@bongos/core 1.19.66 → 1.19.68

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.66",
-  "core_contract": "1.19.66",
-  "source_commit": "b7a4a393e851903e595719125e64e6c5abafceb4",
+  "core_version": "1.19.68",
+  "core_contract": "1.19.68",
+  "source_commit": "0b0e7e636f0a28d01e1bc8f354a06981d6f1ef70",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T13:10:03.862Z",
+  "built_at": "2026-08-12T14:42:16.480Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 292,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1535,
-  "tree_sha256": "de43bd7bdf0e7964a2f861fc87f75fa4bd1ae0e1110f12b37486ce766c33c2a3",
+  "tree_sha256": "cc9278ac9df146953fa33e771313791e8ce82f5d69b05a307763c48bae6207e9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -187,7 +187,7 @@
     {
       "path": ".claude/skills/new-project/SKILL.md",
       "mode": "0000644",
-      "sha256": "4bde7c3a6792e3df0490277095afb061435b921b3b7934d6519e3b3115095710"
+      "sha256": "55b86978a60e33eefe024d7c7d521e4093b82235eeb7e5d4a145fbb0e4db0b06"
     },
     {
       "path": ".claude/skills/otb-character-review/SKILL.md",
@@ -1312,12 +1312,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "a30007778606ce90b8e31470d926047a372c72b93022f54023937cfd4c5b5fc0"
+      "sha256": "1a4562c2e0575f8505a22851c63f1cc3ecfd485ae5de6e725810786f692e6457"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "0e7646ee148453ef5d6d51b3434253b76f35628ee6c36681dbf6e7b27dd20c6f"
+      "sha256": "9a551d5c62209f2c1b935194cc37e86ca5c44b317901499da84126e3868df1fa"
     },
     {
       "path": "docs/architecture.md",
@@ -3737,7 +3737,7 @@
     {
       "path": "modules/provisioning/onboard-plan.js",
       "mode": "0000644",
-      "sha256": "edee29c46f4f106ac08b9b048769182a1d63390a5621bbb6a83361e64a000a4e"
+      "sha256": "19224b44f22a18db651cfefa87c90c250e911dc1b1d00b76ed7c9361b505c037"
     },
     {
       "path": "modules/provisioning/provisioning.js",
@@ -3752,7 +3752,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "a490a4b4b607a302533bac6fedbc39a0153d57e35a086bcc20079fbefc6815e5"
+      "sha256": "a8e2fa66eb19d119e117b80ca49832bec240cb71d167719e2a86f0032823b506"
     },
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
@@ -4042,12 +4042,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c143dc9d0d61ff73fc5d95421a08b76dd695932c371b2c75f6383a4dfa50e641"
+      "sha256": "9319b9acd693e6a9804c215db5ed78ae38f4caf1a698e0596972bfef9555b91c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cadc0c2dd9db11ec051eddb312cfbb7433a7e3cd88bfaa18ea98180351d8032a"
+      "sha256": "147790e86972f4273aa18bd24bf508797c4470a4491a20a9614207edeb2e3478"
     },
     {
       "path": "public-docs/index.html",
@@ -4292,7 +4292,7 @@
     {
       "path": "public-landing/create.html",
       "mode": "0000644",
-      "sha256": "0333bd3cea25e22fc6ad70097a4a57e1fa779b6d47156b551782a06846f76c0b"
+      "sha256": "1874575c2241df1e868d158f3fc4c6c123b8c35531a5b1425de9974230da6510"
     },
     {
       "path": "public-landing/gate/README.md",
@@ -4977,7 +4977,7 @@
     {
       "path": "scripts/gds/onboard.js",
       "mode": "0000644",
-      "sha256": "c1f8299289e917a04f685d72dbced1778f5888aac53bb7ffe4bed7f9ad453b42"
+      "sha256": "11472bb450751330e865cbd8f6dba0276005f120db6438e058cd148dbeb580fb"
     },
     {
       "path": "scripts/gds/onboarding-analyze.js",
@@ -5672,7 +5672,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8dd5e994caef229a93a1ef8fd90e20e24ff9bd7a3ed9ba27bffe5732cfdf5960"
+      "sha256": "28675b76775e2936b6ba819fa37c6628f96b259b850248f2ce1033e9bcd7fe20"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7037,7 +7037,7 @@
     {
       "path": "tests/onboard.mjs",
       "mode": "0000644",
-      "sha256": "61f445855391bfc0e4ab44f8a3f03e074d911e75ed7dbae31293f38314cd3d2e"
+      "sha256": "6a66477263031b252d6a92d5036304a78e11cbbd9e7230d836c4ec96a9297fdd"
     },
     {
       "path": "tests/onboarding_gate.mjs",
@@ -7167,7 +7167,7 @@
     {
       "path": "tests/provisioning_onboard_mode.mjs",
       "mode": "0000644",
-      "sha256": "9a41d64fba3a8cc8ffdbccb0aea363ca6ccb63909cfeefd4bd0b05ebab052403"
+      "sha256": "7749df454ac3cca7c7e5ea1acc94ead15d1c9f87b38fe2028a1c93c8adf31bcf"
     },
     {
       "path": "tests/provisioning_teardown_intent.mjs",

package/.claude/skills/new-project/SKILL.md

@@ -99,6 +99,13 @@ Confirm the owner is **Archon** (their profile / the hall roster). If `auth_conf
 
 Fill the instance **look** — theme / palette / fonts in `config/branding.json` (see `docs/branding-fill-prompt.md`). The identity strings were set at init; this is the visual layer. "Brand with your own LLM."
 
+### 9. Enter your builders hall
+
+The hall is the point of everything above — end there, not at brand (task 1002703):
+
+- **With a domain:** open `https://<domain>/builders` — that's the project's home.
+- **No domain yet:** run `bongos dev` in the repo checkout — it stands the instance up locally and serves the hall on the owner's machine ([ADR 0149](../../../docs/adr/<redacted>.md)).
+
 ## Done-when
 
 A new owner has gone zero → live: their own standalone repo on a pinned core, provisioned with no hand-editing of servers, the four human-only steps done UI-first + verified, and they are signed in as the founding Archon on their own domain. That is goal 35's `project-creation-flow` criterion.

package/docs/api/openapi.json

@@ -8733,7 +8733,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/onboard-plan",
-        "description": "GET /provisioning/onboard-plan?mode=greenfield|adopt — the CANONICAL onboarding step sequence (task 2085; goal 35 / criterion 165: \"the canonical step sequence is the source of truth; skill/CLI/hall are forms over it\"). The branded /create page + the hall wizard fetch it so their human-steps checklist can't drift from the CLI's (scripts/gds/onboard.js reads the same modules/provisioning/onboard-plan.js). rank: public — the signed-out /create landing page reads it; it is the same public runbook the /new-project skill documents (no write, no secret).\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "GET /provisioning/onboard-plan?mode=greenfield|adopt&domain=<host> — the CANONICAL onboarding step sequence (task 2085; goal 35 / criterion 165: \"the canonical step sequence is the source of truth; skill/CLI/hall are forms over it\"). The branded /create page + the hall wizard fetch it so their human-steps checklist can't drift from the CLI's (scripts/gds/onboard.js reads the same modules/provisioning/onboard-plan.js). `domain` relabels the terminal enter-hall step with the instance's own hall address (task 1002703); a non-hostname is dropped — clients render these labels, so unvalidated input must never be echoed back. rank: public — the signed-out /create landing page reads it; it is the same public runbook the /new-project skill documents (no write, no secret).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "responses": {

package/docs/api-reference.md

@@ -374,7 +374,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/provisioning/instances/:id/force-teardown` | `metic+archon` | — | POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. |
 | POST | `/api/bongos/provisioning/instances/:id/github-app` | `any-builder` | `account` | POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 01… |
 | POST | `/api/bongos/provisioning/instances/:id/teardown` | `any-builder` | — | POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. |
-| GET | `/api/bongos/provisioning/onboard-plan` | `public` | — | GET /provisioning/onboard-plan?mode=greenfield\|adopt — the CANONICAL onboarding step sequence (task 2085; goal 35 / criterion 165: "the c… |
+| GET | `/api/bongos/provisioning/onboard-plan` | `public` | — | GET /provisioning/onboard-plan?mode=greenfield\|adopt&domain=<host> — the CANONICAL onboarding step sequence (task 2085; goal 35 / criteri… |
 | GET | `/api/bongos/provisioning/tls-check` | `public` | — | GET /provisioning/tls-check?domain=<host> — the Caddy on-demand-TLS ALLOW-LIST (ADR 0111 §4, task P4 task 1945). |
 
 ## `public` (18)

package/modules/provisioning/onboard-plan.js

@@ -11,13 +11,19 @@
 //
 // Each step: { key, kind: 'auto' | 'human', label }. `kind: 'human'` marks the
 // irreducibly-manual owner actions (create the GitHub repo, wire GitHub sign-in, first
-// sign-in) that every form renders UI-first; `kind: 'auto'` steps the flow performs.
-// The sequence branches at exactly ONE leg — scaffold — into greenfield (`bongos init`,
-// a fresh empty repo) vs brownfield (`bongos init --adopt`, LAYER onto an existing repo;
-// ADR 0121 §Decision 1 / task 2046). Every other leg is identical, so `mode` only
-// relabels the github-repo / init / scaffold steps.
-function onboardPlan(mode = 'greenfield') {
+// sign-in, enter the hall) that every form renders UI-first; `kind: 'auto'` steps the
+// flow performs. The sequence branches at exactly ONE leg — scaffold — into greenfield
+// (`bongos init`, a fresh empty repo) vs brownfield (`bongos init --adopt`, LAYER onto
+// an existing repo; ADR 0121 §Decision 1 / task 2046). Every other leg is identical, so
+// `mode` only relabels the github-repo / init / scaffold steps.
+//
+// `opts.domain` (task 1002703): the terminal enter-hall step names the instance's own
+// hall address when the renderer knows the domain, and falls back to the `bongos dev`
+// local-hall one-liner when it doesn't — the hall is the point of creating a project,
+// so the sequence must end there, not at brand.
+function onboardPlan(mode = 'greenfield', opts = {}) {
   const adopt = mode === 'adopt';
+  const domain = typeof opts.domain === 'string' && opts.domain.trim() ? opts.domain.trim() : null;
   return [
     { key: 'name-address', kind: 'auto', label: 'Decide name + address (interview)' },
     { key: 'github-repo', kind: 'human', label: adopt ? 'Use your EXISTING GitHub repository' : 'Create the empty GitHub repository' },
@@ -31,6 +37,9 @@ function onboardPlan(mode = 'greenfield') {
     { key: 'first-sign-in', kind: 'human', label: 'First sign-in (seats the founding Archon)' },
     { key: 'verify', kind: 'auto', label: 'Verify /healthz auth_configured' },
     { key: 'brand', kind: 'auto', label: 'Brand the instance look' },
+    { key: 'enter-hall', kind: 'human', label: domain
+      ? `Enter your builders hall — https://${domain}/builders`
+      : 'Enter your builders hall — run `bongos dev` for the local hall (no domain attached yet)' },
   ];
 }
 

package/modules/provisioning/routes/provisioning.js

@@ -609,16 +609,20 @@ module.exports = function provisioningRoutes() {
     res.json({ module: 'provisioning', ok: true, coreVersion: api.CORE_VERSION });
   });
 
-  // GET /provisioning/onboard-plan?mode=greenfield|adopt — the CANONICAL onboarding
-  // step sequence (task 2085; goal 35 / criterion 165: "the canonical step sequence is
-  // the source of truth; skill/CLI/hall are forms over it"). The branded /create page +
-  // the hall wizard fetch it so their human-steps checklist can't drift from the CLI's
-  // (scripts/gds/onboard.js reads the same modules/provisioning/onboard-plan.js).
+  // GET /provisioning/onboard-plan?mode=greenfield|adopt&domain=<host> — the CANONICAL
+  // onboarding step sequence (task 2085; goal 35 / criterion 165: "the canonical step
+  // sequence is the source of truth; skill/CLI/hall are forms over it"). The branded
+  // /create page + the hall wizard fetch it so their human-steps checklist can't drift
+  // from the CLI's (scripts/gds/onboard.js reads the same
+  // modules/provisioning/onboard-plan.js). `domain` relabels the terminal enter-hall
+  // step with the instance's own hall address (task 1002703); a non-hostname is dropped
+  // — clients render these labels, so unvalidated input must never be echoed back.
   // rank: public — the signed-out /create landing page reads it; it is the same public
   // runbook the /new-project skill documents (no write, no secret).
   router.get('/provisioning/onboard-plan', (req, res) => {
     const mode = req.query.mode === 'adopt' ? 'adopt' : 'greenfield';
-    res.json({ mode, steps: onboardPlan(mode) });
+    const domain = provisioning.normalizeHostname(req.query.domain) || null;
+    res.json({ mode, steps: onboardPlan(mode, { domain }) });
   });
 
   // GET /provisioning/tls-check?domain=<host> — the Caddy on-demand-TLS ALLOW-LIST

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.66",
+  "version": "1.19.68",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.66",
+      "version": "1.19.68",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.66",
+  "version": "1.19.68",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/create.html

@@ -251,6 +251,14 @@ input[type=text].bad{border-color:var(--err);}
 }
 .steps b{font-size:15px;}
 .steps p{font-size:13.5px;font-weight:500;color:var(--ink-soft);line-height:1.55;margin-top:4px;}
+/* live checklist states (task 1002694): a step the platform has verified done, and a
+   step that can't be performed yet (its prerequisite — usually the domain — is missing) */
+.steps>li.sdone{border-color:#bbe7c8;background:linear-gradient(180deg,#f0fdf4 0%,#fcfffc 100%);}
+.steps>li.sdone::before{content:"✓";background:var(--ok);color:#fff;}
+.steps>li.slocked{opacity:.6;}
+.steps details{margin-top:10px;}
+.steps summary{cursor:pointer;font-weight:700;font-size:12.5px;color:var(--ink-faint);}
+.steps details p{margin-top:8px;}
 .kv{
   display:flex;align-items:center;gap:8px;margin-top:9px;background:var(--bg);border:1.5px solid var(--line);
   border-radius:11px;padding:8px 8px 8px 12px;font-size:12.5px;
@@ -727,7 +735,10 @@ input[type=text].bad{border-color:var(--err);}
     } else if (clash) {
       hint.className = 'hint err'; hint.innerHTML = 'You already have a repo named <strong>' + esc(state.repo) + '</strong> — pick another name, or adopt it instead.';
     } else {
-      hint.className = 'hint'; hint.innerHTML = 'We’ll create an empty repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code>.';
+      /* Visibility stated up front (task 1002694 / idea 1000684): repos WE create are
+         public by design (github-repos.js — open-source, capture-resistant); the
+         private path is adopting a private repo the owner makes themselves. */
+      hint.className = 'hint'; hint.innerHTML = 'We’ll create an empty <strong>public</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code> — projects here are open by design. Want private code? Create the repo yourself on GitHub and “adopt” it instead.';
     }
   }
   $('ghNewName').addEventListener('input', function () { state.repo = this.value.trim(); updateFreshPreview(); saveDraft(); });
@@ -983,53 +994,203 @@ input[type=text].bad{border-color:var(--err);}
     });
   });
 
-  /* ── done panel: the canonical human steps (same sequence as the /new-project
-        skill + `bongos onboard` + the hall wizard — goal 35; ADR 0121 branches
-        only the repo leg on greenfield vs adopt) ── */
+  /* ── done panel: rendered FROM the canonical onboard plan (task 1002694, gap 2 /
+        idea 1000675). GET /provisioning/onboard-plan is the single source the
+        /new-project skill + `bongos onboard` read too, so the checklist can't
+        drift. A per-key renderer adds this page's rich UI; an unknown human step
+        falls back to the plan's own label, so a new canonical step surfaces here
+        by default instead of silently vanishing. ── */
   function copyBtn(text) {
     return '<button type="button" class="copy" data-copy="' + esc(text) + '">Copy</button>';
   }
-  function renderDone(data) {
-    var adopt = state.mode === 'adopt';
-    var oa = state.domain ? oauthAppValues(state.domain) : null;
-    $('doneLede').innerHTML = 'Provisioning is requested for <strong>' + esc(state.name || state.slug) + '</strong>' +
-      (adopt ? ' — adopting your existing repo' : '') +
-      '. The platform stands up the server, database, and address on its own — you can watch its live status right here.';
+  var GH_ICON = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
+
+  var instanceId = null;             // set when a create lands / a resumed watch starts
+  var live = { instStatus: null, manifest: null, manifestMsg: '' };
+  var planPromises = {};             // mode|domain → Promise<steps[]>
+  var lastStepsHtml = '';
+  var FALLBACK_HUMAN_KEYS = ['github-repo', 'oauth-app', 'first-sign-in', 'enter-hall'];
+
+  function fetchPlan() {
+    var domain = state.domain || '';
+    var key = state.mode + '|' + domain;
+    if (!planPromises[key]) {
+      planPromises[key] = fetch(API + '/provisioning/onboard-plan?mode=' + encodeURIComponent(state.mode) + (domain ? '&domain=' + encodeURIComponent(domain) : ''))
+        .then(function (res) { if (!res.ok) throw new Error('plan'); return res.json(); })
+        .then(function (d) { return (d && d.steps) || []; })
+        .catch(function () {
+          delete planPromises[key];  // transient — retried on the next render
+          return FALLBACK_HUMAN_KEYS.map(function (k) { return { key: k, kind: 'human', label: '' }; });
+        });
+    }
+    return planPromises[key];
+  }
 
-    var steps = [];
+  /* github-repo — adopt / auto-created / manual-create, each aware of whether the
+     scaffold has landed (instance active ⇒ the build already pushed). The wizard
+     files onboard_mode to the server, so for adopt the RUNNER clones + layers
+     (task 1002562) — the owner no longer runs `bongos init --adopt` here. */
+  function renderStepGithubRepo() {
+    var landed = live.instStatus === 'active';
     var repoLabel = state.owner && state.repo ? '<strong>' + esc(state.owner + '/' + state.repo) + '</strong>' : 'your new repository';
+    if (state.mode === 'adopt') {
+      return landed
+        ? '<li class="sdone" data-onboard-step="github-repo"><b>Your repo carries the platform</b><p>The build layered the platform onto ' + repoLabel + ' — existing files, history, and backlog kept. Pull to see it.</p></li>'
+        : '<li data-onboard-step="github-repo"><b>Your existing repo</b><p>The build clones ' + repoLabel + ' and layers the platform onto its existing history — nothing is created or emptied, and your backlog is imported. Nothing for you to do here.</p></li>';
+    }
+    if (state.repoAutoCreated) {
+      return landed
+        ? '<li class="sdone" data-onboard-step="github-repo"><b>Repo ready — scaffold landed</b><p>We created ' + repoLabel + ' (public, by design) and the build pushed your project’s starting files to it.</p></li>'
+        : '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLabel + ' on GitHub for you — public (projects here are open by design), empty, and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>';
+    }
     var ghNewUrl = githubNewRepoUrl(state.owner, state.repo);
-    var ghIcon = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
-    steps.push(adopt
-      ? '<li data-onboard-step="github-repo"><b>Layer onto your existing repo</b><p>In your repo run <code style="font-family:var(--font-mono)">bongos init --adopt</code>. It shows a conflict pre-flight and writes <em>nothing</em> until you accept — your files and history stay yours, and your existing backlog is imported. Commit and push.</p></li>'
-      : (state.repoAutoCreated
-        ? '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLabel + ' on GitHub for you — empty and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>'
-        : '<li data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
-        '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + ghIcon + 'Create ' + repoLabel + ' on GitHub</a></li>'));
+    return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
+      '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + GH_ICON + 'Create ' + repoLabel + ' on GitHub</a></li>';
+  }
+
+  /* The manual OAuth-app path stays as a documented fallback (ADR 0133), but the
+     control-plane placement is named as the operator's, never handed to the owner
+     as a command to run (gap 4). */
+  function manualOauthDetails() {
+    var oa = oauthAppValues(state.domain);
+    return '<details><summary>Prefer to create an OAuth app by hand?</summary>' +
+      '<p>GitHub → <em>your account’s</em> Settings → Developer settings → OAuth Apps → New OAuth App. (Developer settings live under your account, not the repo.)</p>' +
+      '<div class="kv"><span class="kk">Homepage URL</span><code>' + esc(oa.homepageUrl) + '</code>' + copyBtn(oa.homepageUrl) + '</div>' +
+      '<div class="kv"><span class="kk">Callback URL</span><code>' + esc(oa.callbackUrl) + '</code>' + copyBtn(oa.callbackUrl) + '</div>' +
+      '<p>The generated credentials are placed on the platform’s control plane by an operator — that part isn’t yours to run (the one-click path above does it all automatically). It’s done when <code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '/healthz</code> reports <code style="font-family:var(--font-mono)">auth_configured: true</code>.</p></details>';
+  }
+
+  /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow is the primary path
+     (gap 3 / idea 1000676); locked until a domain exists (the App needs the real
+     callback host — the server refuses domainless with domain_required). */
+  function renderStepOauthApp() {
     if (!state.domain) {
-      steps.push('<li><b>Add a domain you own</b><p>Sign-in on your new instance needs a real domain. When you have one, attach it from <a href="/projects">your projects page</a> — the address gets wired in minutes.</p></li>');
+      return '<li class="slocked" data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Unlocks once your project has an address — sign-in needs a real domain. Attach one any time from <a href="/projects">your projects page</a>.</p></li>';
+    }
+    if (live.manifest === 'done') {
+      return '<li class="sdone" data-onboard-step="oauth-app"><b>GitHub sign-in is wired</b><p>Credentials placed and verified — sign-in on <code style="font-family:var(--font-mono)">' + esc(state.domain) + '</code> is live.</p></li>';
+    }
+    if (live.manifest === 'error' || live.manifest === 'expired') {
+      return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>' +
+        (live.manifest === 'expired' ? 'That setup link expired (they last 30 minutes) — mint a fresh one.' : 'GitHub setup hit a snag' + (live.manifestMsg ? ': ' + esc(live.manifestMsg) : '') + '. Try again.') + '</p>' +
+        '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
+    }
+    if (live.manifest) {   // pending / code_received — GitHub or the runner is mid-flight
+      return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p></li>';
     }
-    if (oa) {
-      steps.push('<li data-onboard-step="oauth-app"><b>Create the GitHub OAuth app</b><p>GitHub → <em>your account’s</em> Settings → Developer settings → OAuth Apps → New OAuth App. (Developer settings live under your account, not the repo.)</p>' +
-        '<div class="kv"><span class="kk">Homepage URL</span><code>' + esc(oa.homepageUrl) + '</code>' + copyBtn(oa.homepageUrl) + '</div>' +
-        '<div class="kv"><span class="kk">Callback URL</span><code>' + esc(oa.callbackUrl) + '</code>' + copyBtn(oa.callbackUrl) + '</div></li>');
-      var cmd = 'bongos oauth-secret place ' + state.slug + ' --client-id <id> --client-secret <secret> --apply';
-      steps.push('<li><b>Place the secret — verified</b><p>Never hand-edit the env file. On the control plane run the placement command; it checks the value is real and confirms sign-in works.</p>' +
-        '<div class="kv"><code>' + esc(cmd) + '</code>' + copyBtn(cmd) + '</div></li>');
-      steps.push('<li data-onboard-step="first-sign-in"><b>First sign-in</b><p>Open <code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '</code> and sign in with GitHub once. That seats you as the owner — the founding Archon.</p></li>');
-      steps.push('<li><b>Verify</b><p><code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '/healthz</code> should report <code style="font-family:var(--font-mono)">auth_configured: true</code>. Then the hall is yours.</p></li>');
+    return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in — one click</b><p>Approve a pre-filled GitHub App and the platform wires sign-in by itself: no keys to copy, and the secret never leaves the server side.</p>' +
+      '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
+  }
+
+  function renderStepFirstSignIn() {
+    if (!state.domain) {
+      return '<li class="slocked" data-onboard-step="first-sign-in"><b>First sign-in</b><p>Unlocks with sign-in above — you’ll open your project’s address, sign in with GitHub once, and be seated as the owner (the founding Archon).</p></li>';
     }
-    $('humanSteps').innerHTML = steps.join('');
-    $('humanSteps').addEventListener('click', function (ev) {
-      var t = ev.target.closest('.copy');
-      if (!t) return;
-      navigator.clipboard.writeText(t.getAttribute('data-copy')).then(function () {
-        t.classList.add('did'); t.textContent = 'Copied';
-        setTimeout(function () { t.classList.remove('did'); t.textContent = 'Copy'; }, 1600);
+    return '<li data-onboard-step="first-sign-in"><b>First sign-in</b><p>Open <a href="https://' + esc(state.domain) + '" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(state.domain) + '</code></a> and sign in with GitHub once. That seats you as the owner — the founding Archon.</p></li>';
+  }
+
+  function renderStepEnterHall() {
+    return state.domain
+      ? '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>Your project’s home — open <a href="https://' + esc(state.domain) + '/builders" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(state.domain) + '/builders</code></a> and start building.</p></li>'
+      : '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>No address yet — run <code style="font-family:var(--font-mono)">bongos dev</code> in your repo checkout to start the local hall on your machine.</p></li>';
+  }
+
+  var STEP_RENDERERS = {
+    'github-repo': renderStepGithubRepo,
+    'oauth-app': renderStepOauthApp,
+    'first-sign-in': renderStepFirstSignIn,
+    'enter-hall': renderStepEnterHall
+  };
+
+  function renderSteps() {
+    fetchPlan().then(function (steps) {
+      var html = steps.filter(function (s) { return s && s.kind === 'human'; }).map(function (s) {
+        var r = STEP_RENDERERS[s.key];
+        return r ? r(s) : '<li data-onboard-step="' + esc(s.key) + '"><b>' + esc(s.label || s.key) + '</b></li>';
+      }).join('');
+      if (html === lastStepsHtml) return;   // change-only re-render — polls never clobber open UI
+      lastStepsHtml = html;
+      $('humanSteps').innerHTML = html;
+    });
+  }
+
+  function renderDone() {
+    var adopt = state.mode === 'adopt';
+    $('doneLede').innerHTML = 'Provisioning is requested for <strong>' + esc(state.name || state.slug) + '</strong>' +
+      (adopt ? ' — adopting your existing repo' : '') +
+      '. The platform stands up the server, database, and address on its own — you can watch its live status right here.';
+    renderSteps();
+  }
+
+  /* One delegated listener — renderSteps swaps innerHTML, so handlers live on the list. */
+  $('humanSteps').addEventListener('click', function (ev) {
+    var mBtn = ev.target.closest('[data-action="manifest-start"]');
+    if (mBtn) { startManifest(mBtn); return; }
+    var t = ev.target.closest('.copy');
+    if (!t) return;
+    navigator.clipboard.writeText(t.getAttribute('data-copy')).then(function () {
+      t.classList.add('did'); t.textContent = 'Copied';
+      setTimeout(function () { t.classList.remove('did'); t.textContent = 'Copy'; }, 1600);
+    });
+  });
+
+  /* ── GitHub-App manifest flow (ADR 0133): mint a one-time state for OUR instance,
+        form-POST the pre-filled manifest to GitHub in a new tab (opened inside the
+        click gesture so popup blockers allow it; blocked → same-tab, the callback
+        page carries the rest), then poll the public status until the control-plane
+        runner has placed + verified the credentials. ── */
+  var manifestPollTimer = null;
+  function stopManifestPoll() { if (manifestPollTimer) { clearTimeout(manifestPollTimer); manifestPollTimer = null; } }
+
+  function startManifest(btn) {
+    if (!instanceId) return;
+    btn.disabled = true; btn.textContent = 'Preparing GitHub…';
+    var tab = window.open('about:blank', 'ghAppSetup');
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(instanceId) + '/github-app', {
+      method: 'POST', credentials: 'same-origin',
+      headers: { 'Content-Type': 'application/json' }, body: '{}'
+    }).then(function (res) {
+      if (res.status === 401) { window.location.assign(API + '/auth/web/start?return=/create'); throw new Error('signing in'); }
+      return res.json().catch(function () { return {}; }).then(function (d) {
+        if (!res.ok) {
+          var e = new Error((d.error && (d.error.message || d.error.code)) || ('HTTP ' + res.status));
+          throw e;
+        }
+        return d;
       });
+    }).then(function (d) {
+      var form = document.createElement('form');
+      form.method = 'POST'; form.action = d.post_url; form.target = tab ? 'ghAppSetup' : '_self';
+      var inp = document.createElement('input');
+      inp.type = 'hidden'; inp.name = 'manifest'; inp.value = JSON.stringify(d.manifest);
+      form.appendChild(inp); document.body.appendChild(form);
+      form.submit(); form.remove();
+      live.manifest = 'pending'; live.manifestMsg = '';
+      renderSteps();
+      pollManifest(d.state);
+    }).catch(function (err) {
+      if (String(err && err.message) === 'signing in') return;
+      if (tab) { try { tab.close(); } catch (e) {} }
+      live.manifest = 'error'; live.manifestMsg = String((err && err.message) || 'could not start');
+      renderSteps();
     });
   }
 
+  function pollManifest(stateToken) {
+    stopManifestPoll();
+    function tick() {
+      fetch(API + '/provisioning/github-app/status?state=' + encodeURIComponent(stateToken))
+        .then(function (res) { if (!res.ok) throw new Error('soft'); return res.json(); })
+        .then(function (d) {
+          var next = d.ready ? 'done' : (d.status || 'pending');
+          if (next !== live.manifest) { live.manifest = next; renderSteps(); }
+          if (!d.terminal) manifestPollTimer = setTimeout(tick, 4000);
+        })
+        .catch(function () { manifestPollTimer = setTimeout(tick, 8000); });
+    }
+    tick();
+  }
+
   /* ── live build progress (task 2083): poll the instance until it's up.
         Read-only — GET /provisioning/instances/:id (own-scoped) every 5s. ── */
   var pollTimer = null;
@@ -1073,6 +1234,7 @@ input[type=text].bad{border-color:var(--err);}
   }
   function startProgress(id) {
     if (!id) return;
+    instanceId = id;   // the manifest flow mints against this instance
     stopPolling();
     var ticks = 0;
     var el = $('liveProgress');
@@ -1097,7 +1259,12 @@ input[type=text].bad{border-color:var(--err);}
           return res.json();
         })
         .then(function (data) {
-          var terminal = renderProgress(data.instance);
+          var inst = data.instance;
+          /* the checklist reflects live state (task 1002694): a status transition —
+             e.g. the scaffold landing — re-renders the steps (change-only, so the
+             5s tick never clobbers an open dropdown or mid-flight button) */
+          if (inst && inst.status !== live.instStatus) { live.instStatus = inst.status; renderSteps(); }
+          var terminal = renderProgress(inst);
           if (!terminal) pollTimer = setTimeout(tick, 5000);
           else stopPolling();
         })
@@ -1121,6 +1288,10 @@ input[type=text].bad{border-color:var(--err);}
     again.type = 'button'; again.className = 'again'; again.textContent = 'Start another project';
     again.addEventListener('click', function () {
       stopPolling();
+      stopManifestPoll();
+      instanceId = null;
+      live = { instStatus: null, manifest: null, manifestMsg: '' };
+      lastStepsHtml = '';
       try { sessionStorage.removeItem(CREATED_KEY); sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
       state = { step: 1, name: '', mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '' };
       $('f-name').value = ''; $('f-owner').value = ''; $('f-repo').value = ''; $('f-slug').value = ''; $('f-domain').value = '';

package/scripts/gds/onboard.js

@@ -199,6 +199,15 @@ async function run() {
 
     // Step 10 — brand
     log('\n⑨ Brand the instance look — fill theme/palette/fonts in config/branding.json (docs/branding-fill-prompt.md).');
+
+    // Step 11 — enter the builders hall (task 1002703): the point of all of the above.
+    // With a domain the hall lives on the instance; without one, `bongos dev` runs it locally.
+    if (a.domain) {
+      log(`\n⑩ Enter your builders hall — open https://${a.domain}/builders. That's your project's home.`);
+    } else {
+      log('\n⑩ Enter your builders hall — no domain yet, so run `bongos dev` in your repo checkout:');
+      log('   it stands the instance up locally and serves the hall on your machine.');
+    }
     log('\n✓ onboard walkthrough complete. Your standalone instance is live and owned.\n');
   } finally {
     rl.close();

package/src/module-api.js

@@ -559,8 +559,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.64 with no explicit bump. run 31562193292. (task 1002620)
 //   1.19.66 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.65 with no explicit bump. run 31599966075. (task 1002620)
+//   1.19.67 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.66 with no explicit bump. run 31605591253. (task 1002620)
+//   1.19.68 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.67 with no explicit bump. run 31608183268. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.66'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.68'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/onboard.mjs

@@ -7,14 +7,15 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const ob = require('../scripts/gds/onboard.js');
 
-test('onboardPlan is the canonical sequence: name+address first, brand last, four legs automated around the human steps', () => {
+test('onboardPlan is the canonical sequence: name+address first, the builders hall last, four legs automated around the human steps', () => {
   const plan = ob.onboardPlan();
   const keys = plan.map((s) => s.key);
   assert.equal(keys[0], 'name-address');
-  assert.equal(keys[keys.length - 1], 'brand');
+  assert.equal(keys[keys.length - 1], 'enter-hall');
+  assert.equal(keys[keys.length - 2], 'brand');
   // the irreducibly-human steps (must be UI-first prompts)
   const human = plan.filter((s) => s.kind === 'human').map((s) => s.key);
-  assert.deepEqual(human, ['github-repo', 'oauth-app', 'first-sign-in']);
+  assert.deepEqual(human, ['github-repo', 'oauth-app', 'first-sign-in', 'enter-hall']);
   // the DNS preflight comes BEFORE provision (task 1980: before the address step)
   assert.ok(keys.indexOf('dns-preflight') < keys.indexOf('provision'), 'dns preflight precedes provision');
   // OAuth secret placement comes after the OAuth app + before first sign-in
@@ -52,6 +53,63 @@ test('onboardPlan lists seed-first-version as an explicit AUTO step right after
   assert.ok(ob.onboardPlan('adopt').some((s) => s.key === 'seed-version'), 'adopt gets it too');
 });
 
+test('onboardPlan ends at the builders hall, terminal label branching on domain (task 1002703)', () => {
+  // The hall is the entire point of creating a project, yet the sequence used to stop
+  // at brand — owners only learned about `bongos dev` or their hall URL by being told
+  // (idea 1000693). One terminal step in the ONE source reaches every render surface.
+  for (const mode of ['greenfield', 'adopt']) {
+    const dflt = ob.onboardPlan(mode);
+    const last = dflt[dflt.length - 1];
+    assert.equal(last.key, 'enter-hall', `${mode}: the plan ends at the hall`);
+    assert.equal(last.kind, 'human', 'entering the hall is the owner\'s own action');
+    assert.match(last.label, /bongos dev/, 'no domain → the local-hall one-liner');
+
+    const withDomain = ob.onboardPlan(mode, { domain: 'mercury.example.com' });
+    const lastD = withDomain[withDomain.length - 1];
+    assert.equal(lastD.key, 'enter-hall');
+    assert.match(lastD.label, /https:\/\/mercury\.example\.com\/builders/, 'domain → the instance\'s hall address');
+    assert.doesNotMatch(lastD.label, /bongos dev/, 'with a domain the local fallback is noise');
+    // only the terminal label branches — the skeleton is identical
+    assert.deepEqual(withDomain.map((s) => s.key), dflt.map((s) => s.key));
+  }
+  // a blank / whitespace domain is "no domain"
+  const blank = ob.onboardPlan('greenfield', { domain: '   ' });
+  assert.match(blank[blank.length - 1].label, /bongos dev/);
+});
+
+test('every render surface carries the terminal hall step (task 1002703)', () => {
+  // The human-steps drift guard below pins the TAG; this pins the CONTENT — each
+  // surface must point at the hall (domain branch) and at `bongos dev` (local branch).
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const read = (rel) => readFileSync(path.join(import.meta.dirname, '..', rel), 'utf8');
+  const cli = read('scripts/gds/onboard.js');
+  assert.match(cli, /builders hall/i, 'the CLI walkthrough ends at the hall');
+  assert.match(cli, /bongos dev/, 'the CLI offers the local-hall one-liner when no domain');
+  const createHtml = read('public-landing/create.html');
+  const enterHall = createHtml.match(/data-onboard-step="enter-hall"[^]*?<\/li>/g) || [];
+  assert.ok(enterHall.length >= 1, '/create tags the enter-hall step');
+  assert.match(enterHall.join(''), /\/builders/, '/create points at the hall address');
+  assert.match(enterHall.join(''), /bongos dev/, '/create offers the local hall when no domain');
+});
+
+test('the /create done panel is plan-driven, manifest-driven, and owner-honest (task 1002694)', () => {
+  // Gaps 2/3/4/14 of the project-creation audit (docs/audits/project-creation-gap-list.md).
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const src = readFileSync(path.join(import.meta.dirname, '..', 'public-landing/create.html'), 'utf8');
+  // gap 2 (idea 1000675): the checklist renders FROM the canonical plan endpoint
+  assert.match(src, /provisioning\/onboard-plan/, 'the done panel fetches the canonical plan');
+  // gap 3 (idea 1000676): the ADR 0133 one-click manifest flow has a UI caller again
+  assert.match(src, /\/github-app/, 'the done panel drives the GitHub-App manifest flow');
+  assert.match(src, /github-app\/status/, 'and polls its progress to reflect live state');
+  // gap 4: the operator-only control-plane command never reaches a new owner
+  assert.doesNotMatch(src, /oauth-secret place/, 'owners are never handed the control-plane placement command');
+  // gap 14 (idea 1000684): repo visibility is stated, with the private path named
+  assert.match(src, /public/, 'visibility is stated');
+  assert.match(src, /adopt/i, 'the private path (adopt your own private repo) is named');
+});
+
 test('oauthAppInstructions pins the apex callback + homepage and points at ACCOUNT Developer settings', () => {
   const oa = ob.oauthAppInstructions('mercury.example.com');
   assert.equal(oa.homepageUrl, 'https://mercury.example.com');
@@ -113,7 +171,10 @@ test('the web form (/create) declares EXACTLY the canonical human steps — drif
   };
   for (const [name, rel] of Object.entries(surfaces)) {
     const src = readFileSync(path.join(import.meta.dirname, '..', rel), 'utf8');
-    const found = [...src.matchAll(/data-onboard-step="([^"]+)"/g)].map((m) => m[1]);
+    // keys are kebab-case literals; the charset excludes the page's DYNAMIC fallback
+    // tag (data-onboard-step="' + esc(s.key) + '"), which renders unknown plan steps
+    // at runtime and has no literal key to pin here (task 1002694).
+    const found = [...src.matchAll(/data-onboard-step="([a-z0-9-]+)"/g)].map((m) => m[1]);
     const uniq = [...new Set(found)].sort();
     assert.deepEqual(uniq, humanKeys, `${name} (${rel}) must tag exactly the canonical human steps [${humanKeys}], found [${uniq}]`);
   }

package/tests/provisioning_onboard_mode.mjs

@@ -162,6 +162,32 @@ await ta('POST /instances: an unknown onboard_mode is REFUSED (never silently co
   assert.deepEqual(res.body.error.valid, ['greenfield', 'adopt']);
 });
 
+function get(path) {
+  return new Promise((resolve, reject) => {
+    http.get(`${base}${path}`, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    }).on('error', reject);
+  });
+}
+
+await ta('GET /onboard-plan: ?domain= relabels the terminal enter-hall step; garbage is ignored, never echoed (task 1002703)', async () => {
+  const bare = await get('/provisioning/onboard-plan');
+  assert.equal(bare.status, 200);
+  const bareLast = bare.body.steps[bare.body.steps.length - 1];
+  assert.equal(bareLast.key, 'enter-hall');
+  assert.match(bareLast.label, /bongos dev/, 'no domain → the local-hall one-liner');
+  const dom = await get('/provisioning/onboard-plan?domain=mercury.example.com');
+  const domLast = dom.body.steps[dom.body.steps.length - 1];
+  assert.match(domLast.label, /https:\/\/mercury\.example\.com\/builders/, 'domain → that instance\'s hall');
+  // clients render these labels — a non-hostname must be dropped, not reflected back
+  const bad = await get('/provisioning/onboard-plan?domain=' + encodeURIComponent('<script>alert(1)</script>'));
+  const badLast = bad.body.steps[bad.body.steps.length - 1];
+  assert.match(badLast.label, /bongos dev/);
+  assert.ok(!badLast.label.includes('<script>'), 'unvalidated input never reaches the label');
+});
+
 await ta('POST /instances: adopt WITHOUT target_ref is refused — there is no repo to layer onto', async () => {
   // Without target_ref the runner would fall back to greenfield behavior on a row labelled
   // adopt. Refuse at the door rather than store a lie.