@bongos/core 1.19.66 → 1.19.67

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.66",
-  "core_contract": "1.19.66",
-  "source_commit": "b7a4a393e851903e595719125e64e6c5abafceb4",
+  "core_version": "1.19.67",
+  "core_contract": "1.19.67",
+  "source_commit": "cd54b1b3803fb68412c34eabaf969761c6b22728",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T13:10:03.862Z",
+  "built_at": "2026-08-12T14:13:54.700Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 292,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1535,
-  "tree_sha256": "de43bd7bdf0e7964a2f861fc87f75fa4bd1ae0e1110f12b37486ce766c33c2a3",
+  "tree_sha256": "6689b03f0138061c04be8b757cd0a1a13b43f4c64e6d766df97906e306378cf9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -187,7 +187,7 @@
     {
       "path": ".claude/skills/new-project/SKILL.md",
       "mode": "0000644",
-      "sha256": "4bde7c3a6792e3df0490277095afb061435b921b3b7934d6519e3b3115095710"
+      "sha256": "55b86978a60e33eefe024d7c7d521e4093b82235eeb7e5d4a145fbb0e4db0b06"
     },
     {
       "path": ".claude/skills/otb-character-review/SKILL.md",
@@ -1312,12 +1312,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "a30007778606ce90b8e31470d926047a372c72b93022f54023937cfd4c5b5fc0"
+      "sha256": "1a4562c2e0575f8505a22851c63f1cc3ecfd485ae5de6e725810786f692e6457"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "0e7646ee148453ef5d6d51b3434253b76f35628ee6c36681dbf6e7b27dd20c6f"
+      "sha256": "9a551d5c62209f2c1b935194cc37e86ca5c44b317901499da84126e3868df1fa"
     },
     {
       "path": "docs/architecture.md",
@@ -3737,7 +3737,7 @@
     {
       "path": "modules/provisioning/onboard-plan.js",
       "mode": "0000644",
-      "sha256": "edee29c46f4f106ac08b9b048769182a1d63390a5621bbb6a83361e64a000a4e"
+      "sha256": "19224b44f22a18db651cfefa87c90c250e911dc1b1d00b76ed7c9361b505c037"
     },
     {
       "path": "modules/provisioning/provisioning.js",
@@ -3752,7 +3752,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "a490a4b4b607a302533bac6fedbc39a0153d57e35a086bcc20079fbefc6815e5"
+      "sha256": "a8e2fa66eb19d119e117b80ca49832bec240cb71d167719e2a86f0032823b506"
     },
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
@@ -4042,12 +4042,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c143dc9d0d61ff73fc5d95421a08b76dd695932c371b2c75f6383a4dfa50e641"
+      "sha256": "2e4247ac977969f19efdfa6e7e4c111f131e8e6200e393b7e19393d65b57d6ae"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cadc0c2dd9db11ec051eddb312cfbb7433a7e3cd88bfaa18ea98180351d8032a"
+      "sha256": "a840fe8d34e5195d246bfb20de03cf4864bec50d21ba5d3abe4eb17f8ed47275"
     },
     {
       "path": "public-docs/index.html",
@@ -4292,7 +4292,7 @@
     {
       "path": "public-landing/create.html",
       "mode": "0000644",
-      "sha256": "0333bd3cea25e22fc6ad70097a4a57e1fa779b6d47156b551782a06846f76c0b"
+      "sha256": "a90e1cfe70592338dd9e3bb733a5655f8b772594f74a09b0b2a3075ff90c5487"
     },
     {
       "path": "public-landing/gate/README.md",
@@ -4977,7 +4977,7 @@
     {
       "path": "scripts/gds/onboard.js",
       "mode": "0000644",
-      "sha256": "c1f8299289e917a04f685d72dbced1778f5888aac53bb7ffe4bed7f9ad453b42"
+      "sha256": "11472bb450751330e865cbd8f6dba0276005f120db6438e058cd148dbeb580fb"
     },
     {
       "path": "scripts/gds/onboarding-analyze.js",
@@ -5672,7 +5672,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8dd5e994caef229a93a1ef8fd90e20e24ff9bd7a3ed9ba27bffe5732cfdf5960"
+      "sha256": "7f872cf877475c7b89a389c016abb6cdcdbc34a7847b8bf882dd67e8dc49048c"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7037,7 +7037,7 @@
     {
       "path": "tests/onboard.mjs",
       "mode": "0000644",
-      "sha256": "61f445855391bfc0e4ab44f8a3f03e074d911e75ed7dbae31293f38314cd3d2e"
+      "sha256": "93125254eed5a46e933484062942e43966e3cac898e642d546cd467da635223f"
     },
     {
       "path": "tests/onboarding_gate.mjs",
@@ -7167,7 +7167,7 @@
     {
       "path": "tests/provisioning_onboard_mode.mjs",
       "mode": "0000644",
-      "sha256": "9a41d64fba3a8cc8ffdbccb0aea363ca6ccb63909cfeefd4bd0b05ebab052403"
+      "sha256": "7749df454ac3cca7c7e5ea1acc94ead15d1c9f87b38fe2028a1c93c8adf31bcf"
     },
     {
       "path": "tests/provisioning_teardown_intent.mjs",

package/.claude/skills/new-project/SKILL.md

@@ -99,6 +99,13 @@ Confirm the owner is **Archon** (their profile / the hall roster). If `auth_conf
 
 Fill the instance **look** — theme / palette / fonts in `config/branding.json` (see `docs/branding-fill-prompt.md`). The identity strings were set at init; this is the visual layer. "Brand with your own LLM."
 
+### 9. Enter your builders hall
+
+The hall is the point of everything above — end there, not at brand (task 1002703):
+
+- **With a domain:** open `https://<domain>/builders` — that's the project's home.
+- **No domain yet:** run `bongos dev` in the repo checkout — it stands the instance up locally and serves the hall on the owner's machine ([ADR 0149](../../../docs/adr/<redacted>.md)).
+
 ## Done-when
 
 A new owner has gone zero → live: their own standalone repo on a pinned core, provisioned with no hand-editing of servers, the four human-only steps done UI-first + verified, and they are signed in as the founding Archon on their own domain. That is goal 35's `project-creation-flow` criterion.

package/docs/api/openapi.json

@@ -8733,7 +8733,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/onboard-plan",
-        "description": "GET /provisioning/onboard-plan?mode=greenfield|adopt — the CANONICAL onboarding step sequence (task 2085; goal 35 / criterion 165: \"the canonical step sequence is the source of truth; skill/CLI/hall are forms over it\"). The branded /create page + the hall wizard fetch it so their human-steps checklist can't drift from the CLI's (scripts/gds/onboard.js reads the same modules/provisioning/onboard-plan.js). rank: public — the signed-out /create landing page reads it; it is the same public runbook the /new-project skill documents (no write, no secret).\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "GET /provisioning/onboard-plan?mode=greenfield|adopt&domain=<host> — the CANONICAL onboarding step sequence (task 2085; goal 35 / criterion 165: \"the canonical step sequence is the source of truth; skill/CLI/hall are forms over it\"). The branded /create page + the hall wizard fetch it so their human-steps checklist can't drift from the CLI's (scripts/gds/onboard.js reads the same modules/provisioning/onboard-plan.js). `domain` relabels the terminal enter-hall step with the instance's own hall address (task 1002703); a non-hostname is dropped — clients render these labels, so unvalidated input must never be echoed back. rank: public — the signed-out /create landing page reads it; it is the same public runbook the /new-project skill documents (no write, no secret).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "responses": {

package/docs/api-reference.md

@@ -374,7 +374,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/provisioning/instances/:id/force-teardown` | `metic+archon` | — | POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. |
 | POST | `/api/bongos/provisioning/instances/:id/github-app` | `any-builder` | `account` | POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 01… |
 | POST | `/api/bongos/provisioning/instances/:id/teardown` | `any-builder` | — | POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. |
-| GET | `/api/bongos/provisioning/onboard-plan` | `public` | — | GET /provisioning/onboard-plan?mode=greenfield\|adopt — the CANONICAL onboarding step sequence (task 2085; goal 35 / criterion 165: "the c… |
+| GET | `/api/bongos/provisioning/onboard-plan` | `public` | — | GET /provisioning/onboard-plan?mode=greenfield\|adopt&domain=<host> — the CANONICAL onboarding step sequence (task 2085; goal 35 / criteri… |
 | GET | `/api/bongos/provisioning/tls-check` | `public` | — | GET /provisioning/tls-check?domain=<host> — the Caddy on-demand-TLS ALLOW-LIST (ADR 0111 §4, task P4 task 1945). |
 
 ## `public` (18)

package/modules/provisioning/onboard-plan.js

@@ -11,13 +11,19 @@
 //
 // Each step: { key, kind: 'auto' | 'human', label }. `kind: 'human'` marks the
 // irreducibly-manual owner actions (create the GitHub repo, wire GitHub sign-in, first
-// sign-in) that every form renders UI-first; `kind: 'auto'` steps the flow performs.
-// The sequence branches at exactly ONE leg — scaffold — into greenfield (`bongos init`,
-// a fresh empty repo) vs brownfield (`bongos init --adopt`, LAYER onto an existing repo;
-// ADR 0121 §Decision 1 / task 2046). Every other leg is identical, so `mode` only
-// relabels the github-repo / init / scaffold steps.
-function onboardPlan(mode = 'greenfield') {
+// sign-in, enter the hall) that every form renders UI-first; `kind: 'auto'` steps the
+// flow performs. The sequence branches at exactly ONE leg — scaffold — into greenfield
+// (`bongos init`, a fresh empty repo) vs brownfield (`bongos init --adopt`, LAYER onto
+// an existing repo; ADR 0121 §Decision 1 / task 2046). Every other leg is identical, so
+// `mode` only relabels the github-repo / init / scaffold steps.
+//
+// `opts.domain` (task 1002703): the terminal enter-hall step names the instance's own
+// hall address when the renderer knows the domain, and falls back to the `bongos dev`
+// local-hall one-liner when it doesn't — the hall is the point of creating a project,
+// so the sequence must end there, not at brand.
+function onboardPlan(mode = 'greenfield', opts = {}) {
   const adopt = mode === 'adopt';
+  const domain = typeof opts.domain === 'string' && opts.domain.trim() ? opts.domain.trim() : null;
   return [
     { key: 'name-address', kind: 'auto', label: 'Decide name + address (interview)' },
     { key: 'github-repo', kind: 'human', label: adopt ? 'Use your EXISTING GitHub repository' : 'Create the empty GitHub repository' },
@@ -31,6 +37,9 @@ function onboardPlan(mode = 'greenfield') {
     { key: 'first-sign-in', kind: 'human', label: 'First sign-in (seats the founding Archon)' },
     { key: 'verify', kind: 'auto', label: 'Verify /healthz auth_configured' },
     { key: 'brand', kind: 'auto', label: 'Brand the instance look' },
+    { key: 'enter-hall', kind: 'human', label: domain
+      ? `Enter your builders hall — https://${domain}/builders`
+      : 'Enter your builders hall — run `bongos dev` for the local hall (no domain attached yet)' },
   ];
 }
 

package/modules/provisioning/routes/provisioning.js

@@ -609,16 +609,20 @@ module.exports = function provisioningRoutes() {
     res.json({ module: 'provisioning', ok: true, coreVersion: api.CORE_VERSION });
   });
 
-  // GET /provisioning/onboard-plan?mode=greenfield|adopt — the CANONICAL onboarding
-  // step sequence (task 2085; goal 35 / criterion 165: "the canonical step sequence is
-  // the source of truth; skill/CLI/hall are forms over it"). The branded /create page +
-  // the hall wizard fetch it so their human-steps checklist can't drift from the CLI's
-  // (scripts/gds/onboard.js reads the same modules/provisioning/onboard-plan.js).
+  // GET /provisioning/onboard-plan?mode=greenfield|adopt&domain=<host> — the CANONICAL
+  // onboarding step sequence (task 2085; goal 35 / criterion 165: "the canonical step
+  // sequence is the source of truth; skill/CLI/hall are forms over it"). The branded
+  // /create page + the hall wizard fetch it so their human-steps checklist can't drift
+  // from the CLI's (scripts/gds/onboard.js reads the same
+  // modules/provisioning/onboard-plan.js). `domain` relabels the terminal enter-hall
+  // step with the instance's own hall address (task 1002703); a non-hostname is dropped
+  // — clients render these labels, so unvalidated input must never be echoed back.
   // rank: public — the signed-out /create landing page reads it; it is the same public
   // runbook the /new-project skill documents (no write, no secret).
   router.get('/provisioning/onboard-plan', (req, res) => {
     const mode = req.query.mode === 'adopt' ? 'adopt' : 'greenfield';
-    res.json({ mode, steps: onboardPlan(mode) });
+    const domain = provisioning.normalizeHostname(req.query.domain) || null;
+    res.json({ mode, steps: onboardPlan(mode, { domain }) });
   });
 
   // GET /provisioning/tls-check?domain=<host> — the Caddy on-demand-TLS ALLOW-LIST

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.66",
+  "version": "1.19.67",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.66",
+      "version": "1.19.67",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.66",
+  "version": "1.19.67",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/create.html

@@ -1019,6 +1019,9 @@ input[type=text].bad{border-color:var(--err);}
       steps.push('<li data-onboard-step="first-sign-in"><b>First sign-in</b><p>Open <code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '</code> and sign in with GitHub once. That seats you as the owner — the founding Archon.</p></li>');
       steps.push('<li><b>Verify</b><p><code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '/healthz</code> should report <code style="font-family:var(--font-mono)">auth_configured: true</code>. Then the hall is yours.</p></li>');
     }
+    steps.push(state.domain
+      ? '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>Your project’s home — open <a href="https://' + esc(state.domain) + '/builders" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(state.domain) + '/builders</code></a> and start building.</p></li>'
+      : '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>No address yet — run <code style="font-family:var(--font-mono)">bongos dev</code> in your repo checkout to start the local hall on your machine.</p></li>');
     $('humanSteps').innerHTML = steps.join('');
     $('humanSteps').addEventListener('click', function (ev) {
       var t = ev.target.closest('.copy');

package/scripts/gds/onboard.js

@@ -199,6 +199,15 @@ async function run() {
 
     // Step 10 — brand
     log('\n⑨ Brand the instance look — fill theme/palette/fonts in config/branding.json (docs/branding-fill-prompt.md).');
+
+    // Step 11 — enter the builders hall (task 1002703): the point of all of the above.
+    // With a domain the hall lives on the instance; without one, `bongos dev` runs it locally.
+    if (a.domain) {
+      log(`\n⑩ Enter your builders hall — open https://${a.domain}/builders. That's your project's home.`);
+    } else {
+      log('\n⑩ Enter your builders hall — no domain yet, so run `bongos dev` in your repo checkout:');
+      log('   it stands the instance up locally and serves the hall on your machine.');
+    }
     log('\n✓ onboard walkthrough complete. Your standalone instance is live and owned.\n');
   } finally {
     rl.close();

package/src/module-api.js

@@ -559,8 +559,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.64 with no explicit bump. run 31562193292. (task 1002620)
 //   1.19.66 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.65 with no explicit bump. run 31599966075. (task 1002620)
+//   1.19.67 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.66 with no explicit bump. run 31605591253. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.66'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.67'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/onboard.mjs

@@ -7,14 +7,15 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const ob = require('../scripts/gds/onboard.js');
 
-test('onboardPlan is the canonical sequence: name+address first, brand last, four legs automated around the human steps', () => {
+test('onboardPlan is the canonical sequence: name+address first, the builders hall last, four legs automated around the human steps', () => {
   const plan = ob.onboardPlan();
   const keys = plan.map((s) => s.key);
   assert.equal(keys[0], 'name-address');
-  assert.equal(keys[keys.length - 1], 'brand');
+  assert.equal(keys[keys.length - 1], 'enter-hall');
+  assert.equal(keys[keys.length - 2], 'brand');
   // the irreducibly-human steps (must be UI-first prompts)
   const human = plan.filter((s) => s.kind === 'human').map((s) => s.key);
-  assert.deepEqual(human, ['github-repo', 'oauth-app', 'first-sign-in']);
+  assert.deepEqual(human, ['github-repo', 'oauth-app', 'first-sign-in', 'enter-hall']);
   // the DNS preflight comes BEFORE provision (task 1980: before the address step)
   assert.ok(keys.indexOf('dns-preflight') < keys.indexOf('provision'), 'dns preflight precedes provision');
   // OAuth secret placement comes after the OAuth app + before first sign-in
@@ -52,6 +53,46 @@ test('onboardPlan lists seed-first-version as an explicit AUTO step right after
   assert.ok(ob.onboardPlan('adopt').some((s) => s.key === 'seed-version'), 'adopt gets it too');
 });
 
+test('onboardPlan ends at the builders hall, terminal label branching on domain (task 1002703)', () => {
+  // The hall is the entire point of creating a project, yet the sequence used to stop
+  // at brand — owners only learned about `bongos dev` or their hall URL by being told
+  // (idea 1000693). One terminal step in the ONE source reaches every render surface.
+  for (const mode of ['greenfield', 'adopt']) {
+    const dflt = ob.onboardPlan(mode);
+    const last = dflt[dflt.length - 1];
+    assert.equal(last.key, 'enter-hall', `${mode}: the plan ends at the hall`);
+    assert.equal(last.kind, 'human', 'entering the hall is the owner\'s own action');
+    assert.match(last.label, /bongos dev/, 'no domain → the local-hall one-liner');
+
+    const withDomain = ob.onboardPlan(mode, { domain: 'mercury.example.com' });
+    const lastD = withDomain[withDomain.length - 1];
+    assert.equal(lastD.key, 'enter-hall');
+    assert.match(lastD.label, /https:\/\/mercury\.example\.com\/builders/, 'domain → the instance\'s hall address');
+    assert.doesNotMatch(lastD.label, /bongos dev/, 'with a domain the local fallback is noise');
+    // only the terminal label branches — the skeleton is identical
+    assert.deepEqual(withDomain.map((s) => s.key), dflt.map((s) => s.key));
+  }
+  // a blank / whitespace domain is "no domain"
+  const blank = ob.onboardPlan('greenfield', { domain: '   ' });
+  assert.match(blank[blank.length - 1].label, /bongos dev/);
+});
+
+test('every render surface carries the terminal hall step (task 1002703)', () => {
+  // The human-steps drift guard below pins the TAG; this pins the CONTENT — each
+  // surface must point at the hall (domain branch) and at `bongos dev` (local branch).
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const read = (rel) => readFileSync(path.join(import.meta.dirname, '..', rel), 'utf8');
+  const cli = read('scripts/gds/onboard.js');
+  assert.match(cli, /builders hall/i, 'the CLI walkthrough ends at the hall');
+  assert.match(cli, /bongos dev/, 'the CLI offers the local-hall one-liner when no domain');
+  const createHtml = read('public-landing/create.html');
+  const enterHall = createHtml.match(/data-onboard-step="enter-hall"[^]*?<\/li>/g) || [];
+  assert.ok(enterHall.length >= 1, '/create tags the enter-hall step');
+  assert.match(enterHall.join(''), /\/builders/, '/create points at the hall address');
+  assert.match(enterHall.join(''), /bongos dev/, '/create offers the local hall when no domain');
+});
+
 test('oauthAppInstructions pins the apex callback + homepage and points at ACCOUNT Developer settings', () => {
   const oa = ob.oauthAppInstructions('mercury.example.com');
   assert.equal(oa.homepageUrl, 'https://mercury.example.com');

package/tests/provisioning_onboard_mode.mjs

@@ -162,6 +162,32 @@ await ta('POST /instances: an unknown onboard_mode is REFUSED (never silently co
   assert.deepEqual(res.body.error.valid, ['greenfield', 'adopt']);
 });
 
+function get(path) {
+  return new Promise((resolve, reject) => {
+    http.get(`${base}${path}`, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    }).on('error', reject);
+  });
+}
+
+await ta('GET /onboard-plan: ?domain= relabels the terminal enter-hall step; garbage is ignored, never echoed (task 1002703)', async () => {
+  const bare = await get('/provisioning/onboard-plan');
+  assert.equal(bare.status, 200);
+  const bareLast = bare.body.steps[bare.body.steps.length - 1];
+  assert.equal(bareLast.key, 'enter-hall');
+  assert.match(bareLast.label, /bongos dev/, 'no domain → the local-hall one-liner');
+  const dom = await get('/provisioning/onboard-plan?domain=mercury.example.com');
+  const domLast = dom.body.steps[dom.body.steps.length - 1];
+  assert.match(domLast.label, /https:\/\/mercury\.example\.com\/builders/, 'domain → that instance\'s hall');
+  // clients render these labels — a non-hostname must be dropped, not reflected back
+  const bad = await get('/provisioning/onboard-plan?domain=' + encodeURIComponent('<script>alert(1)</script>'));
+  const badLast = bad.body.steps[bad.body.steps.length - 1];
+  assert.match(badLast.label, /bongos dev/);
+  assert.ok(!badLast.label.includes('<script>'), 'unvalidated input never reaches the label');
+});
+
 await ta('POST /instances: adopt WITHOUT target_ref is refused — there is no repo to layer onto', async () => {
   // Without target_ref the runner would fall back to greenfield behavior on a row labelled
   // adopt. Refuse at the door rather than store a lie.