@bongos/core 1.19.528 → 1.19.530

package/docs/module-api-changelog.md

@@ -1493,5 +1493,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.526 with no explicit bump. run 33827382028. (task 1002620)
   1.19.528 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.527 with no explicit bump. run 33829339717. (task 1002620)
+  1.19.529 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.528 with no explicit bump. run 33877197857. (task 1002620)
+  1.19.530 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.529 with no explicit bump. run 33878817005. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/recommendations.js

@@ -39,42 +39,20 @@
 
 'use strict';
 
-const { bundleForProjectType, ALWAYS_ON_CORE } = require('./starter-bundles');
+const { bundleForAnswers, TEAM_SHAPE_RULES, ALWAYS_ON_CORE } = require('./starter-bundles');
 const { PROJECT_DETAIL_VOCAB } = require('./provisioning');
 
-// How the team shape adjusts the type's starter bundle, in application order.
-// Each entry is one condition (`teamShape`) and one effect on ONE opt-in module,
-// carrying the sentence a picker shows when it fires. Deliberately tiny: ADR 0237
-// already made the per-type preset the opinion, and today's opt-in catalog is
-// three modules wide (`agents`, `dev-box`, `discord`) — so this table's job is to
-// correct a preset the owner's answer contradicts, not to re-derive it.
+// `TEAM_SHAPE_RULES` MOVED to starter-bundles.js (BV1.R22, task 1002341; ADR 0243)
+// and is re-exported here so this file's public surface is unchanged. It went to
+// the bundle layer because a bundle adjustment is not advice about the bundle —
+// it IS the bundle once the owner has answered, and `effectiveModules` is the
+// function ADR 0240 §2 hangs the whole skip contract on. A rule the creation
+// picker applies but that fallback does not is two lists kept in agreement by
+// hand, which is the failure ADR 0240 §2 was written to make impossible.
 //
-// A rule may only ever name an OPT-IN module. Adding or removing an always-on one
-// would be a toggle that toggles nothing (ADR 0237 §3's argument, and
-// `tests/provisioning_recommendations.mjs` fails the build over it).
-const TEAM_SHAPE_RULES = Object.freeze([
-  Object.freeze({
-    id: 'a-community-needs-somewhere-to-gather',
-    teamShape: 'community',
-    effect: 'add',
-    module: 'discord',
-    reason: 'You said an open community is building this, so somewhere for it to gather is switched on.',
-  }),
-  Object.freeze({
-    id: 'a-team-shares-one-environment',
-    teamShape: 'small-team',
-    effect: 'add',
-    module: 'dev-box',
-    reason: 'A small team gets one shared environment to build in, so nobody is debugging their own laptop.',
-  }),
-  Object.freeze({
-    id: 'building-alone-needs-no-shared-environment',
-    teamShape: 'solo',
-    effect: 'remove',
-    module: 'dev-box',
-    reason: 'You are building this alone, so the shared cloud environment is off — your own machine is the setup.',
-  }),
-]);
+// What stays HERE is the advice: a governance preset that is only ever previewed,
+// and an invite SEEK nothing in this module may run. Neither is a thing a project
+// silently ends up with, so neither belongs in the read-time resolution.
 
 // The governance presets, by key. A preset is a NAME plus the one sentence that
 // says what living under it feels like — never a set of roles or permissions,
@@ -167,25 +145,6 @@ function normalizeTeamShape(value) {
   return PROJECT_DETAIL_VOCAB.team_shape.includes(value) ? value : null;
 }
 
-// Apply the team-shape rules to one type's opt-in bundle. Returns the adjusted
-// list plus the adjustments that ACTUALLY changed it — a rule whose module the
-// bundle already carries (or already lacks) records nothing, because a stated
-// reason for a change that did not happen is a lie the owner cannot check.
-// Never touches the always-on core. PURE.
-function adjustBundle(bundle, teamShape) {
-  const modules = [...bundle];
-  const adjustments = [];
-  for (const rule of TEAM_SHAPE_RULES) {
-    if (rule.teamShape !== teamShape) continue;
-    const at = modules.indexOf(rule.module);
-    if (rule.effect === 'add' && at === -1) modules.push(rule.module);
-    else if (rule.effect === 'remove' && at !== -1) modules.splice(at, 1);
-    else continue;
-    adjustments.push({ rule: rule.id, effect: rule.effect, module: rule.module, reason: rule.reason });
-  }
-  return { modules, adjustments };
-}
-
 // The whole recommendation for one set of creation answers:
 //
 //   {
@@ -211,8 +170,10 @@ function adjustBundle(bundle, teamShape) {
 function recommendationsForDetails(answers) {
   const given = answers && typeof answers === 'object' && !Array.isArray(answers) ? answers : {};
   const teamShape = normalizeTeamShape(given.team_shape);
-  const preset = bundleForProjectType(given.type);
-  const { modules, adjustments } = adjustBundle(preset.bundle, teamShape);
+  // The SAME resolver the picker preselects from and effectiveModules falls back
+  // to (ADR 0243) — so the recommendation, the panel and the project a skipped
+  // picker ends up with are one function's answer, not three that agree.
+  const preset = bundleForAnswers(given.type, teamShape);
 
   const gov = GOVERNANCE_RULES.find((r) => r.teamShape === teamShape) || GOVERNANCE_DEFAULT;
   const invite = INVITE_RULES.find((r) => r.teamShape === teamShape) || INVITE_DEFAULT;
@@ -226,9 +187,9 @@ function recommendationsForDetails(answers) {
       label: preset.label,
       summary: preset.summary,
       core: [...ALWAYS_ON_CORE],
-      bundle: modules,
-      modules: [...ALWAYS_ON_CORE, ...modules],
-      adjustments,
+      bundle: preset.bundle,
+      modules: preset.modules,
+      adjustments: preset.adjustments,
     },
     governance: {
       preset: gov.preset,

package/modules/provisioning/routes/callback-page.js

@@ -0,0 +1,159 @@
+// modules/provisioning/routes/callback-page.js — the standalone HTML the public
+// GitHub-App-Manifest redirect lands on (task 1003570; the page itself is task 2096).
+//
+// WHY. This is pure PRESENTATION for exactly one route — `GET /provisioning/
+// github-app/callback` in routes/provisioning.js — and it is ~135 lines of escaper,
+// palette, stylesheet, client script and template with no request, DB or auth logic
+// in it. Carrying it inside the route file pushed that file onto the 1500-line
+// OVERSIZE_LINES fitness ratchet (scripts/gds/fitness-ratchets.js), where the next
+// single added line failed `unit` and the only obvious escape — raising the baseline
+// — is the one thing the ratchet forbids (ADR 0243 §4/§5 for the argument that put
+// it there). Moved here verbatim so the route file has room to change again.
+//
+// Reaches core ONLY through the doorway src/module-api.js (the one-way rule, ADR
+// 0083); it is required by routes/provisioning.js and by nothing else.
+//
+// Shape: no DB, no network, no request object — given a plain options bag it returns
+// a string. `esc` and `callbackPage` are the whole surface; PAGE_STYLE and
+// CALLBACK_SCRIPT stay private because they are only ever this page's own body.
+'use strict';
+
+const api = require('../../../src/module-api');
+
+// Minimal HTML escaper for the callback landing page (no template engine here).
+function esc(s) {
+  return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
+    { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
+  ));
+}
+
+// Accent pair resolved from the instance's own branding — the pack is the palette
+// authority (task 1002810); the literal fallbacks are the neutral pack's values, so
+// a branding validation error still paints the current family, never a stale one.
+const ACCENT = (() => {
+  try {
+    const c = api.branding().theme?.ui?.colors || {};
+    return { sun: c.accent || '#fb9569', sun600: c.accentDeep || '#a3481a' };
+  } catch { return { sun: '#fb9569', sun600: '#a3481a' }; }
+})();
+
+// Brand styling for the standalone onboarding pages — sunrise palette + Baloo 2 /
+// Quicksand (accents from the branding pack, config/branding.neutral.json resolved
+// under the instance's own config/branding.json). Light + dark aware; no external
+// dependency beyond an optional Google-Fonts link (system fallback if it doesn't load).
+const PAGE_STYLE = `
+:root{color-scheme:light dark;--sun:${ACCENT.sun};--sun600:${ACCENT.sun600};--sunInk:#2a1305;--coral:#fb7185;--sky:#38bdf8;--sky600:#0284c7;--ok:#16a34a;--warn:#f59e0b;--ink:#2a1f17;--inkSoft:#6b5d52;--card:#fffdfa;--line:#f0e2cf;--bg1:#fde8c8;--bg2:#fff4e6;--bg3:#fffdfa}
+@media (prefers-color-scheme:dark){:root{--ink:#f5efe6;--inkSoft:#cbbdad;--card:#241b13;--line:#3a2c1e;--bg1:#2a1d10;--bg2:#1b130b;--bg3:#130d07}}
+*{box-sizing:border-box}html,body{height:100%}
+body{margin:0;font-family:"Quicksand",system-ui,-apple-system,"Segoe UI",sans-serif;color:var(--ink);background:linear-gradient(180deg,var(--bg1) 0%,var(--bg2) 45%,var(--bg3) 100%);background-attachment:fixed;display:flex;align-items:center;justify-content:center;padding:1.5rem;-webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility}
+.card{width:100%;max-width:30rem;background:var(--card);border:1px solid var(--line);border-radius:20px;padding:2.4rem 2rem 2rem;text-align:center;box-shadow:0 18px 50px -22px rgba(120,60,10,.4),0 2px 8px rgba(120,60,10,.07)}
+.badge-warn{font-size:2.4rem;line-height:1;margin:0 auto 1rem}
+h1{font-family:"Baloo 2",system-ui,sans-serif;font-weight:700;font-size:1.5rem;line-height:1.15;margin:.2rem 0 .55rem}
+.sub{color:var(--inkSoft);font-size:1.02rem;line-height:1.5;margin:0 auto;max-width:24rem}
+.sub p{margin:.6rem 0}
+code{font-family:"Fira Code",ui-monospace,SFMono-Regular,monospace;background:rgba(56,189,248,.14);color:var(--sky600);padding:.12em .45em;border-radius:6px;font-size:.9em;overflow-wrap:anywhere}
+@media (prefers-color-scheme:dark){code{color:var(--sky)}}
+.steps{display:flex;align-items:flex-start;justify-content:center;margin:1.9rem 0 1.1rem}
+.step{flex:1 1 0;max-width:9rem;position:relative}
+.step::before{content:"";position:absolute;top:16px;left:-50%;width:100%;height:3px;background:var(--line);z-index:0;transition:background .4s ease}
+.step:first-child::before{display:none}
+.dot{width:34px;height:34px;border-radius:50%;margin:0 auto;display:grid;place-items:center;background:var(--bg3);border:2px solid var(--line);color:var(--inkSoft);font-weight:700;font-size:.95rem;position:relative;z-index:1;transition:all .4s ease}
+.lbl{margin-top:.55rem;font-size:.78rem;color:var(--inkSoft);font-weight:600;line-height:1.25;padding:0 .2rem}
+.step.done .dot{background:var(--ok);border-color:var(--ok);color:#fff}
+.step.done::before{background:var(--ok)}
+.step.active .dot{border-color:var(--sun);color:var(--sun600);animation:pulse 1.5s ease-in-out infinite}
+.step.active .lbl{color:var(--ink)}
+.step.active .dot::after{content:"";position:absolute;inset:-3px;border-radius:50%;border:2px solid transparent;border-top-color:var(--sun);animation:spin .8s linear infinite}
+@keyframes spin{to{transform:rotate(360deg)}}
+@keyframes pulse{0%,100%{box-shadow:0 0 0 4px rgba(249,115,22,.15)}50%{box-shadow:0 0 0 9px rgba(249,115,22,.04)}}
+@media (prefers-reduced-motion:reduce){.step.active .dot,.step.active .dot::after{animation:none}}
+.status-line{min-height:1.4em;color:var(--inkSoft);font-size:.94rem;margin:.4rem auto 0;max-width:24rem;line-height:1.45}
+.cta{margin-top:1.4rem}
+.btn{display:inline-block;background:var(--sun);color:var(--sunInk);text-decoration:none;font-weight:700;font-family:"Baloo 2",system-ui,sans-serif;padding:.72rem 1.5rem;border-radius:999px;font-size:1.02rem;box-shadow:0 10px 22px -8px rgba(249,115,22,.7);transition:transform .15s ease,box-shadow .15s ease}
+.btn:hover{transform:translateY(-1px);box-shadow:0 14px 28px -8px rgba(249,115,22,.8)}
+.muted{color:var(--inkSoft);opacity:.9;font-size:.85rem;margin:1.1rem auto 0;max-width:24rem;line-height:1.45}
+.hidden{display:none!important}
+`;
+
+// Client script for the PROGRESS variant only (task 2096): poll the public status
+// endpoint, advance the stepper, and auto-open the instance the moment its credentials
+// land. Deliberately contains NO backticks and NO ${...} so it survives the outer
+// template literal verbatim; the only server data it reads is the JSON config block
+// written just above it. Fails soft — a poll hiccup just retries; a long wait reveals a
+// manual "open" button rather than ever falsely erroring. The auto-open countdown runs
+// ONLY when this page is the wizard's pop-up; a same-tab return (pop-up blocked) keeps
+// the founder here with the door and a way back to the checklist (task 1003236).
+const CALLBACK_SCRIPT = `
+(function(){
+  var cfg=window.__CB_SETUP__||{};
+  var state=cfg.state||'',domain=cfg.domain||'';
+  if(!state||!domain)return;
+  var target='https://'+domain;
+  var pollUrl=location.pathname.replace('/callback','/status')+'?state='+encodeURIComponent(state);
+  var steps=document.getElementById('steps'),statusEl=document.getElementById('status');
+  var cta=document.getElementById('cta'),go=document.getElementById('go'),foot=document.getElementById('foot'),back=document.getElementById('back');
+  /* Opened from the wizard as a pop-up (window.opener alive, or the tab still carries the name the wizard gave it):
+     the checklist is in the other tab, so this one may auto-open the instance. Same-tab fallback (pop-up blocked,
+     form target=_self): this IS the founder's checklist tab — never navigate it away; offer both doors (task 1003236). */
+  var popup=!!window.opener||window.name==='ghAppSetup';
+  var finished=false,tries=0,manual=false;
+  function dot(n){return steps.querySelector('[data-step="'+n+'"]');}
+  function setActive(n){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active','done');if(i<n){el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}else if(i===n){el.classList.add('active');}}}
+  function allDone(){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active');el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}}
+  function ready(){if(finished)return;finished=true;allDone();statusEl.textContent='Your instance is ready \\u2014 sign in with GitHub to claim it as owner.';cta.classList.remove('hidden');
+    if(!popup){go.textContent='Open '+domain+' \\u2192';if(back)back.classList.remove('hidden');if(foot)foot.textContent='Your setup checklist is waiting where you left it \\u2014 finish it first, or open your instance now.';return;}
+    var n=4;(function tick(){if(n<=0){location.href=target;return;}go.textContent='Opening '+domain+' in '+n+'\\u2026';n--;setTimeout(tick,1000);})();}
+  function failed(){if(finished)return;finished=true;statusEl.textContent='Setup didn\\u2019t finish. Open your instance page and start the GitHub sign-in setup again.';cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';}
+  function revealManual(){if(manual||finished)return;manual=true;cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';if(foot)foot.textContent='This is taking a little longer than usual \\u2014 you can open your instance now, or keep waiting.';}
+  function schedule(){if(!finished)setTimeout(poll,3000);}
+  function poll(){tries++;fetch(pollUrl,{headers:{accept:'application/json'},cache:'no-store'}).then(function(r){return r.ok?r.json():null;}).then(function(j){if(!j){schedule();return;}if(j.ready||j.status==='done'){ready();return;}if(j.status==='error'||j.status==='expired'){failed();return;}setActive(2);if(tries===40)revealManual();schedule();}).catch(function(){schedule();});}
+  setActive(2);poll();
+})();
+`;
+
+// The standalone landing page for the public GitHub redirect (the mothership serves it;
+// it is NOT the hall shell). Two variants share the Cloud Bongos brand shell (task 2096):
+//   • progress — ok + state + domain: an animated stepper that polls the status endpoint
+//     and auto-opens the instance when its credentials are placed.
+//   • message — everything else (errors + the no-domain success fallback): a calm badge
+//     + `body` (server-authored, trusted HTML).
+function callbackPage({ ok, title, body, state, domain }) {
+  const progress = !!(ok && state && domain);
+  const cfgJson = JSON.stringify({ state: state || '', domain: domain || '' }).replace(/</g, '\\u003c');
+  const head = `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="light dark">
+<title>${esc(title)}</title>
+<link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@600;700;800&family=Quicksand:wght@400;500;600;700&family=Fira+Code&display=swap" rel="stylesheet">
+<style>${PAGE_STYLE}</style></head><body>`;
+  if (progress) {
+    return `${head}
+<main class="card">
+  <h1>${esc(title)}</h1>
+  <p class="sub">Finishing sign-in setup for <code>${esc(domain)}</code>.</p>
+  <div class="steps" id="steps" aria-label="Setup progress">
+    <div class="step done" data-step="1"><div class="dot">✓</div><div class="lbl">GitHub app created</div></div>
+    <div class="step active" data-step="2"><div class="dot">2</div><div class="lbl">Placing credentials</div></div>
+    <div class="step" data-step="3"><div class="dot">3</div><div class="lbl">Ready to sign in</div></div>
+  </div>
+  <p class="status-line" id="status">Hang tight — keep this tab open while we finish.</p>
+  <div class="cta hidden" id="cta"><a class="btn" id="go" href="https://${esc(domain)}">Open ${esc(domain)} →</a></div>
+  <p class="muted hidden" id="back"><a href="/projects?view=new">Finish your remaining setup steps →</a></p>
+  <p class="muted" id="foot">This page opens <code>${esc(domain)}</code> for you the moment it’s ready.</p>
+  <noscript><p class="muted">When setup finishes, open <a href="https://${esc(domain)}">${esc(domain)}</a> and sign in with GitHub — that first sign-in makes you the owner.</p></noscript>
+</main>
+<script>window.__CB_SETUP__=${cfgJson};</script>
+<script>${CALLBACK_SCRIPT}</script>
+</body></html>`;
+  }
+  return `${head}
+<main class="card">
+  <div class="badge-warn">${ok ? '✓' : '⚠️'}</div>
+  <h1>${esc(title)}</h1>
+  <div class="sub">${body || ''}</div>
+</main>
+</body></html>`;
+}
+
+module.exports = { esc, callbackPage };

package/modules/provisioning/routes/provisioning.js

@@ -27,6 +27,9 @@
 //
 // Reaches core ONLY through the doorway src/module-api.js (the one-way rule, ADR
 // 0083); it requires this module's own provisioning.js (same-dir), never a sibling.
+// The GitHub-App callback page's presentation (esc / ACCENT / the stylesheet / the
+// client script / callbackPage) lives in ./callback-page.js — moved out under task
+// 1003570 because this file had reached the 1500-line fitness ratchet.
 'use strict';
 
 const crypto = require('node:crypto');
@@ -36,9 +39,10 @@ const auth = api;
 const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const { onboardPlan, stepsForShape } = require('../onboard-plan');
-const { ALWAYS_ON_CORE, OPTIONAL_MODULES, allStarterBundles, optionalModules } = require('../starter-bundles');
+const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModules, effectiveModules } = require('../starter-bundles');
 const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
+const { callbackPage } = require('./callback-page');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('provisioning');
 
@@ -139,142 +143,6 @@ function badModuleSelection(modules) {
   return null;
 }
 
-// Minimal HTML escaper for the callback landing page (no template engine here).
-function esc(s) {
-  return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
-    { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
-  ));
-}
-
-// Accent pair resolved from the instance's own branding — the pack is the palette
-// authority (task 1002810); the literal fallbacks are the neutral pack's values, so
-// a branding validation error still paints the current family, never a stale one.
-const ACCENT = (() => {
-  try {
-    const c = api.branding().theme?.ui?.colors || {};
-    return { sun: c.accent || '#fb9569', sun600: c.accentDeep || '#a3481a' };
-  } catch { return { sun: '#fb9569', sun600: '#a3481a' }; }
-})();
-
-// Brand styling for the standalone onboarding pages — sunrise palette + Baloo 2 /
-// Quicksand (accents from the branding pack, config/branding.neutral.json resolved
-// under the instance's own config/branding.json). Light + dark aware; no external
-// dependency beyond an optional Google-Fonts link (system fallback if it doesn't load).
-const PAGE_STYLE = `
-:root{color-scheme:light dark;--sun:${ACCENT.sun};--sun600:${ACCENT.sun600};--sunInk:#2a1305;--coral:#fb7185;--sky:#38bdf8;--sky600:#0284c7;--ok:#16a34a;--warn:#f59e0b;--ink:#2a1f17;--inkSoft:#6b5d52;--card:#fffdfa;--line:#f0e2cf;--bg1:#fde8c8;--bg2:#fff4e6;--bg3:#fffdfa}
-@media (prefers-color-scheme:dark){:root{--ink:#f5efe6;--inkSoft:#cbbdad;--card:#241b13;--line:#3a2c1e;--bg1:#2a1d10;--bg2:#1b130b;--bg3:#130d07}}
-*{box-sizing:border-box}html,body{height:100%}
-body{margin:0;font-family:"Quicksand",system-ui,-apple-system,"Segoe UI",sans-serif;color:var(--ink);background:linear-gradient(180deg,var(--bg1) 0%,var(--bg2) 45%,var(--bg3) 100%);background-attachment:fixed;display:flex;align-items:center;justify-content:center;padding:1.5rem;-webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility}
-.card{width:100%;max-width:30rem;background:var(--card);border:1px solid var(--line);border-radius:20px;padding:2.4rem 2rem 2rem;text-align:center;box-shadow:0 18px 50px -22px rgba(120,60,10,.4),0 2px 8px rgba(120,60,10,.07)}
-.badge-warn{font-size:2.4rem;line-height:1;margin:0 auto 1rem}
-h1{font-family:"Baloo 2",system-ui,sans-serif;font-weight:700;font-size:1.5rem;line-height:1.15;margin:.2rem 0 .55rem}
-.sub{color:var(--inkSoft);font-size:1.02rem;line-height:1.5;margin:0 auto;max-width:24rem}
-.sub p{margin:.6rem 0}
-code{font-family:"Fira Code",ui-monospace,SFMono-Regular,monospace;background:rgba(56,189,248,.14);color:var(--sky600);padding:.12em .45em;border-radius:6px;font-size:.9em;overflow-wrap:anywhere}
-@media (prefers-color-scheme:dark){code{color:var(--sky)}}
-.steps{display:flex;align-items:flex-start;justify-content:center;margin:1.9rem 0 1.1rem}
-.step{flex:1 1 0;max-width:9rem;position:relative}
-.step::before{content:"";position:absolute;top:16px;left:-50%;width:100%;height:3px;background:var(--line);z-index:0;transition:background .4s ease}
-.step:first-child::before{display:none}
-.dot{width:34px;height:34px;border-radius:50%;margin:0 auto;display:grid;place-items:center;background:var(--bg3);border:2px solid var(--line);color:var(--inkSoft);font-weight:700;font-size:.95rem;position:relative;z-index:1;transition:all .4s ease}
-.lbl{margin-top:.55rem;font-size:.78rem;color:var(--inkSoft);font-weight:600;line-height:1.25;padding:0 .2rem}
-.step.done .dot{background:var(--ok);border-color:var(--ok);color:#fff}
-.step.done::before{background:var(--ok)}
-.step.active .dot{border-color:var(--sun);color:var(--sun600);animation:pulse 1.5s ease-in-out infinite}
-.step.active .lbl{color:var(--ink)}
-.step.active .dot::after{content:"";position:absolute;inset:-3px;border-radius:50%;border:2px solid transparent;border-top-color:var(--sun);animation:spin .8s linear infinite}
-@keyframes spin{to{transform:rotate(360deg)}}
-@keyframes pulse{0%,100%{box-shadow:0 0 0 4px rgba(249,115,22,.15)}50%{box-shadow:0 0 0 9px rgba(249,115,22,.04)}}
-@media (prefers-reduced-motion:reduce){.step.active .dot,.step.active .dot::after{animation:none}}
-.status-line{min-height:1.4em;color:var(--inkSoft);font-size:.94rem;margin:.4rem auto 0;max-width:24rem;line-height:1.45}
-.cta{margin-top:1.4rem}
-.btn{display:inline-block;background:var(--sun);color:var(--sunInk);text-decoration:none;font-weight:700;font-family:"Baloo 2",system-ui,sans-serif;padding:.72rem 1.5rem;border-radius:999px;font-size:1.02rem;box-shadow:0 10px 22px -8px rgba(249,115,22,.7);transition:transform .15s ease,box-shadow .15s ease}
-.btn:hover{transform:translateY(-1px);box-shadow:0 14px 28px -8px rgba(249,115,22,.8)}
-.muted{color:var(--inkSoft);opacity:.9;font-size:.85rem;margin:1.1rem auto 0;max-width:24rem;line-height:1.45}
-.hidden{display:none!important}
-`;
-
-// Client script for the PROGRESS variant only (task 2096): poll the public status
-// endpoint, advance the stepper, and auto-open the instance the moment its credentials
-// land. Deliberately contains NO backticks and NO ${...} so it survives the outer
-// template literal verbatim; the only server data it reads is the JSON config block
-// written just above it. Fails soft — a poll hiccup just retries; a long wait reveals a
-// manual "open" button rather than ever falsely erroring. The auto-open countdown runs
-// ONLY when this page is the wizard's pop-up; a same-tab return (pop-up blocked) keeps
-// the founder here with the door and a way back to the checklist (task 1003236).
-const CALLBACK_SCRIPT = `
-(function(){
-  var cfg=window.__CB_SETUP__||{};
-  var state=cfg.state||'',domain=cfg.domain||'';
-  if(!state||!domain)return;
-  var target='https://'+domain;
-  var pollUrl=location.pathname.replace('/callback','/status')+'?state='+encodeURIComponent(state);
-  var steps=document.getElementById('steps'),statusEl=document.getElementById('status');
-  var cta=document.getElementById('cta'),go=document.getElementById('go'),foot=document.getElementById('foot'),back=document.getElementById('back');
-  /* Opened from the wizard as a pop-up (window.opener alive, or the tab still carries the name the wizard gave it):
-     the checklist is in the other tab, so this one may auto-open the instance. Same-tab fallback (pop-up blocked,
-     form target=_self): this IS the founder's checklist tab — never navigate it away; offer both doors (task 1003236). */
-  var popup=!!window.opener||window.name==='ghAppSetup';
-  var finished=false,tries=0,manual=false;
-  function dot(n){return steps.querySelector('[data-step="'+n+'"]');}
-  function setActive(n){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active','done');if(i<n){el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}else if(i===n){el.classList.add('active');}}}
-  function allDone(){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active');el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}}
-  function ready(){if(finished)return;finished=true;allDone();statusEl.textContent='Your instance is ready \\u2014 sign in with GitHub to claim it as owner.';cta.classList.remove('hidden');
-    if(!popup){go.textContent='Open '+domain+' \\u2192';if(back)back.classList.remove('hidden');if(foot)foot.textContent='Your setup checklist is waiting where you left it \\u2014 finish it first, or open your instance now.';return;}
-    var n=4;(function tick(){if(n<=0){location.href=target;return;}go.textContent='Opening '+domain+' in '+n+'\\u2026';n--;setTimeout(tick,1000);})();}
-  function failed(){if(finished)return;finished=true;statusEl.textContent='Setup didn\\u2019t finish. Open your instance page and start the GitHub sign-in setup again.';cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';}
-  function revealManual(){if(manual||finished)return;manual=true;cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';if(foot)foot.textContent='This is taking a little longer than usual \\u2014 you can open your instance now, or keep waiting.';}
-  function schedule(){if(!finished)setTimeout(poll,3000);}
-  function poll(){tries++;fetch(pollUrl,{headers:{accept:'application/json'},cache:'no-store'}).then(function(r){return r.ok?r.json():null;}).then(function(j){if(!j){schedule();return;}if(j.ready||j.status==='done'){ready();return;}if(j.status==='error'||j.status==='expired'){failed();return;}setActive(2);if(tries===40)revealManual();schedule();}).catch(function(){schedule();});}
-  setActive(2);poll();
-})();
-`;
-
-// The standalone landing page for the public GitHub redirect (the mothership serves it;
-// it is NOT the hall shell). Two variants share the Cloud Bongos brand shell (task 2096):
-//   • progress — ok + state + domain: an animated stepper that polls the status endpoint
-//     and auto-opens the instance when its credentials are placed.
-//   • message — everything else (errors + the no-domain success fallback): a calm badge
-//     + `body` (server-authored, trusted HTML).
-function callbackPage({ ok, title, body, state, domain }) {
-  const progress = !!(ok && state && domain);
-  const cfgJson = JSON.stringify({ state: state || '', domain: domain || '' }).replace(/</g, '\\u003c');
-  const head = `<!doctype html><html lang="en"><head><meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="color-scheme" content="light dark">
-<title>${esc(title)}</title>
-<link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-<link href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@600;700;800&family=Quicksand:wght@400;500;600;700&family=Fira+Code&display=swap" rel="stylesheet">
-<style>${PAGE_STYLE}</style></head><body>`;
-  if (progress) {
-    return `${head}
-<main class="card">
-  <h1>${esc(title)}</h1>
-  <p class="sub">Finishing sign-in setup for <code>${esc(domain)}</code>.</p>
-  <div class="steps" id="steps" aria-label="Setup progress">
-    <div class="step done" data-step="1"><div class="dot">✓</div><div class="lbl">GitHub app created</div></div>
-    <div class="step active" data-step="2"><div class="dot">2</div><div class="lbl">Placing credentials</div></div>
-    <div class="step" data-step="3"><div class="dot">3</div><div class="lbl">Ready to sign in</div></div>
-  </div>
-  <p class="status-line" id="status">Hang tight — keep this tab open while we finish.</p>
-  <div class="cta hidden" id="cta"><a class="btn" id="go" href="https://${esc(domain)}">Open ${esc(domain)} →</a></div>
-  <p class="muted hidden" id="back"><a href="/projects?view=new">Finish your remaining setup steps →</a></p>
-  <p class="muted" id="foot">This page opens <code>${esc(domain)}</code> for you the moment it’s ready.</p>
-  <noscript><p class="muted">When setup finishes, open <a href="https://${esc(domain)}">${esc(domain)}</a> and sign in with GitHub — that first sign-in makes you the owner.</p></noscript>
-</main>
-<script>window.__CB_SETUP__=${cfgJson};</script>
-<script>${CALLBACK_SCRIPT}</script>
-</body></html>`;
-  }
-  return `${head}
-<main class="card">
-  <div class="badge-warn">${ok ? '✓' : '⚠️'}</div>
-  <h1>${esc(title)}</h1>
-  <div class="sub">${body || ''}</div>
-</main>
-</body></html>`;
-}
-
 // Register this module's kernel seam (ADR 0083 / the registerBoxSeams precedent).
 // Idempotent — the loader calls this factory once at boot, but tests may
 // instantiate the router repeatedly; gating on hasProvider keeps the port
@@ -840,6 +708,8 @@ module.exports = function provisioningRoutes() {
         // project is now on the map, and one who cleared it learns it just left.
         // Re-deriving it from a follow-up GET would let the two answers disagree.
         publish: publishVerdict(updated),
+        // `team_shape` MOVES a bundle-sourced project's modules — effect with cause (ADR 0243 §5).
+        modules: effectiveModules(updated),
       });
     } catch (err) {
       log.error('[provisioning] PATCH /provisioning/instances/:id/detail', err);
@@ -1337,8 +1207,10 @@ module.exports = function provisioningRoutes() {
   // row for. The alternatives were both worse: `GET /modules` needs a session
   // (this wizard is read signed-out) and `GET /public/modules` serves booleans,
   // not copy. Additive — `core` and `bundles` keep their shape.
+  // `byTeamShape` re-resolves each bundle for every answer the About step can give,
+  // riding THIS payload rather than a second read (task 1002341; ADR 0243 §4).
   router.get('/provisioning/starter-bundles', (req, res) => {
-    res.json({ core: [...ALWAYS_ON_CORE], bundles: allStarterBundles(), optional: optionalModules() });
+    res.json({ core: [...ALWAYS_ON_CORE], bundles: starterBundleAnswerTable(), optional: optionalModules() });
   });
 
   // GET /provisioning/recommendations?type=<project type>&team_shape=<interview answer>