@bongos/core 1.19.53 → 1.19.55

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.53",
-  "core_contract": "1.19.53",
-  "source_commit": "47298870569c3fc932d5b2f0cb2d484ce07c506a",
+  "core_version": "1.19.55",
+  "core_contract": "1.19.55",
+  "source_commit": "70c27fe9a074e260e720860e06905fc626d4f2c2",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T19:17:46.981Z",
+  "built_at": "2026-08-11T20:41:26.500Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1219,
+    "functional_verbatim": 1217,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1531,
-  "tree_sha256": "32b317228ddd8735e031c7475020fc3ea23d32069a4660b906853faadf0af1e0",
+  "file_count": 1529,
+  "tree_sha256": "911e16dd941f52958189cbcdaab6b68d02011450d0242220d6b5326212e74b5a",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3117,12 +3117,7 @@
     {
       "path": "modules/hall-ui/public/index.html",
       "mode": "0000644",
-      "sha256": "7df06f1e3cfecbdd4f9aca7404a4fea5d27039f564d0c37fb6a1e55ad6e57ee7"
-    },
-    {
-      "path": "modules/hall-ui/public/instances-panel.js",
-      "mode": "0000644",
-      "sha256": "d42ddfb865d8fa928286be158a19a93299050754366b2d625fe2f92dbbd75ade"
+      "sha256": "d26633abd6e6e0b4675357c0537296c05532df94272c6033e72d9eddedce1bab"
     },
     {
       "path": "modules/hall-ui/public/md-reader.js",
@@ -3154,11 +3149,6 @@
       "mode": "0000644",
       "sha256": "39252c26f1ca28fce403b195868ceae01041daf064507fc5760378c134e9eee5"
     },
-    {
-      "path": "modules/hall-ui/public/new-project-wizard.js",
-      "mode": "0000644",
-      "sha256": "ebd0192e70e01cbf36be4eb977039c2368cc325a6cd64f8de9c7530d25f357c4"
-    },
     {
       "path": "modules/hall-ui/public/not-ready.html",
       "mode": "0000644",
@@ -3292,7 +3282,7 @@
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "41fbe46c9bbc6e9a4397733c070cb2d5e7bfd698d629445f786a44c44a35b0c4"
+      "sha256": "aec0a07f929b88d95d4ec2e7809f0b8cba24855441c8d719a137f2d2f184adf6"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -4042,12 +4032,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cd3aa458c21647143fdfaab782c7022dc3e7eed2ae0d227f201b4c4de80503ec"
+      "sha256": "f7fb6d01950d858aaeefd581b47bd278c43f32ff4257ba353a790afaf8ce91d5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7b005ce2936c09e1dd97ea8891db02f41fc77844c87c52c8d2ff876264715d5e"
+      "sha256": "30f7fe88cf022bede5c4f57466b5386414f54ef0d25bc808293544a596c0450a"
     },
     {
       "path": "public-docs/index.html",
@@ -5667,7 +5657,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b3774e26aaaae064f271b354d54d01003130d9d7cada57c8202b6da60db95d0c"
+      "sha256": "5ad5187a73a1fe3812b0fe8dddb01bc1c179fea6ecc7f54cc3549ec5d154fcfb"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7032,7 +7022,7 @@
     {
       "path": "tests/onboard.mjs",
       "mode": "0000644",
-      "sha256": "5719f40eddad431c8332356073ed10d175b18dd3ad83c967aba117ea2626ca56"
+      "sha256": "61f445855391bfc0e4ab44f8a3f03e074d911e75ed7dbae31293f38314cd3d2e"
     },
     {
       "path": "tests/onboarding_gate.mjs",

package/modules/hall-ui/public/index.html

@@ -117,9 +117,6 @@
 <!-- ADR 0112 (task 1954): the home-page goal-membership inbox — invitations to
      accept + join-requests to approve. Self-registers; hidden when empty. -->
 <script src="/builders/goal-inbox.js?v=2026-07-10-goal-inbox" defer></script>
-<!-- BV1-prov-P6 (task 1947): the Instances widget — self-registers, gated on the provisioning module. -->
-<script src="/builders/new-project-wizard.js?v=2026-07-04-goal35" defer></script>
-<script src="/builders/instances-panel.js?v=2026-07-03-prov-p6" defer></script>
 <script src="/builders/builders.js?v=2026-06-27-r75" defer></script>
 <script src="/builders/copy-on-click.js?v=2026-06-01-copy-1" defer></script>
 </body>

package/modules/hall-ui/public/style.css

@@ -137,7 +137,7 @@ html[data-theme="dark"] body { background: var(--bg); }
      onboarding checklist · welcome panel + setup selector · landing
      goals · work-board task cards · ranks page
      security / roster / admin leftovers (dead — removed by task 2179)
-     toast + overlays · misc shared bits · widget one-offs (wizard, triage,
+     toast + overlays · misc shared bits · widget one-offs (triage,
      goal inbox) · hall-kit components (END — the shared kit, task 2166).
    New page-SPECIFIC styles belong in that page's own <page>.css (the
    primer.css precedent), not here; new SHARED components join the kit
@@ -1860,21 +1860,6 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
 /* primer's article images should never overflow its column */
 .primer-article img { max-width: 100%; }
 
-/* Start-a-project wizard (new-project-wizard.js, provisioning module, task 1983) */
-.np-form { display: grid; gap: 0.75rem; max-width: 32rem; margin-top: 0.5rem; }
-.np-field { display: grid; gap: 0.25rem; font-size: 0.9rem; color: var(--ink-soft); }
-.np-field input { padding: 0.5rem 0.6rem; border: 1px solid var(--border); border-radius: 6px; background: var(--bg-card); color: var(--ink); font: inherit; }
-.np-field input:focus { outline: 2px solid var(--accent-weak); border-color: var(--accent); }
-.np-error { color: var(--danger); font-size: 0.9rem; min-height: 1.2em; margin: 0; }
-.np-create-btn { justify-self: start; padding: 0.55rem 1.1rem; border: 0; border-radius: 6px; background: var(--accent); color: var(--accent-text); font: inherit; font-weight: 600; cursor: pointer; }
-.np-create-btn:hover:not(:disabled) { background: var(--accent-deep); }
-.np-create-btn:disabled { opacity: 0.5; cursor: not-allowed; }
-.np-steps { display: grid; gap: 0.6rem; padding-left: 1.2rem; margin: 0.5rem 0; }
-.np-kv { display: flex; gap: 0.5rem; align-items: baseline; margin-top: 0.25rem; flex-wrap: wrap; }
-.np-kv span { color: var(--ink-faint); font-size: 0.85rem; min-width: 12rem; }
-.np-kv code, .np-steps code { background: var(--surface-2); padding: 0.1rem 0.35rem; border-radius: 4px; word-break: break-all; }
-.np-done { margin-top: 0.5rem; }
-
 /* ---- task 1471: idea-inbox triage cue (Home widget, Metic+) ---- */
 /* Shared .count-pill — work.html defines its own page-scoped copy; the hall
    index widget needs the same look, so it lives in the shared sheet now. */
@@ -2021,15 +2006,12 @@ a.stat-tile:hover {
   border-color: color-mix(in srgb, var(--accent) 35%, var(--border));
   background: color-mix(in srgb, var(--accent) 3%, var(--surface));
 }
-/* Projects card header: title left, "Start a project" disclosure right. */
-.proj-head { display: flex; align-items: baseline; justify-content: space-between; gap: 12px; flex-wrap: wrap; }
-.proj-head .scroll__h { margin: 0; }
 /* The over-budget "More" row — one quiet line, not a card. */
 .home-more { margin: 0; font-size: 13px; color: var(--ink-soft); }
 
 /* task 2184: two-column main zone on wide screens — Home reads as a
    dashboard, not a stack. The attention inbox (and the More row) span both
-   columns; the work + Projects cards sit side by side. Mirrors the
+   columns; the home-main cards sit side by side. Mirrors the
    .view-zone--band grid idiom (cards drop their own margins inside a grid). */
 #zone-home-main { display: grid; grid-template-columns: minmax(0, 1fr); gap: 20px; align-items: start; }
 #zone-home-main > .scroll { margin: 0; }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.53",
+  "version": "1.19.55",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.53",
+      "version": "1.19.55",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.53",
+  "version": "1.19.55",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -533,8 +533,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.51 with no explicit bump. run 31526131183. (task 1002620)
 //   1.19.53 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.52 with no explicit bump. run 31527057565. (task 1002620)
+//   1.19.54 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.53 with no explicit bump. run 31531157867. (task 1002620)
+//   1.19.55 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.54 with no explicit bump. run 31534150701. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.53'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.55'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/onboard.mjs

@@ -97,18 +97,19 @@ test('onboardPlan is the SAME function the provisioning module owns (single sour
   assert.equal(ob.onboardPlan, canonical, 'scripts/gds/onboard.js must re-export the module’s onboardPlan');
 });
 
-test('the web forms (/create + hall wizard) declare EXACTLY the canonical human steps — drift guard', () => {
+test('the web form (/create) declares EXACTLY the canonical human steps — drift guard', () => {
   // goal 35 / criterion 165: "the canonical step sequence is the source of truth;
-  // skill/CLI/hall are forms over it." Each web form tags its human-step <li>s with
+  // skill/CLI/web are forms over it." The web form tags its human-step <li>s with
   // data-onboard-step="<key>"; this asserts that set equals the plan's human-step keys,
   // so adding/removing/renaming a human step in the single source fails CI until every
   // form is updated (and vice-versa) — the sequence can no longer drift between forms.
+  // (The hall new-project wizard was removed in task 1002675 — project creation lives
+  // on the apex /create flow; the skill + CLI + /create remain the canonical forms.)
   const { readFileSync } = require('node:fs');
   const path = require('node:path');
   const humanKeys = ob.onboardPlan().filter((s) => s.kind === 'human').map((s) => s.key).sort();
   const surfaces = {
     '/create landing page': 'public-landing/create.html',
-    'hall new-project wizard': 'modules/hall-ui/public/new-project-wizard.js',
   };
   for (const [name, rel] of Object.entries(surfaces)) {
     const src = readFileSync(path.join(import.meta.dirname, '..', rel), 'utf8');
@@ -120,13 +121,12 @@ test('the web forms (/create + hall wizard) declare EXACTLY the canonical human
 
 test('the one-click GitHub-App manifest path surfaces the CLI-only Enable-Device-Flow step (task 2129)', () => {
   // GitHub defaults Device Flow OFF and the manifest can't enable it, but `bongos login` needs
-  // it — so BOTH manifest surfaces must tell the owner to enable it after the one-click approval.
+  // it — so the manifest surface must tell the owner to enable it after the one-click approval.
   // Assert on a phrase DISTINCT to the one-click caveat: the manual OAuth path already mentions
   // Device Flow (task 2127), so a bare "Device Flow" match wouldn't prove the manifest path carries it.
+  // (`bongos onboard` is the only manifest surface since the hall wizard's removal, task 1002675.)
   const { readFileSync } = require('node:fs');
   const path = require('node:path');
   const onboardSrc = readFileSync(path.join(import.meta.dirname, '..', 'scripts/gds/onboard.js'), 'utf8');
-  const wizardSrc = readFileSync(path.join(import.meta.dirname, '..', 'modules/hall-ui/public/new-project-wizard.js'), 'utf8');
   assert.match(onboardSrc, /cannot enable Device Flow via the manifest/i, 'bongos onboard one-click caveat missing');
-  assert.match(wizardSrc, /Terminal CLI only: after approving, enable/i, 'hall wizard one-click caveat missing');
 });

package/modules/hall-ui/public/instances-panel.js

@@ -1,198 +0,0 @@
-// instances-panel.js — the "Instances" hall widget (provisioning module, ADR 0111
-// §1, task 1947 / BV1-prov-P6).
-//
-// Surfaces provisioning_instances STATE + cost estimate: an owner sees their own
-// instance(s) + request status; an Archon additionally sees the fleet roster + the
-// cost ledger total. One cohesive panel — the caller's own instances always, the
-// fleet appended only when /me returns rank 'archon'.
-//
-// GATED on the provisioning module: registered with module:'provisioning', so
-// contributeHallWidget (dom-utils.js) drops it entirely on an instance that hasn't
-// enabled the module — the belt-and-suspenders to window.__MODULES__ (ADR 0062 §4).
-//
-// Reuses the dev-box hall pattern: a self-contained, self-fetching widget (the
-// goals.js precedent), living in the hall's own served dir so it serves on both the
-// apex and the builders subdomain. Reads the P1 routes only:
-//   GET /provisioning/instances                 (own)
-//   GET /provisioning/fleet                      (archon)
-//   GET /provisioning/fleet/cost-ledger          (archon)
-// READ/STATE only — no mutations. Creating a request is `bongos init` (P5) or the
-// provisioning API; request/teardown buttons here are a deliberate follow-up.
-(function () {
-  'use strict';
-  if (!window.OTB || typeof window.OTB.contributeHallWidget !== 'function') return;
-  const { escapeHtml } = window.OTB;
-  const API = '/api/bongos';
-  // Generated typed client (task 1996 / R09), served as window.BongosClient by
-  // /lib/bongos-client.js. baseUrl:'' passes the full same-origin paths this file
-  // builds through unchanged; result-mode ({ status, ok, data }) preserves control flow 1:1.
-  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
-
-  async function getJSON(path, { softAuth = false } = {}) {
-    const res = await api.request('GET', path);
-    if (res.status === 401) {
-      if (softAuth) { const e = new Error('auth-needed'); e.code = 'auth-needed'; throw e; }
-      window.location.assign(`${API}/auth/web/start`);
-      throw new Error('redirecting to auth');
-    }
-    if (!res.ok) throw new Error(`${path} → ${res.status}`);
-    return res.data;
-  }
-
-  let host = null;
-
-  // Lifecycle status → a badge class from the shared goal-badge family (achieved =
-  // live/green, open = in-flight/neutral, archived = gone/muted). Mirrors the states
-  // in provisioning_001_tables.sql / provisioning.INSTANCE_STATES.
-  const STATUS_CLASS = {
-    active: 'goal-badge--achieved',
-    requested: 'goal-badge--open',
-    provisioning: 'goal-badge--open',
-    tearing_down: 'goal-badge--archived',
-    torn_down: 'goal-badge--archived',
-    error: 'goal-badge--archived',
-  };
-  function statusBadge(status) {
-    const cls = STATUS_CLASS[status] || 'goal-badge--open';
-    return `<span class="goal-badge ${cls}">${escapeHtml(status || 'unknown')}</span>`;
-  }
-  // Monthly cost — co-tenant is $0 (shares an existing box); a dedicated droplet
-  // carries its tier's estimate. VISIBILITY only (ADR 0111 §6), never a bill.
-  function usdMonthly(n) {
-    const v = Number(n) || 0;
-    return v > 0 ? `$${v.toFixed(2)}/mo` : '$0';
-  }
-  function openIntentNote(inst) {
-    if (!inst.open_intent) return '';
-    return ` <span class="ledger__note">(${escapeHtml(inst.open_intent.action)} ${escapeHtml(inst.open_intent.state)})</span>`;
-  }
-
-  function ownRow(inst) {
-    return `<tr>
-        <td>${escapeHtml(inst.slug || '—')}</td>
-        <td>${statusBadge(inst.status)}${openIntentNote(inst)}</td>
-        <td>${escapeHtml(inst.hosting_shape || '—')}</td>
-        <td>${inst.domain ? escapeHtml(inst.domain) : '—'}</td>
-        <td>${usdMonthly(inst.cost_estimate_usd)}</td>
-      </tr>`;
-  }
-
-  function fleetRow(inst) {
-    const owner = inst.owner || {};
-    return `<tr>
-        <td>${escapeHtml(inst.slug || '—')}</td>
-        <td>${escapeHtml(owner.github_login || owner.display_name || '—')}</td>
-        <td>${statusBadge(inst.status)}</td>
-        <td>${escapeHtml(inst.hosting_shape || '—')}</td>
-        <td>${inst.tier ? escapeHtml(inst.tier) : '—'}</td>
-        <td>${usdMonthly(inst.cost_estimate_usd)}</td>
-      </tr>`;
-  }
-
-  // Paint the caller's own instances into #instances-own-body.
-  function renderOwn(instances) {
-    const body = host.querySelector('#instances-own-body');
-    if (!body) return;
-    if (!instances.length) {
-      body.innerHTML = '<p class="goal-empty">No instances yet. Create one with <code>bongos init</code> or the provisioning API — it’ll show here with its status and cost.</p>';
-      return;
-    }
-    body.innerHTML =
-      '<table class="ledger"><thead><tr><th>Instance</th><th>Status</th><th>Shape</th><th>Domain</th><th>Cost</th></tr></thead>' +
-      `<tbody>${instances.map(ownRow).join('')}</tbody></table>`;
-  }
-
-  // Paint the fleet + cost-ledger total into #instances-fleet (Archon only). Reveals
-  // the section (hidden by default in the skeleton) once data is in hand.
-  function renderFleet(fleet, ledger) {
-    const wrap = host.querySelector('#instances-fleet');
-    const body = host.querySelector('#instances-fleet-body');
-    if (!wrap || !body) return;
-    wrap.hidden = false;
-    if (!fleet.length) {
-      body.innerHTML = '<p class="goal-empty">No provisioned instances across the fleet yet.</p>';
-      return;
-    }
-    const total = ledger && typeof ledger.total_monthly_usd === 'number' ? ledger.total_monthly_usd : null;
-    body.innerHTML =
-      '<table class="ledger"><thead><tr><th>Instance</th><th>Owner</th><th>Status</th><th>Shape</th><th>Tier</th><th>Cost</th></tr></thead>' +
-      `<tbody>${fleet.map(fleetRow).join('')}</tbody></table>` +
-      (total !== null ? `<p class="ledger__note">Fleet estimate: <strong>${usdMonthly(total)}</strong> across ${fleet.length} instance${fleet.length === 1 ? '' : 's'} (co-tenant instances are $0).</p>` : '');
-  }
-
-  async function load() {
-    if (!host) return;
-    try {
-      // Own instances (any authenticated builder).
-      const mine = await getJSON(`${API}/provisioning/instances`);
-      renderOwn(Array.isArray(mine.instances) ? mine.instances : []);
-    } catch (err) {
-      const body = host.querySelector('#instances-own-body');
-      if (body) body.innerHTML = '<p class="goal-empty">Your instances couldn’t be loaded just now. Refresh to try again.</p>';
-      console.error('[hall] instances load failed', err);
-    }
-
-    // Archon-only: the fleet roster + cost ledger. Read /me softly; a non-Archon (or
-    // an auth hiccup) simply never reveals the fleet section.
-    try {
-      const me = await getJSON(`${API}/me`, { softAuth: true }).catch(() => null);
-      const rank = me && me.builder ? me.builder.rank : null;
-      // ADR 0157: `provisioning.fleet.manage` moved archon→metic, so the fleet section
-      // reveals for Metic+ too. Cosmetic — the route gates are the wall.
-      if (rank !== 'metic' && rank !== 'archon') return;
-      const [fleet, ledger] = await Promise.all([
-        getJSON(`${API}/provisioning/fleet`).catch(() => ({ instances: [] })),
-        getJSON(`${API}/provisioning/fleet/cost-ledger`).catch(() => null),
-      ]);
-      renderFleet(Array.isArray(fleet.instances) ? fleet.instances : [], ledger);
-    } catch (err) {
-      console.error('[hall] instances fleet load failed', err);
-    }
-  }
-
-  // task 2169: this is the "Projects" card — instances state + the
-  // Start-a-project wizard merged. The wizard (an idle multi-step form, the
-  // page's worst length offender as its own card) renders ON DEMAND behind the
-  // header button, via window.OTBNewProject (new-project-wizard.js).
-  const SKELETON =
-    '<div class="proj-head">' +
-      '<h2 id="instances-h" class="scroll__h">Projects</h2>' +
-      '<button type="button" class="btn-ghost" id="new-project-toggle" aria-expanded="false" aria-controls="new-project-mount">+ Start a project</button>' +
-    '</div>' +
-    '<p class="scroll__lede">Hosting you’ve provisioned through Cloud Bongos — each instance’s status and estimated monthly cost. Provision one right here, or with <code>bongos init</code>.</p>' +
-    '<div id="new-project-mount" hidden></div>' +
-    '<div id="instances-own-body"><div class="profile__placeholder">Loading your instances…</div></div>' +
-    '<div id="instances-fleet" hidden>' +
-      '<h3 class="scroll__h" style="font-size:1rem;margin-top:1rem">Fleet</h3>' +
-      '<p class="scroll__lede">Every owner’s instances and the fleet cost estimate (Archon view).</p>' +
-      '<div id="instances-fleet-body"><div class="profile__placeholder">Loading the fleet…</div></div>' +
-    '</div>';
-
-  function mount(hostEl) {
-    host = hostEl;
-    host.innerHTML = SKELETON;
-    const toggle = host.querySelector('#new-project-toggle');
-    const wizardMount = host.querySelector('#new-project-mount');
-    let wizardRendered = false;
-    toggle?.addEventListener('click', () => {
-      if (!wizardRendered && window.OTBNewProject) {
-        window.OTBNewProject.renderInto(wizardMount);
-        wizardRendered = true;
-      }
-      const open = wizardMount.hidden;
-      wizardMount.hidden = !open;
-      toggle.setAttribute('aria-expanded', String(open));
-      toggle.textContent = open ? '− Start a project' : '+ Start a project';
-    });
-    load();
-  }
-
-  // summary: true (task 2177) — a module-contributed home-main card must be
-  // row-capped with no pager/filter. This one lists the builder's instances and
-  // links out to the full surface, which is exactly the summary shape.
-  window.OTB.contributeHallWidget({
-    id: 'instances-scroll', label: 'Projects', order: 33,
-    module: 'provisioning', view: 'home', zone: 'home-main', summary: true,
-    labelledby: 'instances-h', mount,
-  });
-})();

package/modules/hall-ui/public/new-project-wizard.js

@@ -1,199 +0,0 @@
-// new-project-wizard.js — the "Start a project" flow (provisioning module,
-// ADR 0111 / BONGOS-V1 goal 35, task 1983).
-//
-// The most ACCESSIBLE form of the canonical onboarding runbook (the /new-project skill,
-// task 1981; the `bongos onboard` CLI, task 1982) — a point-and-click wizard for a
-// non-technical owner. It files the provisioning REQUEST (the web tier only ENQUEUES —
-// POST /provisioning/instances; the control-plane runner does the real standup, trust
-// boundary intact, ADR 0111 §2) as a STANDALONE instance (ADR 0108), then renders the
-// four irreducibly-human steps UI-first (create the repo, the OAuth app + secret, first
-// sign-in) with the exact pinned values, and points at the Instances panel for status.
-//
-// NOT a hall widget — it registers nothing with contributeHallWidget and owns no
-// zone. It exposes window.OTBNewProject, which instances-panel.js's header button
-// opens as a modal; that panel carries the provisioning gate + the home-main budget
-// for both. (Correcting a stale header, task 2177: this file used to describe itself
-// as a registered widget, which is why the "wizard" in that task's acceptance list
-// could not be found in the registry.)
-(function () {
-  'use strict';
-  if (!window.OTB || typeof window.OTB.contributeHallWidget !== 'function') return;
-  const { escapeHtml } = window.OTB;
-  const API = '/api/bongos';
-
-  // Mirror provisioning.isValidSlug (DNS/db-safe): 2–40 of [a-z0-9-], starts+ends
-  // alnum, no double dash. Client-side pre-check; the server re-validates.
-  function validSlug(s) {
-    const v = String(s || '');
-    return v.length >= 2 && v.length <= 40 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(v) && !v.includes('--');
-  }
-
-  // The pinned GitHub OAuth-app values for a domain (auth.js WEB_REDIRECT_ORIGIN —
-  // callback is the apex /api/gds/auth/web/callback). Mirrors onboard.oauthAppInstructions.
-  function oauthAppValues(domain) {
-    const origin = `https://${domain}`;
-    return { homepageUrl: origin, callbackUrl: `${origin}/api/gds/auth/web/callback` };
-  }
-
-  let host = null;
-
-  async function postJSON(path, body) {
-    const res = await fetch(path, {
-      method: 'POST', credentials: 'same-origin',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(body),
-    });
-    if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); throw new Error('redirecting to auth'); }
-    const data = await res.json().catch(() => ({}));
-    if (!res.ok) { const e = new Error((data.error && (data.error.message || data.error.code)) || `HTTP ${res.status}`); e.data = data; throw e; }
-    return data;
-  }
-
-  // File a GitHub-App-Manifest onboarding link for the just-created instance (task 2080,
-  // ADR 0133) and NAVIGATE the browser to GitHub's pre-filled "create App" screen. The
-  // manifest rides a hidden form field; GitHub echoes our one-time `state`. After the
-  // owner approves, GitHub redirects to the mothership callback and the control-plane
-  // runner places the creds automatically — no secret is ever pasted. `account` is
-  // 'personal' | 'org'.
-  async function launchGithubApp(instanceId, account) {
-    const data = await postJSON(`${API}/provisioning/instances/${instanceId}/github-app`, account ? { account } : {});
-    const form = document.createElement('form');
-    form.method = 'POST';
-    form.action = data.post_url; // https://github.com/…/settings/apps/new?state=<one-time>
-    const input = document.createElement('input');
-    input.type = 'hidden';
-    input.name = 'manifest';
-    input.value = JSON.stringify(data.manifest);
-    form.appendChild(input);
-    document.body.appendChild(form);
-    form.submit(); // navigates away to GitHub
-  }
-
-  // After the request is filed, render the human-only next steps + a pointer to the
-  // Instances panel for status. The FIRST step branches on greenfield vs adopt (ADR
-  // 0121 §Decision 1 / task 2046). GitHub sign-in is now ONE CLICK via the App Manifest
-  // flow (task 2080) — the manual OAuth-app path is kept as a collapsible fallback.
-  function renderNextSteps(instanceId, slug, domain, mode) {
-    const adopt = mode === 'adopt';
-    const oa = domain ? oauthAppValues(domain) : null;
-    const dnsNote = domain ? '' : '<li>Add a domain you own, then re-run to wire the address (a domain is needed before sign-in works).</li>';
-    const repoStep = adopt
-      ? `<li data-onboard-step="github-repo"><strong>Layer onto your existing repo</strong> — in your repo run <code>bongos init --adopt</code>. It shows a conflict pre-flight (migrations, CI, protected paths) and writes <em>nothing</em> until you accept; it never overwrites your files, and it imports your existing backlog (GitHub issues / a TODO/ROADMAP file). Commit + push.</li>`
-      : '<li data-onboard-step="github-repo"><strong>Create the empty GitHub repo</strong> — github.com → New repository, leave it empty.</li>';
-    // The one-click GitHub sign-in step + a collapsible manual fallback (only when a
-    // domain is set — the App needs a real callback host).
-    const signInStep = oa ? `<li data-onboard-step="oauth-app"><strong>Set up GitHub sign-in — one click</strong>. We’ll open GitHub with a pre-filled app; approve it, and we place the credentials on your instance automatically (no secret to copy).
-        <div class="np-signin-actions">
-          <button id="np-github-app" type="button" class="np-create-btn" data-instance="${escapeHtml(String(instanceId))}">Set up GitHub sign-in</button>
-          <span id="np-github-app-msg" class="ledger__note"></span>
-        </div>
-        <p class="ledger__note">Terminal CLI only: after approving, enable <strong>Device Flow</strong> on the app (GitHub → Settings → Developer settings → GitHub Apps → your app → “Enable Device Flow”) so <code>bongos login</code> works. Web sign-in needs nothing.</p>
-        <details class="np-manual"><summary class="ledger__note">Prefer to do it by hand?</summary>
-          <ol class="np-steps">
-            <li><strong>Create the GitHub OAuth app</strong> — GitHub → <em>your account's</em> Settings → Developer settings → OAuth Apps → New OAuth App.
-              <div class="np-kv"><span>Homepage URL</span><code>${escapeHtml(oa.homepageUrl)}</code></div>
-              <div class="np-kv"><span>Authorization callback URL</span><code>${escapeHtml(oa.callbackUrl)}</code></div>
-              <div class="np-kv"><span>Enable Device Flow</span><code>✅ required — the terminal login uses it (off by default)</code></div>
-            </li>
-            <li><strong>Place the secret — verified</strong> (never hand-edit the env file): on the control plane run
-              <code>bongos … oauth-secret place ${escapeHtml(slug)} --client-id &lt;id&gt; --client-secret &lt;secret&gt; --apply</code>.</li>
-          </ol>
-        </details>
-      </li>` : '';
-    return `<div class="np-done">
-      <p class="scroll__lede">✓ Provisioning requested for <strong>${escapeHtml(slug)}</strong> (standalone${adopt ? ', adopting your existing repo' : ''}). The control plane stands it up — watch its status in <strong>Instances</strong> below.</p>
-      <h3 class="scroll__h" style="font-size:1rem">Your steps (the parts only you can do):</h3>
-      <ol class="np-steps">
-        ${repoStep}
-        ${dnsNote}
-        ${signInStep}
-        ${oa ? `<li data-onboard-step="first-sign-in"><strong>First sign-in</strong> — once the instance is live, open <code>${escapeHtml(oa.homepageUrl)}</code> and sign in with GitHub; that makes you the owner (Archon).</li>
-        <li><strong>Verify</strong> — <code>${escapeHtml(oa.homepageUrl)}/healthz</code> should report <code>auth_configured: true</code>.</li>` : ''}
-      </ol>
-      <p class="ledger__note">This is the same sequence the <code>/new-project</code> assistant and <code>bongos onboard</code> use.</p>
-    </div>`;
-  }
-
-  async function submit() {
-    const q = (id) => host.querySelector(id);
-    const productName = q('#np-name').value.trim();
-    const owner = q('#np-owner').value.trim();
-    const repo = q('#np-repo').value.trim();
-    const slug = q('#np-slug').value.trim().toLowerCase();
-    const domain = q('#np-domain').value.trim();
-    const mode = q('#np-mode') ? q('#np-mode').value : 'greenfield'; // greenfield | adopt (ADR 0121)
-    const err = q('#np-error');
-    err.textContent = '';
-
-    if (!productName) { err.textContent = 'Give the project a name.'; return; }
-    if (!owner || !repo) { err.textContent = 'Give the GitHub repo (owner and name).'; return; }
-    if (!validSlug(slug)) { err.textContent = 'Slug must be 2–40 lowercase letters/numbers/dashes (no leading/trailing/double dash).'; return; }
-
-    const btn = q('#np-create');
-    btn.disabled = true; btn.textContent = 'Requesting…';
-    try {
-      const data = await postJSON(`${API}/provisioning/instances`, {
-        slug,
-        hosting_shape: 'standalone',
-        domain: domain || undefined,
-        target_ref: `${owner}/${repo}`,
-        // The mode is LOAD-BEARING for the control-plane runner, not just for which
-        // checklist we render (task 1002562): 'adopt' makes it clone + layer onto the
-        // owner's existing history instead of pushing a fresh tree, which an existing
-        // repo rejects. This form already tracked `mode` purely for renderNextSteps —
-        // it has to reach the server too.
-        onboard_mode: mode,
-      });
-      const instanceId = data && data.instance ? data.instance.id : null;
-      q('#np-form').hidden = true;
-      q('#np-result').innerHTML = renderNextSteps(instanceId, slug, domain, mode);
-      // Wire the one-click GitHub sign-in button (task 2080), if a domain gave us one.
-      const gh = q('#np-github-app');
-      if (gh) gh.addEventListener('click', async () => {
-        const msg = q('#np-github-app-msg');
-        gh.disabled = true; gh.textContent = 'Opening GitHub…'; if (msg) msg.textContent = '';
-        try {
-          await launchGithubApp(gh.getAttribute('data-instance'));
-        } catch (e2) {
-          gh.disabled = false; gh.textContent = 'Set up GitHub sign-in';
-          if (msg) msg.textContent = e2 && e2.message ? `Couldn’t start it: ${e2.message}` : 'Couldn’t start it — try again.';
-        }
-      });
-    } catch (e) {
-      err.textContent = e && e.message ? `Couldn’t request it: ${e.message}` : 'Couldn’t request it — try again.';
-      btn.disabled = false; btn.textContent = 'Create project';
-    }
-  }
-
-  const SKELETON =
-    '<h2 id="np-h" class="scroll__h">Start a project</h2>' +
-    '<p class="scroll__lede">Stand up a <strong>standalone</strong> Cloud Bongos instance — its own repo running a pinned copy of the platform. Start fresh, or adopt a repo you already have. We file the request and walk you through the few steps only you can do.</p>' +
-    '<div id="np-form" class="np-form">' +
-      '<label class="np-field"><span>Project name</span><input id="np-name" type="text" placeholder="Mercury" autocomplete="off"></label>' +
-      '<label class="np-field"><span>Starting from</span><select id="np-mode">' +
-        '<option value="greenfield">A new, empty repo (greenfield)</option>' +
-        '<option value="adopt">A repo I already have (adopt)</option>' +
-      '</select></label>' +
-      '<label class="np-field"><span>GitHub repo owner</span><input id="np-owner" type="text" placeholder="acme" autocomplete="off"></label>' +
-      '<label class="np-field"><span>GitHub repo name</span><input id="np-repo" type="text" placeholder="mercury" autocomplete="off"></label>' +
-      '<label class="np-field"><span>Instance slug</span><input id="np-slug" type="text" placeholder="mercury" autocomplete="off"></label>' +
-      '<label class="np-field"><span>Domain you own <span class="ledger__note">(optional now)</span></span><input id="np-domain" type="text" placeholder="mercury.example.com" autocomplete="off"></label>' +
-      '<p id="np-error" class="np-error" role="alert"></p>' +
-      '<button id="np-create" type="button" class="np-create-btn">Create project</button>' +
-    '</div>' +
-    '<div id="np-result"></div>';
-
-  function mount(hostEl) {
-    host = hostEl;
-    host.innerHTML = SKELETON;
-    const btn = host.querySelector('#np-create');
-    if (btn) btn.addEventListener('click', submit);
-  }
-
-  // task 2169: the wizard no longer registers its own always-open Home card —
-  // an idle multi-step form was the page's worst length offender. It renders
-  // on demand into the Projects card (instances-panel.js) behind its
-  // "Start a project" disclosure button. Module gating is inherited: only the
-  // provisioning-gated Projects card ever calls this.
-  window.OTBNewProject = { renderInto: mount };
-})();