@bongos/core 1.19.67 → 1.19.68

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.67",
-  "core_contract": "1.19.67",
-  "source_commit": "cd54b1b3803fb68412c34eabaf969761c6b22728",
+  "core_version": "1.19.68",
+  "core_contract": "1.19.68",
+  "source_commit": "0b0e7e636f0a28d01e1bc8f354a06981d6f1ef70",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T14:13:54.700Z",
+  "built_at": "2026-08-12T14:42:16.480Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 292,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1535,
-  "tree_sha256": "6689b03f0138061c04be8b757cd0a1a13b43f4c64e6d766df97906e306378cf9",
+  "tree_sha256": "cc9278ac9df146953fa33e771313791e8ce82f5d69b05a307763c48bae6207e9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4042,12 +4042,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2e4247ac977969f19efdfa6e7e4c111f131e8e6200e393b7e19393d65b57d6ae"
+      "sha256": "9319b9acd693e6a9804c215db5ed78ae38f4caf1a698e0596972bfef9555b91c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a840fe8d34e5195d246bfb20de03cf4864bec50d21ba5d3abe4eb17f8ed47275"
+      "sha256": "147790e86972f4273aa18bd24bf508797c4470a4491a20a9614207edeb2e3478"
     },
     {
       "path": "public-docs/index.html",
@@ -4292,7 +4292,7 @@
     {
       "path": "public-landing/create.html",
       "mode": "0000644",
-      "sha256": "a90e1cfe70592338dd9e3bb733a5655f8b772594f74a09b0b2a3075ff90c5487"
+      "sha256": "1874575c2241df1e868d158f3fc4c6c123b8c35531a5b1425de9974230da6510"
     },
     {
       "path": "public-landing/gate/README.md",
@@ -5672,7 +5672,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7f872cf877475c7b89a389c016abb6cdcdbc34a7847b8bf882dd67e8dc49048c"
+      "sha256": "28675b76775e2936b6ba819fa37c6628f96b259b850248f2ce1033e9bcd7fe20"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7037,7 +7037,7 @@
     {
       "path": "tests/onboard.mjs",
       "mode": "0000644",
-      "sha256": "93125254eed5a46e933484062942e43966e3cac898e642d546cd467da635223f"
+      "sha256": "6a66477263031b252d6a92d5036304a78e11cbbd9e7230d836c4ec96a9297fdd"
     },
     {
       "path": "tests/onboarding_gate.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.67",
+  "version": "1.19.68",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.67",
+      "version": "1.19.68",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.67",
+  "version": "1.19.68",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/create.html

@@ -251,6 +251,14 @@ input[type=text].bad{border-color:var(--err);}
 }
 .steps b{font-size:15px;}
 .steps p{font-size:13.5px;font-weight:500;color:var(--ink-soft);line-height:1.55;margin-top:4px;}
+/* live checklist states (task 1002694): a step the platform has verified done, and a
+   step that can't be performed yet (its prerequisite — usually the domain — is missing) */
+.steps>li.sdone{border-color:#bbe7c8;background:linear-gradient(180deg,#f0fdf4 0%,#fcfffc 100%);}
+.steps>li.sdone::before{content:"✓";background:var(--ok);color:#fff;}
+.steps>li.slocked{opacity:.6;}
+.steps details{margin-top:10px;}
+.steps summary{cursor:pointer;font-weight:700;font-size:12.5px;color:var(--ink-faint);}
+.steps details p{margin-top:8px;}
 .kv{
   display:flex;align-items:center;gap:8px;margin-top:9px;background:var(--bg);border:1.5px solid var(--line);
   border-radius:11px;padding:8px 8px 8px 12px;font-size:12.5px;
@@ -727,7 +735,10 @@ input[type=text].bad{border-color:var(--err);}
     } else if (clash) {
       hint.className = 'hint err'; hint.innerHTML = 'You already have a repo named <strong>' + esc(state.repo) + '</strong> — pick another name, or adopt it instead.';
     } else {
-      hint.className = 'hint'; hint.innerHTML = 'We’ll create an empty repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code>.';
+      /* Visibility stated up front (task 1002694 / idea 1000684): repos WE create are
+         public by design (github-repos.js — open-source, capture-resistant); the
+         private path is adopting a private repo the owner makes themselves. */
+      hint.className = 'hint'; hint.innerHTML = 'We’ll create an empty <strong>public</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code> — projects here are open by design. Want private code? Create the repo yourself on GitHub and “adopt” it instead.';
     }
   }
   $('ghNewName').addEventListener('input', function () { state.repo = this.value.trim(); updateFreshPreview(); saveDraft(); });
@@ -983,56 +994,203 @@ input[type=text].bad{border-color:var(--err);}
     });
   });
 
-  /* ── done panel: the canonical human steps (same sequence as the /new-project
-        skill + `bongos onboard` + the hall wizard — goal 35; ADR 0121 branches
-        only the repo leg on greenfield vs adopt) ── */
+  /* ── done panel: rendered FROM the canonical onboard plan (task 1002694, gap 2 /
+        idea 1000675). GET /provisioning/onboard-plan is the single source the
+        /new-project skill + `bongos onboard` read too, so the checklist can't
+        drift. A per-key renderer adds this page's rich UI; an unknown human step
+        falls back to the plan's own label, so a new canonical step surfaces here
+        by default instead of silently vanishing. ── */
   function copyBtn(text) {
     return '<button type="button" class="copy" data-copy="' + esc(text) + '">Copy</button>';
   }
-  function renderDone(data) {
-    var adopt = state.mode === 'adopt';
-    var oa = state.domain ? oauthAppValues(state.domain) : null;
-    $('doneLede').innerHTML = 'Provisioning is requested for <strong>' + esc(state.name || state.slug) + '</strong>' +
-      (adopt ? ' — adopting your existing repo' : '') +
-      '. The platform stands up the server, database, and address on its own — you can watch its live status right here.';
+  var GH_ICON = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
+
+  var instanceId = null;             // set when a create lands / a resumed watch starts
+  var live = { instStatus: null, manifest: null, manifestMsg: '' };
+  var planPromises = {};             // mode|domain → Promise<steps[]>
+  var lastStepsHtml = '';
+  var FALLBACK_HUMAN_KEYS = ['github-repo', 'oauth-app', 'first-sign-in', 'enter-hall'];
+
+  function fetchPlan() {
+    var domain = state.domain || '';
+    var key = state.mode + '|' + domain;
+    if (!planPromises[key]) {
+      planPromises[key] = fetch(API + '/provisioning/onboard-plan?mode=' + encodeURIComponent(state.mode) + (domain ? '&domain=' + encodeURIComponent(domain) : ''))
+        .then(function (res) { if (!res.ok) throw new Error('plan'); return res.json(); })
+        .then(function (d) { return (d && d.steps) || []; })
+        .catch(function () {
+          delete planPromises[key];  // transient — retried on the next render
+          return FALLBACK_HUMAN_KEYS.map(function (k) { return { key: k, kind: 'human', label: '' }; });
+        });
+    }
+    return planPromises[key];
+  }
 
-    var steps = [];
+  /* github-repo — adopt / auto-created / manual-create, each aware of whether the
+     scaffold has landed (instance active ⇒ the build already pushed). The wizard
+     files onboard_mode to the server, so for adopt the RUNNER clones + layers
+     (task 1002562) — the owner no longer runs `bongos init --adopt` here. */
+  function renderStepGithubRepo() {
+    var landed = live.instStatus === 'active';
     var repoLabel = state.owner && state.repo ? '<strong>' + esc(state.owner + '/' + state.repo) + '</strong>' : 'your new repository';
+    if (state.mode === 'adopt') {
+      return landed
+        ? '<li class="sdone" data-onboard-step="github-repo"><b>Your repo carries the platform</b><p>The build layered the platform onto ' + repoLabel + ' — existing files, history, and backlog kept. Pull to see it.</p></li>'
+        : '<li data-onboard-step="github-repo"><b>Your existing repo</b><p>The build clones ' + repoLabel + ' and layers the platform onto its existing history — nothing is created or emptied, and your backlog is imported. Nothing for you to do here.</p></li>';
+    }
+    if (state.repoAutoCreated) {
+      return landed
+        ? '<li class="sdone" data-onboard-step="github-repo"><b>Repo ready — scaffold landed</b><p>We created ' + repoLabel + ' (public, by design) and the build pushed your project’s starting files to it.</p></li>'
+        : '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLabel + ' on GitHub for you — public (projects here are open by design), empty, and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>';
+    }
     var ghNewUrl = githubNewRepoUrl(state.owner, state.repo);
-    var ghIcon = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
-    steps.push(adopt
-      ? '<li data-onboard-step="github-repo"><b>Layer onto your existing repo</b><p>In your repo run <code style="font-family:var(--font-mono)">bongos init --adopt</code>. It shows a conflict pre-flight and writes <em>nothing</em> until you accept — your files and history stay yours, and your existing backlog is imported. Commit and push.</p></li>'
-      : (state.repoAutoCreated
-        ? '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLabel + ' on GitHub for you — empty and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>'
-        : '<li data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
-        '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + ghIcon + 'Create ' + repoLabel + ' on GitHub</a></li>'));
+    return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
+      '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + GH_ICON + 'Create ' + repoLabel + ' on GitHub</a></li>';
+  }
+
+  /* The manual OAuth-app path stays as a documented fallback (ADR 0133), but the
+     control-plane placement is named as the operator's, never handed to the owner
+     as a command to run (gap 4). */
+  function manualOauthDetails() {
+    var oa = oauthAppValues(state.domain);
+    return '<details><summary>Prefer to create an OAuth app by hand?</summary>' +
+      '<p>GitHub → <em>your account’s</em> Settings → Developer settings → OAuth Apps → New OAuth App. (Developer settings live under your account, not the repo.)</p>' +
+      '<div class="kv"><span class="kk">Homepage URL</span><code>' + esc(oa.homepageUrl) + '</code>' + copyBtn(oa.homepageUrl) + '</div>' +
+      '<div class="kv"><span class="kk">Callback URL</span><code>' + esc(oa.callbackUrl) + '</code>' + copyBtn(oa.callbackUrl) + '</div>' +
+      '<p>The generated credentials are placed on the platform’s control plane by an operator — that part isn’t yours to run (the one-click path above does it all automatically). It’s done when <code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '/healthz</code> reports <code style="font-family:var(--font-mono)">auth_configured: true</code>.</p></details>';
+  }
+
+  /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow is the primary path
+     (gap 3 / idea 1000676); locked until a domain exists (the App needs the real
+     callback host — the server refuses domainless with domain_required). */
+  function renderStepOauthApp() {
     if (!state.domain) {
-      steps.push('<li><b>Add a domain you own</b><p>Sign-in on your new instance needs a real domain. When you have one, attach it from <a href="/projects">your projects page</a> — the address gets wired in minutes.</p></li>');
+      return '<li class="slocked" data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Unlocks once your project has an address — sign-in needs a real domain. Attach one any time from <a href="/projects">your projects page</a>.</p></li>';
+    }
+    if (live.manifest === 'done') {
+      return '<li class="sdone" data-onboard-step="oauth-app"><b>GitHub sign-in is wired</b><p>Credentials placed and verified — sign-in on <code style="font-family:var(--font-mono)">' + esc(state.domain) + '</code> is live.</p></li>';
+    }
+    if (live.manifest === 'error' || live.manifest === 'expired') {
+      return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>' +
+        (live.manifest === 'expired' ? 'That setup link expired (they last 30 minutes) — mint a fresh one.' : 'GitHub setup hit a snag' + (live.manifestMsg ? ': ' + esc(live.manifestMsg) : '') + '. Try again.') + '</p>' +
+        '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
+    }
+    if (live.manifest) {   // pending / code_received — GitHub or the runner is mid-flight
+      return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p></li>';
     }
-    if (oa) {
-      steps.push('<li data-onboard-step="oauth-app"><b>Create the GitHub OAuth app</b><p>GitHub → <em>your account’s</em> Settings → Developer settings → OAuth Apps → New OAuth App. (Developer settings live under your account, not the repo.)</p>' +
-        '<div class="kv"><span class="kk">Homepage URL</span><code>' + esc(oa.homepageUrl) + '</code>' + copyBtn(oa.homepageUrl) + '</div>' +
-        '<div class="kv"><span class="kk">Callback URL</span><code>' + esc(oa.callbackUrl) + '</code>' + copyBtn(oa.callbackUrl) + '</div></li>');
-      var cmd = 'bongos oauth-secret place ' + state.slug + ' --client-id <id> --client-secret <secret> --apply';
-      steps.push('<li><b>Place the secret — verified</b><p>Never hand-edit the env file. On the control plane run the placement command; it checks the value is real and confirms sign-in works.</p>' +
-        '<div class="kv"><code>' + esc(cmd) + '</code>' + copyBtn(cmd) + '</div></li>');
-      steps.push('<li data-onboard-step="first-sign-in"><b>First sign-in</b><p>Open <code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '</code> and sign in with GitHub once. That seats you as the owner — the founding Archon.</p></li>');
-      steps.push('<li><b>Verify</b><p><code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '/healthz</code> should report <code style="font-family:var(--font-mono)">auth_configured: true</code>. Then the hall is yours.</p></li>');
+    return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in — one click</b><p>Approve a pre-filled GitHub App and the platform wires sign-in by itself: no keys to copy, and the secret never leaves the server side.</p>' +
+      '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
+  }
+
+  function renderStepFirstSignIn() {
+    if (!state.domain) {
+      return '<li class="slocked" data-onboard-step="first-sign-in"><b>First sign-in</b><p>Unlocks with sign-in above — you’ll open your project’s address, sign in with GitHub once, and be seated as the owner (the founding Archon).</p></li>';
     }
-    steps.push(state.domain
+    return '<li data-onboard-step="first-sign-in"><b>First sign-in</b><p>Open <a href="https://' + esc(state.domain) + '" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(state.domain) + '</code></a> and sign in with GitHub once. That seats you as the owner — the founding Archon.</p></li>';
+  }
+
+  function renderStepEnterHall() {
+    return state.domain
       ? '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>Your project’s home — open <a href="https://' + esc(state.domain) + '/builders" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(state.domain) + '/builders</code></a> and start building.</p></li>'
-      : '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>No address yet — run <code style="font-family:var(--font-mono)">bongos dev</code> in your repo checkout to start the local hall on your machine.</p></li>');
-    $('humanSteps').innerHTML = steps.join('');
-    $('humanSteps').addEventListener('click', function (ev) {
-      var t = ev.target.closest('.copy');
-      if (!t) return;
-      navigator.clipboard.writeText(t.getAttribute('data-copy')).then(function () {
-        t.classList.add('did'); t.textContent = 'Copied';
-        setTimeout(function () { t.classList.remove('did'); t.textContent = 'Copy'; }, 1600);
+      : '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>No address yet — run <code style="font-family:var(--font-mono)">bongos dev</code> in your repo checkout to start the local hall on your machine.</p></li>';
+  }
+
+  var STEP_RENDERERS = {
+    'github-repo': renderStepGithubRepo,
+    'oauth-app': renderStepOauthApp,
+    'first-sign-in': renderStepFirstSignIn,
+    'enter-hall': renderStepEnterHall
+  };
+
+  function renderSteps() {
+    fetchPlan().then(function (steps) {
+      var html = steps.filter(function (s) { return s && s.kind === 'human'; }).map(function (s) {
+        var r = STEP_RENDERERS[s.key];
+        return r ? r(s) : '<li data-onboard-step="' + esc(s.key) + '"><b>' + esc(s.label || s.key) + '</b></li>';
+      }).join('');
+      if (html === lastStepsHtml) return;   // change-only re-render — polls never clobber open UI
+      lastStepsHtml = html;
+      $('humanSteps').innerHTML = html;
+    });
+  }
+
+  function renderDone() {
+    var adopt = state.mode === 'adopt';
+    $('doneLede').innerHTML = 'Provisioning is requested for <strong>' + esc(state.name || state.slug) + '</strong>' +
+      (adopt ? ' — adopting your existing repo' : '') +
+      '. The platform stands up the server, database, and address on its own — you can watch its live status right here.';
+    renderSteps();
+  }
+
+  /* One delegated listener — renderSteps swaps innerHTML, so handlers live on the list. */
+  $('humanSteps').addEventListener('click', function (ev) {
+    var mBtn = ev.target.closest('[data-action="manifest-start"]');
+    if (mBtn) { startManifest(mBtn); return; }
+    var t = ev.target.closest('.copy');
+    if (!t) return;
+    navigator.clipboard.writeText(t.getAttribute('data-copy')).then(function () {
+      t.classList.add('did'); t.textContent = 'Copied';
+      setTimeout(function () { t.classList.remove('did'); t.textContent = 'Copy'; }, 1600);
+    });
+  });
+
+  /* ── GitHub-App manifest flow (ADR 0133): mint a one-time state for OUR instance,
+        form-POST the pre-filled manifest to GitHub in a new tab (opened inside the
+        click gesture so popup blockers allow it; blocked → same-tab, the callback
+        page carries the rest), then poll the public status until the control-plane
+        runner has placed + verified the credentials. ── */
+  var manifestPollTimer = null;
+  function stopManifestPoll() { if (manifestPollTimer) { clearTimeout(manifestPollTimer); manifestPollTimer = null; } }
+
+  function startManifest(btn) {
+    if (!instanceId) return;
+    btn.disabled = true; btn.textContent = 'Preparing GitHub…';
+    var tab = window.open('about:blank', 'ghAppSetup');
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(instanceId) + '/github-app', {
+      method: 'POST', credentials: 'same-origin',
+      headers: { 'Content-Type': 'application/json' }, body: '{}'
+    }).then(function (res) {
+      if (res.status === 401) { window.location.assign(API + '/auth/web/start?return=/create'); throw new Error('signing in'); }
+      return res.json().catch(function () { return {}; }).then(function (d) {
+        if (!res.ok) {
+          var e = new Error((d.error && (d.error.message || d.error.code)) || ('HTTP ' + res.status));
+          throw e;
+        }
+        return d;
       });
+    }).then(function (d) {
+      var form = document.createElement('form');
+      form.method = 'POST'; form.action = d.post_url; form.target = tab ? 'ghAppSetup' : '_self';
+      var inp = document.createElement('input');
+      inp.type = 'hidden'; inp.name = 'manifest'; inp.value = JSON.stringify(d.manifest);
+      form.appendChild(inp); document.body.appendChild(form);
+      form.submit(); form.remove();
+      live.manifest = 'pending'; live.manifestMsg = '';
+      renderSteps();
+      pollManifest(d.state);
+    }).catch(function (err) {
+      if (String(err && err.message) === 'signing in') return;
+      if (tab) { try { tab.close(); } catch (e) {} }
+      live.manifest = 'error'; live.manifestMsg = String((err && err.message) || 'could not start');
+      renderSteps();
     });
   }
 
+  function pollManifest(stateToken) {
+    stopManifestPoll();
+    function tick() {
+      fetch(API + '/provisioning/github-app/status?state=' + encodeURIComponent(stateToken))
+        .then(function (res) { if (!res.ok) throw new Error('soft'); return res.json(); })
+        .then(function (d) {
+          var next = d.ready ? 'done' : (d.status || 'pending');
+          if (next !== live.manifest) { live.manifest = next; renderSteps(); }
+          if (!d.terminal) manifestPollTimer = setTimeout(tick, 4000);
+        })
+        .catch(function () { manifestPollTimer = setTimeout(tick, 8000); });
+    }
+    tick();
+  }
+
   /* ── live build progress (task 2083): poll the instance until it's up.
         Read-only — GET /provisioning/instances/:id (own-scoped) every 5s. ── */
   var pollTimer = null;
@@ -1076,6 +1234,7 @@ input[type=text].bad{border-color:var(--err);}
   }
   function startProgress(id) {
     if (!id) return;
+    instanceId = id;   // the manifest flow mints against this instance
     stopPolling();
     var ticks = 0;
     var el = $('liveProgress');
@@ -1100,7 +1259,12 @@ input[type=text].bad{border-color:var(--err);}
           return res.json();
         })
         .then(function (data) {
-          var terminal = renderProgress(data.instance);
+          var inst = data.instance;
+          /* the checklist reflects live state (task 1002694): a status transition —
+             e.g. the scaffold landing — re-renders the steps (change-only, so the
+             5s tick never clobbers an open dropdown or mid-flight button) */
+          if (inst && inst.status !== live.instStatus) { live.instStatus = inst.status; renderSteps(); }
+          var terminal = renderProgress(inst);
           if (!terminal) pollTimer = setTimeout(tick, 5000);
           else stopPolling();
         })
@@ -1124,6 +1288,10 @@ input[type=text].bad{border-color:var(--err);}
     again.type = 'button'; again.className = 'again'; again.textContent = 'Start another project';
     again.addEventListener('click', function () {
       stopPolling();
+      stopManifestPoll();
+      instanceId = null;
+      live = { instStatus: null, manifest: null, manifestMsg: '' };
+      lastStepsHtml = '';
       try { sessionStorage.removeItem(CREATED_KEY); sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
       state = { step: 1, name: '', mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '' };
       $('f-name').value = ''; $('f-owner').value = ''; $('f-repo').value = ''; $('f-slug').value = ''; $('f-domain').value = '';

package/src/module-api.js

@@ -561,8 +561,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.65 with no explicit bump. run 31599966075. (task 1002620)
 //   1.19.67 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.66 with no explicit bump. run 31605591253. (task 1002620)
+//   1.19.68 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.67 with no explicit bump. run 31608183268. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.67'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.68'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/onboard.mjs

@@ -93,6 +93,23 @@ test('every render surface carries the terminal hall step (task 1002703)', () =>
   assert.match(enterHall.join(''), /bongos dev/, '/create offers the local hall when no domain');
 });
 
+test('the /create done panel is plan-driven, manifest-driven, and owner-honest (task 1002694)', () => {
+  // Gaps 2/3/4/14 of the project-creation audit (docs/audits/project-creation-gap-list.md).
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const src = readFileSync(path.join(import.meta.dirname, '..', 'public-landing/create.html'), 'utf8');
+  // gap 2 (idea 1000675): the checklist renders FROM the canonical plan endpoint
+  assert.match(src, /provisioning\/onboard-plan/, 'the done panel fetches the canonical plan');
+  // gap 3 (idea 1000676): the ADR 0133 one-click manifest flow has a UI caller again
+  assert.match(src, /\/github-app/, 'the done panel drives the GitHub-App manifest flow');
+  assert.match(src, /github-app\/status/, 'and polls its progress to reflect live state');
+  // gap 4: the operator-only control-plane command never reaches a new owner
+  assert.doesNotMatch(src, /oauth-secret place/, 'owners are never handed the control-plane placement command');
+  // gap 14 (idea 1000684): repo visibility is stated, with the private path named
+  assert.match(src, /public/, 'visibility is stated');
+  assert.match(src, /adopt/i, 'the private path (adopt your own private repo) is named');
+});
+
 test('oauthAppInstructions pins the apex callback + homepage and points at ACCOUNT Developer settings', () => {
   const oa = ob.oauthAppInstructions('mercury.example.com');
   assert.equal(oa.homepageUrl, 'https://mercury.example.com');
@@ -154,7 +171,10 @@ test('the web form (/create) declares EXACTLY the canonical human steps — drif
   };
   for (const [name, rel] of Object.entries(surfaces)) {
     const src = readFileSync(path.join(import.meta.dirname, '..', rel), 'utf8');
-    const found = [...src.matchAll(/data-onboard-step="([^"]+)"/g)].map((m) => m[1]);
+    // keys are kebab-case literals; the charset excludes the page's DYNAMIC fallback
+    // tag (data-onboard-step="' + esc(s.key) + '"), which renders unknown plan steps
+    // at runtime and has no literal key to pin here (task 1002694).
+    const found = [...src.matchAll(/data-onboard-step="([a-z0-9-]+)"/g)].map((m) => m[1]);
     const uniq = [...new Set(found)].sort();
     assert.deepEqual(uniq, humanKeys, `${name} (${rel}) must tag exactly the canonical human steps [${humanKeys}], found [${uniq}]`);
   }