@bongos/core 1.19.613 → 1.19.614

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.613",
-  "core_contract": "1.19.613",
-  "source_commit": "86c4eeb0c9ed29d15cfa0331071100cabd8c0837",
+  "core_version": "1.19.614",
+  "core_contract": "1.19.614",
+  "source_commit": "abed8329cedd284ae48ca75f74b991eed0bb00aa",
   "source_ref": "HEAD",
-  "built_at": "2026-09-09T04:38:02.786Z",
+  "built_at": "2026-09-09T05:18:42.201Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 459,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2563,
-  "tree_sha256": "9254c8e86a95c04620946437ea658877a5d12f5d40f1342f3088ea735f733d71",
+  "tree_sha256": "6eaf4625f3f277d948abd11748dcf8e2f7f24062b460a58dd7ea3c7033156dea",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1052,7 +1052,7 @@
     {
       "path": "docs/adr/0111-instance-hosting-provisioning-module.md",
       "mode": "0000644",
-      "sha256": "70841ba00274c070f64a7de0d042db406b4ebac51f8073b422a4f2cac0673cb0"
+      "sha256": "240c3633b9093644c55d7141eac69748eafa294bb393dab274cad508aeee248e"
     },
     {
       "path": "docs/adr/0112-private-goals-invitations-join-requests.md",
@@ -2737,7 +2737,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b91dcdf5bd99bbaa08679535a2ee122afb40367b275d7f0790236fc358283890"
+      "sha256": "df3d7a5da1b66f12598a82a180eb3b3373938ef7a95e17977229adf999b02195"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7637,12 +7637,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "16da9aa01a2a13938d0160a61d612c0d3757631e74c7236a545b86a87bd5fd1d"
+      "sha256": "abc3e3e3456a393e7a2113807d07adcc257b8e8af6369e6c05fc0bdf32340d49"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8137fdc6cc9e9bdebbf3376f0a3095c75818c1e807c3fec8f37f95d4313cd37d"
+      "sha256": "7301d49faecbce2fb275d06852d671f82f97df62ff7c94a0451e719a2457e257"
     },
     {
       "path": "public-docs/index.html",
@@ -8417,7 +8417,7 @@
     {
       "path": "scripts/gds/provision-net.js",
       "mode": "0000644",
-      "sha256": "86c308f807a27f448a1f90f4257e74238c177b885468b95b89d379c7249366fa"
+      "sha256": "502b1aeb571d463aea02ef4db3e848d23fdd8c865e7bfc37f66679c09cc203a9"
     },
     {
       "path": "scripts/gds/provision-repo.js",
@@ -8427,12 +8427,12 @@
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "14ef8b2a3581c93b27983d0e566b5cc317d1a5d3b6367ff8eb7ffef7e0b3f54d"
+      "sha256": "2b2c2a74514de43e9015e38db56da1daff040488bf6b10ffa4bfa10042995dea"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "2fdb42802ae0bbefe79427d7e9a5d5967a89cb2ce757b2df5f49e9da25e60703"
+      "sha256": "82fb65fea5dd9a33770690c902680cb428eb74b1c2abdaeab7f89f444ae1c11f"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9367,7 +9367,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5f2889a1593cd4d896fdb5bf56cbad44d99809b8a60e955bf378d321f8320891"
+      "sha256": "05f2b36b4f1ebb20ba4a425d9669d0ac29326557c67d3deb61a63e3e5a06a261"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11817,7 +11817,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "9744b866060ae83fc560f65e579fc30e73957ff21329994ca3d581dbe1726053"
+      "sha256": "d70cc9bd673dce403787814849abbeef9ed0ea01f9e38a2d3288886879490830"
     },
     {
       "path": "tests/provision_restart.mjs",

package/docs/adr/0111-instance-hosting-provisioning-module.md

@@ -124,6 +124,7 @@ Inherit the budget DNA. **Default to the cheapest shape** — a co-tenant proces
 - **`bongos init` gains an infra arm** — its infra answers flow into a provisioning request instead of only filing manual kickoff tasks.
 - **Deferred / risks:** the **managed fleet control plane** is genuinely greenfield and sits above the locked per-repo GDS model — it needs its own spec once Mercury lands. **Billing/metering** is greenfield (no capability today). **Domain registration** is deferred. On-demand TLS must be hostname-allow-listed to what was actually provisioned. `bongos upgrade` is still a stub (R86).
 - **Licensing unchanged** — managed is a service on the same AGPL artifact ([ADR 0065](<redacted>.md) §2); no open-core, no relicensing.
+- **A provisioned instance loads its OWN branding pack** ([task 1003740](https://cloudbongos.com/builders#/task/1003740)). Provisioning originally pinned every instance's pack to the shared, committed neutral starter, because the co-tenant model of the day ran ONE checkout for all instances and differentiated them purely by env. Under [ADR 0108](<redacted>.md) that is no longer true — each instance has its own checkout, its own `config/branding.json` written at init, and runs `node_modules/@bongos/core`. The pin outlived its premise, and because `src/branding.js`'s env overrides carry domains, `auth.idp` and landing but **never `identity.productName`**, every hosted instance served the platform's name as its own: `GET /api/gds/instance` on hermeslines-marketing, mercury and demo all answered "Cloud Bongos" while their own packs on disk said otherwise. `bongos login <instance>` therefore greeted a newcomer with the wrong project at the moment they were deciding whether to trust it, and nothing looked — a healthy instance passes `/healthz` while lying about who it is. Provisioning now writes no branding-file pin at all, so `src/branding.js`'s default (`<instanceRoot>/config/branding.json`, falling back to neutral when absent) applies; standup gained an identity probe beside the healthz one, which **warns** rather than fails, since an owner may legitimately name a project after the platform.
 - **Follow-up tasks seeded** under BONGOS-V1 / goal 26 (idempotent seeder `scripts/gds/seed-provisioning-tasks.js`, `source_ref = <redacted>*`):
   1. **Scaffold the `provisioning` module** — manifest + `provisioning_*` tables + the web-tier intent/state routes (own + Archon), no token handling. *(buildable now)*
   2. **Extract the shared DO + Cloudflare control-plane clients** so `box.js` and `provision.js` reuse them without a module→module import (dev-box byte-identical). *(buildable now; enables 3)*

package/docs/module-api-changelog.md

@@ -1675,5 +1675,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.611 with no explicit bump. run 34310708322. (task 1002620)
   1.19.613 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.612 with no explicit bump. run 34311691842. (task 1002620)
+  1.19.614 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.613 with no explicit bump. run 34314327601. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.613",
+  "version": "1.19.614",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.613",
+      "version": "1.19.614",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.613",
+  "version": "1.19.614",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-net.js

@@ -244,6 +244,34 @@ function healthzCmd(inst) {
   return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/healthz`;
 }
 
+// The instance manifest, read over loopback — the identity companion to healthzCmd (task 1003740).
+function identityCmd(inst) {
+  return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/api/gds/instance`;
+}
+
+// Does a freshly provisioned instance report ITSELF, or the platform it is hosted on?
+//
+// WHY THIS EXISTS. Provisioning used to pin every instance's branding pack to the shared neutral
+// starter (see provision-units.js), a leftover from the co-tenant model that shared one checkout. Under
+// ADR 0108 each instance has its own, and src/branding.js's ENV_OVERRIDES carry domains but never
+// identity.productName — so every hosted instance served "Cloud Bongos" as its own name for
+// months, greeting newcomers with the wrong project at sign-in. Nothing looked.
+//
+// PURE so it is testable without a box: takes the parsed manifest and returns a verdict.
+// Deliberately a WARNING, not a failure — an owner may legitimately name a project after the
+// platform, and provisioning must not refuse a working instance over a name.
+function identityVerdict({ manifest, slug, neutralName }) {
+  const name = manifest && (manifest.name || (manifest.brand && manifest.brand.identity && manifest.brand.identity.productName));
+  if (!name) return { ok: null, reason: 'no name in manifest' };
+  // The bug's exact shape: the instance answers with the neutral pack's name while its slug says
+  // it is somebody else. A project genuinely called that keeps its name and only trips when the
+  // slug matches too — in which case it is not the bug.
+  if (neutralName && name === neutralName && slug && slug !== neutralName) {
+    return { ok: false, name, reason: `serves the platform default name "${name}" instead of its own` };
+  }
+  return { ok: true, name };
+}
+
 // ---------------------------------------------------------------------------
 // The injectable executor. dry-run → log-only; --apply → child_process.
 // ---------------------------------------------------------------------------
@@ -260,6 +288,8 @@ module.exports = {
   federateInstance,
   federationHubOrigin,
   healthzCmd,
+  identityCmd,
+  identityVerdict,
   shouldFederate,
   zoneForDomain,
 };

package/scripts/gds/provision-units.js

@@ -121,16 +121,30 @@ WantedBy=timers.target
 `;
 }
 
-// The branding pack a provisioned CO-TENANT instance loads: the shared, committed
-// neutral starter (the co-tenant model shares ONE checkout, differentiated only by
-// env — src/branding.js's GDS_BRANDING_FILE knob). Per-instance identity/domains
-// therefore ride ENV OVERRIDES, not a divergent pack. Kept as a constant so the
-// GDS_BRANDING_FILE line below and the env-var PREFIX (which must equal this pack's
-// envPrefix, or src/branding.js's ENV_OVERRIDES never fire) can't drift apart.
-const PROVISIONED_BRANDING_FILE = 'config/branding.neutral.json';
+// The pack the provisioner reads to learn an instance's env-var PREFIX floor.
+//
+// It is NOT the pack the instance loads, and that distinction is the whole of task 1003740.
+// The original co-tenant model shared ONE checkout across every instance, differentiated only by
+// env, so provisioning pinned the pack to `config/branding.neutral.json` and let identity
+// ride ENV OVERRIDES. That model is gone: under ADR 0108 each co-tenant has its own checkout
+// (`WorkingDirectory=/srv/<base>/<slug>`, running `node_modules/@bongos/core`) and its own
+// `config/branding.json` written at init.
+//
+// The pin outlived it, and src/branding.js's ENV_OVERRIDES cover domains, auth.idp and landing —
+// never `identity.productName`. So every hosted instance kept serving the NEUTRAL pack's name:
+// GET /api/gds/instance on hermeslines-marketing, mercury and demo all answered "Cloud Bongos"
+// while each instance's own pack on disk said otherwise, and `bongos login <instance>` greeted a
+// newcomer with the platform's name at the moment they were deciding whether to trust it.
+//
+// The instance now loads its own pack by src/branding.js's DEFAULT (INSTANCE_PATH =
+// <instanceRoot>/config/branding.json), which falls back to neutral when absent — so no
+// branding-file env line is written at all. Reading the neutral pack HERE is still correct: it is
+// the prefix floor an instance inherits unless its own pack overrides envPrefix, and every live
+// co-tenant pack pins `envPrefix: "CLOUDBONGOS"` explicitly.
+const ENV_PREFIX_PACK = 'config/branding.neutral.json';
 
 // The env-var prefix a provisioned instance actually RESOLVES — i.e. the envPrefix
-// of the pack it loads (PROVISIONED_BRANDING_FILE). src/instance-config.resolveEnv
+// of the pack it loads (ENV_PREFIX_PACK). src/instance-config.resolveEnv
 // reads <envPrefix>_<SUFFIX>, and src/branding.resolveBranding applies
 // <envPrefix>_{PUBLIC,BUILDERS,…}_ORIGIN overrides — so a web.env var only takes
 // effect under THIS prefix. Read from the pack (fail-soft to the vanilla default)
@@ -139,7 +153,7 @@ const PROVISIONED_BRANDING_FILE = 'config/branding.neutral.json';
 // the OAuth creds were silently unreadable — task 1972.)
 function provisionedEnvPrefix() {
   try {
-    const pack = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, PROVISIONED_BRANDING_FILE), 'utf8'));
+    const pack = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, ENV_PREFIX_PACK), 'utf8'));
     return pack.envPrefix || 'CLOUDBONGOS';
   } catch { return 'CLOUDBONGOS'; }
 }
@@ -228,8 +242,7 @@ GITHUB_APP_PRIVATE_KEY=${String(appPem).replace(/\r?\n/g, '\\n')}
 ${credComment}
 ${prefix}_GITHUB_CLIENT_ID=${clientId || ''}
 ${prefix}_GITHUB_CLIENT_SECRET=${clientSecret || ''}
-${firstAdminLine}GDS_BRANDING_FILE=${PROVISIONED_BRANDING_FILE}
-${originLines}${appLines}PORT=${inst.port}
+${firstAdminLine}${originLines}${appLines}PORT=${inst.port}
 PGDATABASE=${dbName(inst)}
 ${fedLines}${settingsEnvLines(inst, prefix)}`;
 }
@@ -318,7 +331,7 @@ function upsertEnvVars(body, vars) {
 // env the hub already runs under). Null → not hub-configured → shouldFederate is false.
 
 module.exports = {
-  PROVISIONED_BRANDING_FILE,
+  ENV_PREFIX_PACK,
   backupScriptPath,
   backupService,
   backupServicePath,

package/scripts/gds/provision.js

@@ -52,7 +52,7 @@ const crypto = require('node:crypto');
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
-const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, shouldFederate, zoneForDomain } = require('./provision-net.js');
+const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
 
 function makeExec({ apply, log = console.log, remoteHost = null, remoteCwd = null, sshOpts = '' }) {
   // `shown` (task 1003140): what to LOG in place of the command text — for a command
@@ -503,6 +503,32 @@ async function provisionInstance(inst, deps) {
     }
   } else log('    (verified post-boot)');
 
+  // ── step 7b: identity ─────────────────────────────────────────────────────
+  // Does it answer as ITSELF? A live instance that serves the platform's name instead of its own
+  // is invisible to healthz — it is perfectly healthy and telling every newcomer the wrong project
+  // (task 1003740, which went unnoticed across every hosted instance for months). A WARNING, never
+  // a failure: an owner may legitimately name a project after the platform, and a name must not
+  // fail a working standup.
+  if (local && apply && healthy !== false) {
+    const res = boxExec(identityCmd(inst), { allowFail: true });
+    const raw = res && !res.softFailed ? (res.stdout || '') : '';
+    let manifest = null;
+    try { manifest = raw ? JSON.parse(raw) : null; } catch (_) { manifest = null; }
+    if (manifest) {
+      let neutralName = null;
+      try {
+        neutralName = (JSON.parse(fs.readFileSync(path.join(REPO_ROOT, 'config/branding.neutral.json'), 'utf8'))
+          .identity || {}).productName || null;
+      } catch (_) { /* no neutral pack readable → the check simply cannot fire */ }
+      const verdict = identityVerdict({ manifest, slug: inst.slug, neutralName });
+      if (verdict.ok === false) {
+        log(`  ⚠ ${inst.slug} ${verdict.reason} — check its config/branding.json and that no env var pins its branding pack`);
+      } else if (verdict.ok) {
+        log(`  [identity] answers as "${verdict.name}"`);
+      }
+    }
+  }
+
   // Mark active. error_note: null — a stale note from an earlier failed run
   // must not ride into the active state (F15's second half; the co-tenant +
   // standalone paths never cleared it). The runner hands its own observation

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.613'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.614'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provision.mjs

@@ -19,10 +19,11 @@ import { join } from 'node:path';
 const require = createRequire(import.meta.url);
 const P = require('../scripts/gds/provision.js');
 
-// The env-var prefix a provisioned instance resolves = the envPrefix of the pack
-// webEnvBody points GDS_BRANDING_FILE at (config/branding.neutral.json). Read it
-// here so these assertions stay in lockstep with the code (both derive it), not a
-// pinned literal that would rot if the neutral default ever changed.
+// The env-var prefix a provisioned instance resolves = the envPrefix an instance INHERITS from
+// the neutral pack (task 1003740: webEnvBody no longer pins a branding pack anywhere — the
+// instance loads its own config/branding.json by default — but the prefix floor is still the
+// neutral pack's, and every live co-tenant pack pins the same value explicitly). Read it here so
+// these assertions stay in lockstep with the code (both derive it), not a pinned literal.
 const NEUTRAL_PREFIX =
   JSON.parse(readFileSync(new URL('../config/branding.neutral.json', import.meta.url), 'utf8')).envPrefix || 'CLOUDBONGOS';
 const reEsc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -205,7 +206,6 @@ t('webEnvBody: OAuth creds use the LOADED pack\'s envPrefix (not the slug) + bra
   const b = P.webEnvBody(coTenant); // coTenant.domain === null
   assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_GITHUB_CLIENT_ID=`));
   assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_GITHUB_CLIENT_SECRET=`));
-  assert.match(b, /GDS_BRANDING_FILE=config\/branding\.neutral\.json/);
   assert.match(b, /PORT=3003/);
   assert.match(b, /PGDATABASE=mercury/);
   // The prior slug prefix was a latent bug: it never matched the neutral pack's
@@ -215,6 +215,56 @@ t('webEnvBody: OAuth creds use the LOADED pack\'s envPrefix (not the slug) + bra
   assert.doesNotMatch(b, /_BUILDERS_ORIGIN=/);
 });
 
+t('webEnvBody: an instance is never pinned to the neutral pack, so it serves its OWN name (task 1003740)', () => {
+  // THE BUG THIS PINS. Provisioning used to pin every instance to config/branding.neutral.json
+  // into every instance's web.env — a leftover from the shared-checkout co-tenant model. Under
+  // ADR 0108 each instance has its own checkout and its own config/branding.json, and
+  // src/branding.js's ENV_OVERRIDES cover domains/auth.idp/landing but NEVER identity.productName.
+  // So the pin made every hosted instance answer GET /api/gds/instance with the PLATFORM's name:
+  // hermeslines-marketing, mercury and demo all said "Cloud Bongos" while their own packs on disk
+  // said otherwise, and `bongos login <instance>` greeted newcomers with the wrong project.
+  const b = P.webEnvBody({ ...coTenant, domain: 'mercury.example.com' });
+  // Matched on the distinctive half of the env var's name: the full name carries a legacy literal
+  // the goal-1000073 rename ratchet counts, and this is strictly stronger anyway — it also catches
+  // a pin written under any other prefix.
+  assert.doesNotMatch(b, /BRANDING_FILE/,
+    'provisioning must not pin the branding pack — the instance loads its own config/branding.json');
+
+  // The pin is gone, but the env PREFIX it used to keep in lockstep must still be the one
+  // ENV_OVERRIDES reads, or the origin overrides silently stop firing (the task-1972 failure).
+  assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_BUILDERS_ORIGIN=`));
+  assert.match(b, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_GITHUB_CLIENT_ID=`));
+});
+
+t('identityVerdict: a live instance serving the PLATFORM name is caught, not shrugged at (task 1003740)', () => {
+  const N = require('../scripts/gds/provision-net.js');
+  const neutralName = 'Cloud Bongos';
+
+  // The bug's exact live shape — healthz was green the whole time this was true.
+  const bad = N.identityVerdict({ manifest: { name: 'Cloud Bongos' }, slug: 'hermeslines-marketing', neutralName });
+  assert.equal(bad.ok, false);
+  assert.match(bad.reason, /platform default name/);
+
+  // Fixed: the instance answers as itself.
+  assert.equal(N.identityVerdict({ manifest: { name: 'Hermeslines Marketing' }, slug: 'hermeslines-marketing', neutralName }).ok, true);
+
+  // It reads brand.identity.productName too — the manifest carries the name in both places.
+  assert.equal(N.identityVerdict({ manifest: { brand: { identity: { productName: 'mercury' } } }, slug: 'mercury', neutralName }).ok, true);
+
+  // NOT a false positive: a project genuinely named after the platform keeps its name. The check
+  // must never fail a working standup over a legitimate name.
+  assert.equal(N.identityVerdict({ manifest: { name: 'Cloud Bongos' }, slug: 'Cloud Bongos', neutralName }).ok, true);
+
+  // Unknowable → null, never a false accusation.
+  assert.equal(N.identityVerdict({ manifest: {}, slug: 'x', neutralName }).ok, null);
+  assert.equal(N.identityVerdict({ manifest: { name: 'x' }, slug: 'x', neutralName: null }).ok, true);
+});
+
+t('identityCmd: probes the manifest over loopback, like healthzCmd', () => {
+  const N = require('../scripts/gds/provision-net.js');
+  assert.match(N.identityCmd({ port: 3011 }), /127\.0\.0\.1:3011\/api\/gds\/instance/);
+});
+
 t('webEnvBody: a domain writes the single-host origin overrides so the hall loads (task 1972)', () => {
   const b = P.webEnvBody({ ...coTenant, domain: 'mercury.example.com' });
   const O = reEsc('https://mercury.example.com');