle.
+const STARTER_BUNDLES = Object.freeze({
+  game: Object.freeze({
+    label: 'Game starter',
+    summary: 'Somewhere for players to gather, and a place to walk a change through before anyone plays it.',
+    modules: Object.freeze(['dev-box', 'discord']),
+  }),
+  research: Object.freeze({
+    label: 'Research starter',
+    summary: 'Extra agents to run the reading and the experiments the question needs.',
+    modules: Object.freeze(['agents']),
+  }),
+  business: Object.freeze({
+    label: 'Business starter',
+    summary: 'A place to try a change before customers see it, and agents to look it over first.',
+    modules: Object.freeze(['agents', 'dev-box']),
+  }),
+  'non-profit': Object.freeze({
+    label: 'Non-profit starter',
+    summary: 'Somewhere the community around the cause can gather and be heard.',
+    modules: Object.freeze(['discord']),
+  }),
+  'not-sure': Object.freeze({
+    label: 'Core only',
+    summary: 'Just the core, and nothing else to decide today. Add modules whenever you know what you need.',
+    modules: Object.freeze([]),
+  }),
+});
+
+// The copy an undeclared project gets. Deliberately NOT one of the bundles above:
+// `type` is nullable because every row predates the field and must never be
+// back-filled with a guess (migration provisioning_007), so "nobody said" has to
+// read differently from "the owner said not sure".
+const UNDECLARED = Object.freeze({
+  label: 'Core only',
+  summary: 'No project type yet, so nothing is preselected — every project starts with the core.',
+});
+
+// Resolve one project type to what the creation flow should preselect:
+// `{ type, label, summary, core, bundle, modules }`, where `bundle` is the type's
+// opt-in additions, `core` the always-on floor, and `modules` the union in that
+// order — what the owner ends up with if they change nothing. An unknown or
+// absent type resolves to the core with `type: null`; this never throws and never
+// invents a type, because a recommendation built on an answer nobody gave is
+// worse than no recommendation. Arrays are fresh copies, so a caller may sort or
+// splice its result without corrupting the frozen declaration.
+function bundleForProjectType(type) {
+  const declared = typeof type === 'string' && Object.prototype.hasOwnProperty.call(STARTER_BUNDLES, type)
+    ? type
+    : null;
+  const preset = declared ? STARTER_BUNDLES[declared] : UNDECLARED;
+  const bundle = declared ? [...STARTER_BUNDLES[declared].modules] : [];
+  return {
+    type: declared,
+    label: preset.label,
+    summary: preset.summary,
+    core: [...ALWAYS_ON_CORE],
+    bundle,
+    modules: [...ALWAYS_ON_CORE, ...bundle],
+  };
+}
+
+// Every curated bundle, resolved, in declaration order — the whole table in one
+// read. The creation picker wants all of them up front so flipping the type
+// question re-preselects without another round trip.
+function allStarterBundles() {
+  return Object.keys(STARTER_BUNDLES).map(bundleForProjectType);
+}
+
+module.exports = {
+  ALWAYS_ON_CORE,
+  HUB_ONLY_MODULES,
+  STARTER_BUNDLES,
+  bundleForProjectType,
+  allStarterBundles,
+};

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.509",
+  "version": "1.19.510",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.509",
+      "version": "1.19.510",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.509",
+  "version": "1.19.510",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.509'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.510'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provisioning_starter_bundles.mjs

@@ -0,0 +1,268 @@
+// tests/provisioning_starter_bundles.mjs — the curated starter bundles (BV1.R19,
+// task 1002338; goal 1000046 criterion `proj-module-select`).
+//
+// Three things are pinned here, and the middle one is the reason this file exists.
+//
+//   1. The resolver — bundleForProjectType(type) for each declared type, and the
+//      core-only fallback for a type nobody declared. A creation form must never
+//      be handed a guess.
+//   2. Bundle <-> catalog integrity — a bundle is a list of module KEYS, declared
+//      in a pure file that may not import the live catalog (the one-way rule, ADR
+//      0083). This test IS the link: it reads every modules/*/module.json off disk
+//      and fails the build the moment a bundle names a module that does not exist,
+//      names an always-on one (a preselect that toggles nothing), or the declared
+//      always-on list drifts from the manifests' `default: true` set.
+//   3. The read surface — GET /provisioning/starter-bundles is public and returns
+//      exactly what the resolver returns, so R20's picker and R17's rule engine
+//      cannot read a different answer than a script would.
+//
+// DB-free: the route is a pure read, so nothing here touches Postgres or the
+// network beyond a loopback listener on port 0.
+//
+// Run:  node --test --test-reporter=tap tests/provisioning_starter_bundles.mjs
+
+import { test, before, after } from 'node:test';
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import http from 'node:http';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+// ESM named imports off the CJS module on purpose: knip cannot trace a
+// createRequire() import, so a test-only export would read as dead code and move
+// the knip ratchet (see the repo's knip learning).
+import {
+  ALWAYS_ON_CORE,
+  STARTER_BUNDLES,
+  HUB_ONLY_MODULES,
+  bundleForProjectType,
+  allStarterBundles,
+} from '../modules/provisioning/starter-bundles.js';
+
+const require = createRequire(import.meta.url);
+
+// Stub the doorway in require.cache BEFORE the route file loads (the
+// access_requests_invite pattern): the route destructures `pool` at require time,
+// and a real pg pool would hold the event loop open long after the assertions
+// pass. Nothing here needs a database — the route under test is a pure read.
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool: { async query() { throw new Error('the starter-bundles route must not touch the database'); } },
+};
+
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+const MODULES_DIR = fileURLToPath(new URL('../modules', import.meta.url));
+
+// Every module key on disk, with the manifest's `default` — the live catalog as
+// the loader discovers it (src/module-loader/loader.js scans exactly this).
+function manifestsOnDisk() {
+  const out = new Map();
+  for (const ent of fs.readdirSync(MODULES_DIR, { withFileTypes: true })) {
+    if (!ent.isDirectory()) continue;
+    const manifestPath = path.join(MODULES_DIR, ent.name, 'module.json');
+    if (!fs.existsSync(manifestPath)) continue;
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    out.set(manifest.key, manifest);
+  }
+  return out;
+}
+
+// ── the resolver ────────────────────────────────────────────────────────────
+
+test('bundleForProjectType returns the always-on core plus the type\'s opt-in modules', () => {
+  // Arrange
+  const type = 'game';
+
+  // Act
+  const resolved = bundleForProjectType(type);
+
+  // Assert
+  assert.equal(resolved.type, 'game');
+  assert.deepEqual(resolved.core, [...ALWAYS_ON_CORE]);
+  assert.deepEqual(resolved.bundle, [...STARTER_BUNDLES.game.modules]);
+  assert.deepEqual(resolved.modules, [...ALWAYS_ON_CORE, ...STARTER_BUNDLES.game.modules]);
+  assert.ok(resolved.label && resolved.summary, 'carries owner-facing copy for the picker to render');
+});
+
+test('every declared project type resolves to a bundle', () => {
+  // Arrange — the shipped vocabulary (task 1002772, owner decision 2026-08-13).
+  const declared = provisioning.PROJECT_TYPES;
+
+  // Act + Assert
+  for (const type of declared) {
+    const resolved = bundleForProjectType(type);
+    assert.equal(resolved.type, type, `${type} resolves to itself, not the fallback`);
+  }
+  assert.deepEqual(
+    Object.keys(STARTER_BUNDLES).sort(),
+    [...declared].sort(),
+    'the bundle table covers the declared type vocabulary exactly — no missing type, no invented one',
+  );
+});
+
+test('an undeclared or unknown project type falls back to the core, and never guesses a type', () => {
+  // A project may have no type at all: the column is nullable because every row
+  // predates the field and must not be back-filled with a guess (migration
+  // provisioning_007). The fallback must be honest about that.
+  for (const type of [null, undefined, '', 'saas-tool', 'GAME', 42, {}]) {
+    // Act
+    const resolved = bundleForProjectType(type);
+
+    // Assert
+    assert.equal(resolved.type, null, `${JSON.stringify(type)} → no declared type`);
+    assert.deepEqual(resolved.bundle, [], 'nothing is preselected on a guess');
+    assert.deepEqual(resolved.modules, [...ALWAYS_ON_CORE]);
+  }
+});
+
+test('"not-sure" is a real answer that resolves to the core only, distinct from an undeclared type', () => {
+  // Arrange + Act
+  const notSure = bundleForProjectType('not-sure');
+  const undeclared = bundleForProjectType(null);
+
+  // Assert — same modules, different provenance: one owner said "not sure", the
+  // other said nothing at all, and the picker should be able to tell them apart.
+  assert.deepEqual(notSure.modules, undeclared.modules);
+  assert.equal(notSure.type, 'not-sure');
+  assert.equal(undeclared.type, null);
+  assert.deepEqual(notSure.bundle, [], 'the escape hatch adds nothing — nothing depends on it');
+});
+
+test('a caller mutating a resolved bundle cannot corrupt the declaration', () => {
+  // Arrange
+  const first = bundleForProjectType('game');
+
+  // Act
+  first.modules.push('not-a-module');
+  first.bundle.length = 0;
+  first.core.length = 0;
+
+  // Assert
+  const second = bundleForProjectType('game');
+  assert.deepEqual(second.core, [...ALWAYS_ON_CORE]);
+  assert.deepEqual(second.bundle, [...STARTER_BUNDLES.game.modules]);
+  assert.ok(!second.modules.includes('not-a-module'));
+});
+
+test('allStarterBundles returns one resolved bundle per declared type', () => {
+  // Act
+  const all = allStarterBundles();
+
+  // Assert
+  assert.deepEqual(all.map((b) => b.type), Object.keys(STARTER_BUNDLES));
+  for (const row of all) assert.deepEqual(row, bundleForProjectType(row.type));
+});
+
+// ── bundle <-> catalog integrity ────────────────────────────────────────────
+
+test('every module a bundle names exists in the module catalog', () => {
+  // Arrange
+  const onDisk = manifestsOnDisk();
+  assert.ok(onDisk.size > 0, 'read the manifests off disk');
+
+  // Act + Assert
+  for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
+    for (const key of bundle.modules) {
+      assert.ok(onDisk.has(key), `bundle "${type}" names "${key}", which is not a module on disk`);
+    }
+  }
+});
+
+test('every always-on module is a real module whose manifest says default: true', () => {
+  // Arrange
+  const onDisk = manifestsOnDisk();
+
+  // Act + Assert
+  for (const key of ALWAYS_ON_CORE) {
+    assert.ok(onDisk.has(key), `ALWAYS_ON_CORE names "${key}", which is not a module on disk`);
+    assert.equal(onDisk.get(key).default, true, `"${key}" is listed as always-on but its manifest is not default: true`);
+  }
+  const defaultsOnDisk = [...onDisk.values()].filter((m) => m.default === true).map((m) => m.key).sort();
+  assert.deepEqual(
+    [...ALWAYS_ON_CORE].sort(),
+    defaultsOnDisk,
+    'the declared always-on list has drifted from the manifests — a module was added, removed, or flipped its default',
+  );
+});
+
+test('a bundle may only add opt-in modules — never one that is already always-on', () => {
+  // A preselect that names an always-on module toggles nothing and reads to the
+  // owner as a choice they made; that is a lie the picker would render.
+  for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
+    for (const key of bundle.modules) {
+      assert.ok(!ALWAYS_ON_CORE.includes(key), `bundle "${type}" names always-on module "${key}"`);
+    }
+  }
+});
+
+test('no bundle names a hub-only module', () => {
+  // platform-identity and provisioning are the control plane's own modules — the
+  // hub runs them, a project created THROUGH the hub never should.
+  for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
+    for (const key of bundle.modules) {
+      assert.ok(!HUB_ONLY_MODULES.includes(key), `bundle "${type}" names hub-only module "${key}"`);
+    }
+  }
+});
+
+test('a bundle lists each module once', () => {
+  for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
+    assert.equal(new Set(bundle.modules).size, bundle.modules.length, `bundle "${type}" repeats a module`);
+  }
+});
+
+// ── the read surface ────────────────────────────────────────────────────────
+
+// Mount the real router. The route under test is a pure read, so it needs no
+// session gate and no res.fail helper — which is itself the point of the
+// assertion below.
+const express = require('express');
+const buildProvisioningRouter = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use('/api/bongos', buildProvisioningRouter());
+
+let server;
+let port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  port = server.address().port;
+});
+after(async () => { await new Promise((resolve) => server.close(resolve)); });
+
+function get(pathname) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: pathname }, (res) => {
+      let body = '';
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => {
+        let parsed = null;
+        try { parsed = JSON.parse(body); } catch { /* non-JSON */ }
+        resolve({ status: res.statusCode, body: parsed, raw: body });
+      });
+    }).on('error', reject);
+  });
+}
+
+test('GET /provisioning/starter-bundles is public and serves the resolved bundles', async () => {
+  // Act — no session: `rank: public`, the same gate (none) the signed-out create
+  // wizard reads GET /provisioning/onboard-plan with.
+  const res = await get('/api/bongos/provisioning/starter-bundles');
+
+  // Assert
+  assert.equal(res.status, 200, `readable with no session (got ${res.status} ${res.raw})`);
+  assert.deepEqual(res.body.core, [...ALWAYS_ON_CORE]);
+  assert.deepEqual(res.body.bundles, allStarterBundles());
+  assert.equal(res.body.bundles.length, provisioning.PROJECT_TYPES.length);
+});
+
+test('the route never reaches the database — the bundles are a declaration, not a query', async () => {
+  // The stubbed pool throws on any query, so a 200 here IS the assertion: an
+  // owner picking a type in the wizard must not cost a round trip to Postgres.
+  const res = await get('/api/bongos/provisioning/starter-bundles');
+  assert.equal(res.status, 200);
+});