@bongos/core 1.19.838 → 1.19.840

package/modules/lifecycle/pr-assign.js

@@ -0,0 +1,77 @@
+// modules/lifecycle/pr-assign.js — assign a ship's pull request to the builder who wrote
+// it, and name them in its body (task 1003991).
+//
+// WHY. A builder box holds no GitHub credential (ADR 0055), so the server opens the PR
+// with its own — and GitHub records the credential's account as the AUTHOR: 259 of the
+// last 300 PRs. The builder's commits are theirs, but "created by me" is empty for them,
+// and the PR is where CI and merge state live. An ASSIGNEE is the one PR-level link to a
+// person the server can set for someone else; "assigned to me" then finds their work.
+//
+// A COURTESY, NEVER A GATE. assignPullRequest resolves { assigned, reason? } on every
+// path and never rejects: a login GitHub will not assign (not a collaborator — it
+// answers 201 and silently drops the name), a missing permission or a network fault
+// must not be able to fail a ship that already pushed. A sibling of github-push.js
+// rather than a function in it because that file sits at the line cap.
+
+'use strict';
+
+const githubPush = require('./github-push');
+
+// GitHub's own login rule: 1–39 chars, alphanumeric with single inner hyphens — plus
+// the underscore a managed-user login carries (`name_shortcode`). The login is
+// interpolated into a PR body as an @-mention, so anything else never gets that far.
+const GITHUB_LOGIN_RE = /^[a-z\d](?:[a-z\d]|[-_](?=[a-z\d])){0,38}$/i;
+// The assignment is the one OPTIONAL call between a finished push and the route's 201:
+// a stalled GitHub must not make a ship that succeeded read as a failed publish.
+const ASSIGN_TIMEOUT_MS = 5000;
+
+function isGithubLogin(login) {
+  return typeof login === 'string' && GITHUB_LOGIN_RE.test(login);
+}
+
+// The sentence the PR body carries, or '' when there is no usable login.
+function prBuilderLine(login) {
+  return isGithubLogin(login) ? `Built by @${login}.` : '';
+}
+
+function logAssignFailure(reason, number, logImpl) {
+  try {
+    const sink = logImpl || require('../../src/module-api').logger('lifecycle');
+    sink.warn('pull request could not be assigned to its builder (the ship is unaffected)',
+      { reason: githubPush.scrubCredential(String(reason)), pr: number });
+  } catch (_) { /* logging is never load-bearing */ }
+}
+
+async function assignPullRequest({ number, login }, deps = {}) {
+  const miss = (reason, detail) => {
+    logAssignFailure(detail ? `${reason}: ${detail}` : reason, number, deps.logImpl);
+    return { assigned: false, reason };
+  };
+  try {
+    if (!isGithubLogin(login)) return miss('bad_login');
+    if (!Number.isInteger(number) || number <= 0) return miss('bad_pr_number');
+    const token = await githubPush.resolveToken(deps);
+    const repoInfo = deps.repoInfo || require('../../src/module-api').repoInfo.loadRepoInfo();
+    if (!token || !repoInfo || repoInfo.error) return miss('unconfigured');
+
+    const doFetch = deps.fetchImpl || fetch;
+    const res = await doFetch(
+      `https://api.github.com/repos/${repoInfo.owner}/${repoInfo.repo}/issues/${number}/assignees`,
+      {
+        method: 'POST',
+        headers: { ...githubPush.ghHeaders(token), 'Content-Type': 'application/json' },
+        body: JSON.stringify({ assignees: [login] }),
+        signal: AbortSignal.timeout(ASSIGN_TIMEOUT_MS),
+      }
+    );
+    if (!res.ok) return miss(`http_${res.status}`);
+    const issue = await res.json();
+    const took = ((issue && issue.assignees) || [])
+      .some((a) => String(a && a.login).toLowerCase() === login.toLowerCase());
+    return took ? { assigned: true } : miss('not_assignable');
+  } catch (e) {
+    return miss('threw', (e && e.message) || '');
+  }
+}
+
+module.exports = { assignPullRequest, prBuilderLine };

package/modules/lifecycle/routes/tasks.js

@@ -46,6 +46,7 @@ const { makeAbandonHandler } = require('./abandon-handler');
 // longer imports the grader — it resolves the `grade` kernel PORT at grade time
 // (seams.resolveOptional('grade'), in POST /tasks/:id/grade below).
 const githubPush = require('../github-push');
+const prAssign = require('../pr-assign');
 const shipAssurance = require('../ship-assurance');
 const RECONCILE_PROOF = Object.freeze({ kind: 'proof', reason: 'publish-status reconcile: land proven' });
 const seams = api;
@@ -1125,12 +1126,25 @@ module.exports = function buildTasksRouter() {
       fs.writeFileSync(bundlePath, bundleBuf);
       const { head_sha: pushedSha } = await githubPush.pushBundle({ bundlePath, branch, headSha });
       const title = `task ${id}: ${deHashRefs(valueSummary) || branch}`.slice(0, 240);
+      // task 1003991: the server's credential is the PR's AUTHOR, so the builder who
+      // wrote the work is named in the body and made its assignee. The claim holder,
+      // not the caller — an Archon re-shipping someone's strand did not write it. A
+      // lookup that FAILS names nobody (a PR body is never rewritten, so a wrong name
+      // is permanent); only a never-claimed task falls back to the caller.
+      const builderLogin = await db.getLastClaimHolder(id)
+        .then((h) => (h ? h.github_login : req.builder.github_login), () => null);
+      const builderLine = prAssign.prBuilderLine(builderLogin);
       const body =
-        `Auto-opened by GDS server-mediated publish (ADR 0055) for task ${id}.\n\n` +
+        `Auto-opened by GDS server-mediated publish (ADR 0055) for task ${id}.` +
+        `${builderLine ? ` ${builderLine}` : ''}\n\n` +
         `${deHashRefs(valueSummary) || '(no value summary)'}\n\n` +
         `Merging triggers .github/workflows/deploy-prod.yml -> ${branding().domains.publicOrigin}. ` +
         `Auto-merge is enabled — GitHub lands it once the required checks pass.`;
       const pr = await githubPush.openOrFindPullRequest({ branch, title, body });
+      // Best-effort by contract (pr-assign.js never rejects); the catch is for a future
+      // edit that forgets — an assignment must not be able to fail a pushed ship.
+      const assignment = await prAssign.assignPullRequest({ number: pr.number, login: builderLogin })
+        .catch(() => ({ assigned: false }));
       // task 1001431: ask WHY when arming fails. `auto_merge: false` on its own told the
       // builder nothing, and the commonest cause is a repo with allow_auto_merge OFF —
       // a permanent condition that reads exactly like a transient blip.
@@ -1157,6 +1171,7 @@ module.exports = function buildTasksRouter() {
       }
       return res.status(201).json({
         ok: true, pr_url: pr.url, pr_number: pr.number, head_sha: pushedSha, auto_merge: autoMerge,
+        pr_assignee: assignment.assigned ? builderLogin : null,
         // Only present when arming failed — the publish itself still succeeded (201).
         ...(autoMerge ? {} : { auto_merge_reason: autoMergeResult.reason }),
       });

package/modules/status-ui/public/index.html

@@ -352,7 +352,8 @@
     <svg><use href="#orn-diamond"/></svg>
   </div>
   <p class="foot__seal">By order of the Senate</p>
-  <p>{{worldName}} is the work of <a href="https://hermeslines.com" target="_blank" rel="noopener"><strong>Hermeslines</strong></a>, a third-party logistics house in Cleveland, Ohio.</p>
+  <!-- task 1002853: every company field is optional, so each clause drops whole when its pack field is empty -->
+  <!--brand-if:companyName--><p>{{worldName}} is the work of <!--brand-if:companySite--><a href="{{companySite}}" target="_blank" rel="noopener"><!--/brand-if:companySite--><strong>{{companyName}}</strong><!--brand-if:companySite--></a><!--/brand-if:companySite--><!--brand-if:companyTagline-->, {{companyTagline}}<!--/brand-if:companyTagline-->.</p><!--/brand-if:companyName-->
   <p>{{Currency}} are wrought by the lawmen's review; redemption awaits their seal.</p>
 </footer>
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.838",
+  "version": "1.19.840",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.838",
+      "version": "1.19.840",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.838",
+  "version": "1.19.840",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness-checks-identity.js

@@ -41,6 +41,9 @@ const { CORE_ROOT, MODULE_ROOTS, REPO_ROOT, rel } = require('./fitness-lib.js');
 const PROMPT_IDENTITY_LITERALS = [
   /off the boats/i,
   /amazonprimea/i,
+  // The host's operating company (task 1002853): the scan already covered the status
+  // page's HTML, but with only the product listed its footer credited this company for years.
+  /hermeslines/i,
 ];
 // Scan roots (recursive) + kernel-prompt CLIs that live outside them.
 // scripts/gds joined at task 1002427: the builder CLI was UNSCANNED, which is how
@@ -101,7 +104,7 @@ const IDENTITY_SCAN_EXTRA_FILES = [];
 const IDENTITY_SCAN_ALLOWED = {
   // task 1003206 moved Check 13's own regexes out of fitness.js into THIS file
   // when the monolith was split, so the detector's self-carve-out moved with them.
-  'scripts/gds/fitness-checks-identity.js': 2,
+  'scripts/gds/fitness-checks-identity.js': 3,
   'scripts/gds/package-core.js': 1,
   // audit-replay.sh + db-backup-{nightly,offsite}.sh were carved out here as
   // "host-pinned ops"; task 1002757 RETIRED that justification for them — each
@@ -125,6 +128,11 @@ const IDENTITY_SCAN_ALLOWED = {
   'scripts/gds/seed-productization-tasks.js': 6,
   'scripts/gds/seed-provisioning-tasks.js': 2,
   'scripts/gds/version-close.js': 1,
+  // task 1002853 (the company literal joined the list): audit-authorship.sh is itself a
+  // detector — its ops allowlist names the founder's commit address so it can exempt it; grade-smoke.js
+  // is a protected grader probe whose fixture task prose names the company, the seed-*.js rationale.
+  'scripts/gds/audit-authorship.sh': 1,
+  'scripts/gds/grade-smoke.js': 1,
 };
 // `.sh` joined at task 1002567: the extension set was `.js/.html/.css`, so NO shell
 // script had ever been scanned — which is how scripts/gds/lib.sh kept a hardcoded

package/scripts/gds/fitness.js

@@ -113,6 +113,12 @@ const ROOT_CHAR_HARD_MAX = 42000; // ~10.5K tokens — the always-loaded file mu
 const ROOT_CHAR_TARGET = 32000;   // ~8K tokens — aspirational, mirrors the ~200-line aim.
 const estTokens = (n) => Math.round(n / 4); // ~4 chars/token for markdown prose.
 
+// Where the charter BODY lives since task 1003687. It is guidance for EDITING a
+// CLAUDE.md, so it is paths-scoped (`paths:` frontmatter, same mechanism as
+// .claude/rules/hook-authoring.md) and costs nothing in the sessions — the large
+// majority — that never open one. The kernel keeps the heading and a pointer.
+const CHARTER_RULE_REL = '.claude/rules/claudemd-authoring.md';
+
 function checkClaudeMdBudget(opts = {}) {
   const p = path.join(INSTANCE_ROOT, 'CLAUDE.md'); // the root CLAUDE.md is INSTANCE content (materialized per instance; ADR 0108)
   const text = opts.text != null ? opts.text : fs.readFileSync(p, 'utf8');
@@ -133,8 +139,35 @@ function checkClaudeMdBudget(opts = {}) {
   }
   if (!text.includes('## Working with this file (content charter)')) {
     violations.push('CLAUDE.md is missing the content-charter section (ADR 0061) — the per-line test + "what goes where" table must stay.');
+  } else {
+    // Task 1003687 relocated the charter BODY to a paths-scoped rule, so the kernel
+    // keeps the heading and a pointer. That makes the heading cheap to fake: a section
+    // with nothing behind it satisfies a substring check while the rules it names are
+    // gone. So the charter must resolve to something — either inline here, or through a
+    // pointer whose target actually exists and still carries the two rules + the table.
+    const namesRule = text.includes(CHARTER_RULE_REL);
+    const inlineCharter = text.includes('Per-line test:');
+    if (namesRule) {
+      const rulePath = path.join(INSTANCE_ROOT, CHARTER_RULE_REL); // .claude/ is materialized INSTANCE content (ADR 0108 §3)
+      if (!fs.existsSync(rulePath)) {
+        violations.push(`CLAUDE.md points its content charter at ${CHARTER_RULE_REL}, but that file does not exist — a pointer to nothing is worse than no pointer (ADR 0061 / task 1003687).`);
+      } else {
+        const rule = fs.readFileSync(rulePath, 'utf8');
+        const missing = [];
+        if (!/^---\r?\n[\s\S]*?\bpaths:[\s\S]*?["']\*\*\/CLAUDE\.md["'][\s\S]*?^---$/m.test(rule)) {
+          missing.push('`paths:` frontmatter matching `**/CLAUDE.md` (without it the rule never loads, and the charter is simply gone)');
+        }
+        if (!rule.includes('Per-line test:')) missing.push('the per-line test');
+        if (!rule.includes('## What goes where')) missing.push('the "what goes where" table');
+        if (missing.length) {
+          violations.push(`${CHARTER_RULE_REL} is missing ${missing.join(', ')} — the kernel delegates the charter to it, so the charter is only as real as that file (ADR 0061 / task 1003687).`);
+        }
+      }
+    } else if (!inlineCharter) {
+      violations.push('The CLAUDE.md content-charter section is hollow — it has the heading but neither the per-line test inline nor a pointer to `' + CHARTER_RULE_REL + '`. The heading exists to make the rules findable; on its own it only satisfies this check (ADR 0061).');
+    }
   }
-  return { name: 'root CLAUDE.md budget + charter', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings, note: `≤ ${ROOT_HARD_MAX} lines / ${ROOT_CHAR_HARD_MAX} chars (~${estTokens(ROOT_CHAR_HARD_MAX)} tok); targets ~${ROOT_TARGET} lines / ~${estTokens(ROOT_CHAR_TARGET)} tok; charter present.` };
+  return { name: 'root CLAUDE.md budget + charter', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings, note: `≤ ${ROOT_HARD_MAX} lines / ${ROOT_CHAR_HARD_MAX} chars (~${estTokens(ROOT_CHAR_HARD_MAX)} tok); targets ~${ROOT_TARGET} lines / ~${estTokens(ROOT_CHAR_TARGET)} tok; charter resolves (inline or via ${CHARTER_RULE_REL}).` };
 }
 
 // ============================================================================

package/scripts/gds/paste-token.js

@@ -32,27 +32,71 @@ const { SESSION_FILENAMES, readSessionConfigSync } = require('../../src/instance
 // WRITE the session to the configured instance dir (OTB → ~/.config/otb,
 // unchanged; a fresh instance → its neutral dir). R61 / task 1200.
 const SESSION_PATH = ic.configPath(SESSION_FILENAMES[0]);
-// env → the EXISTING session's api_base → this instance's branding default.
-// On a RE-auth a session file already exists, and its api_base is the best signal
-// of which instance the builder is on — this file used to hardcode the founder
-// host here (a straggler the task 1002201 sweep missed), so a token minted by
-// another instance was verified against example.com and rejected 401 with a
-// perfectly valid token (task 1002427).
-const API_BASE = ic.resolveApiBase();
+
+// `--api-base <url>` / `--api-base=<url>`, plus the positional token. Hand-rolled
+// because this script has no arg parser and one flag does not earn a dependency.
+function parseArgs(argv) {
+  const out = { token: null, apiBase: null };
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = String(argv[i]);
+    if (a === '--api-base') { out.apiBase = argv[i + 1] === undefined ? '' : String(argv[i + 1]); i += 1; continue; }
+    if (a.startsWith('--api-base=')) { out.apiBase = a.slice('--api-base='.length); continue; }
+    if (out.token === null && !a.startsWith('-')) out.token = a;
+  }
+  return out;
+}
+
+// WHICH INSTANCE IS THIS TOKEN FOR? (task 1003722)
+//
+// The old order was env → the EXISTING session's api_base → branding default, on the
+// reasoning that a re-auth already knows which instance the builder is on. That holds
+// right up until the builder uses a SECOND instance: the stale api_base then wins over
+// the instance that actually minted the token, so the paste is verified against — and
+// written as — the wrong host. The reported symptom was a token from this instance
+// landing as a token for an unrelated one, after which every /builder-* command
+// authenticated somewhere unintended.
+//
+// A token is minted BY an instance, so the issuer is a property of the token, not of
+// the machine. The hall now stamps it into the paste command, and an explicit flag
+// outranks every inferred source: it is per-invocation, it came from the minting
+// instance, and it is the only source that is right by construction.
+//
+// Below the flag the old order is untouched, so an older instance whose paste command
+// carries no flag behaves exactly as before — and so does the founder-host regression
+// this file already guards (task 1002427: hardcoding a host here rejected a valid
+// token with a 401).
+function resolveBaseForPaste({ flag, resolve = () => ic.resolveApiBase() } = {}) {
+  const f = typeof flag === 'string' ? flag.trim() : '';
+  if (!f) return { base: resolve(), source: 'resolved' };
+  if (!/^https?:\/\/[^\s/]+/i.test(f)) return { base: null, source: 'invalid' };
+  return { base: f.replace(/\/+$/, ''), source: 'flag' };
+}
+
+const ARGS = parseArgs(process.argv.slice(2));
+const RESOLVED = resolveBaseForPaste({ flag: ARGS.apiBase });
+const API_BASE = RESOLVED.base;
 
 function usage(extra) {
   if (extra) console.error(extra);
   console.error('');
-  console.error('Usage: bongos paste-token <token>');
+  console.error('Usage: bongos paste-token <token> [--api-base <url>]');
   console.error('   (inside a core checkout: node scripts/gds/paste-token.js <token>)');
   console.error('');
-  console.error('Get a token on your Settings page: ' + API_BASE + '/builders/settings');
+  // Fall back to the inferred base for this hint when --api-base was the thing that
+  // was malformed — otherwise the error message that explains the bad flag would
+  // itself print "null/builders/settings".
+  const hintBase = API_BASE || ic.resolveApiBase();
+  console.error('Get a token on your Settings page: ' + hintBase + '/builders/settings');
   console.error('— under "CLI Access" click "Re-issue CLI token" (you must be signed in).');
   console.error('The page prints the exact paste-command — just run that line.');
 }
 
 async function main() {
-  const token = process.argv[2];
+  if (RESOLVED.source === 'invalid') {
+    usage(`--api-base must be an http(s) URL, got: ${ARGS.apiBase}`);
+    process.exit(2);
+  }
+  const token = ARGS.token;
   if (!token) {
     usage('No token argument provided.');
     process.exit(2);
@@ -138,7 +182,14 @@ async function main() {
   }
 }
 
-main().catch((err) => {
-  console.error('paste-token failed:', err && err.message ? err.message : err);
-  process.exit(1);
-});
+// Run only as a script. Exporting the two pure helpers lets the decision that caused
+// task 1003722 — WHICH instance a pasted token belongs to — be tested directly, rather
+// than inferred from a text scan of this file.
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('paste-token failed:', err && err.message ? err.message : err);
+    process.exit(1);
+  });
+}
+
+module.exports = { parseArgs, resolveBaseForPaste };

package/scripts/gds/provision-config.js

@@ -55,6 +55,9 @@ const CONFIG = {
   // <slug>.caddy file (idempotent overwrite, no fragile append to a shared file);
   // the main Caddyfile carries a one-time `import <dir>/*.caddy` (operator setup).
   caddySnippetDir: process.env.PROVISION_CADDY_SNIPPET_DIR || '/etc/caddy/sites',
+  // The base Caddyfile the running Caddy loads — read (never written) to prove it imports
+  // the snippets and carries the on-demand TLS ask (task 1002860, ADR 0303).
+  caddyfile: process.env.PROVISION_CADDYFILE || '/etc/caddy/Caddyfile',
   // Where nightly pg_dump backups land (db-backup-nightly.sh's GDS_BACKUP_DIR
   // default). Shared across co-tenant instances on one box — dumps are named
   // `<db>-<ts>.sql.gz`, so each instance's files + retention prune stay scoped to

package/scripts/gds/provision-net.js

@@ -240,6 +240,36 @@ function caddyBlock(inst) {
 function caddySnippetPath(inst, { snippetDir = CONFIG.caddySnippetDir } = {}) {
   return path.posix.join(snippetDir, `${inst.slug}.caddy`);
 }
+// Does the base Caddyfile carry what a provisioned domain needs (task 1002860, ADR 0303)?
+// Read from Caddy's RESOLVED config, not the file's text, so the answer holds whatever form
+// the operator wrote it in: an `ask` (2.7) or a `permission` module (2.8+), an absolute or
+// relative import, directives split across imported files. `requireHost` asks whether the
+// domain is served, which only a written snippet can make true. Returns the operator
+// instruction, or null when wired.
+function caddyWiringGap(adaptedJson, { domain, requireHost = false, caddyfile = CONFIG.caddyfile, snippetDir = CONFIG.caddySnippetDir } = {}) {
+  let apps;
+  try { apps = JSON.parse(adaptedJson).apps || {}; } catch (_) {
+    return `could not read Caddy's resolved config ('caddy adapt --config ${caddyfile}' printed no JSON)`;
+  }
+  const onDemand = apps.tls && apps.tls.automation && apps.tls.automation.on_demand;
+  if (!JSON.stringify(onDemand || {}).includes('/provisioning/tls-check')) {
+    return `${caddyfile} has no on_demand_tls ask for the provisioning tls-check, so no provisioned domain can get a certificate — add 'on_demand_tls { ask <platform origin>/api/bongos/provisioning/tls-check }' to its global options block and reload Caddy`;
+  }
+  if (requireHost && !JSON.stringify(apps.http || {}).includes(JSON.stringify(domain))) {
+    return `${caddyfile} does not import ${snippetDir}/*.caddy, so Caddy will never serve ${domain} — add 'import ${snippetDir}/*.caddy' at the top level of ${caddyfile} and reload Caddy`;
+  }
+  return null;
+}
+// `caddy adapt` reads config files only: no privilege, no certificate keys, no running server.
+function checkCaddyWiring(exec, opts = {}) {
+  const caddyfile = opts.caddyfile || CONFIG.caddyfile;
+  let res;
+  try { res = exec(`caddy adapt --config ${caddyfile} --adapter caddyfile`); } catch (e) {
+    const why = String((e && (e.stderr || e.message)) || e).trim().slice(0, 200);
+    return `'caddy adapt --config ${caddyfile}' failed (${why}) — the base Caddyfile must load before a site is added to it`;
+  }
+  return caddyWiringGap(res && res.stdout, { ...opts, caddyfile });
+}
 function healthzCmd(inst) {
   return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/healthz`;
 }
@@ -281,6 +311,8 @@ module.exports = {
   DNS_BLACKHOLE_IP,
   caddyBlock,
   caddySnippetPath,
+  caddyWiringGap,
+  checkCaddyWiring,
   checkDnsTokenScope,
   classifyZoneScope,
   dnsReleaseEnv,

package/scripts/gds/provision.js

@@ -52,7 +52,7 @@ const crypto = require('node:crypto');
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
-const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
+const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
 const { installedCoreVersion, runnerBanner } = require('./runner-drift.js');
 const { teardownInstance } = require('./provision-teardown.js');
@@ -263,6 +263,13 @@ async function provisionInstance(inst, deps) {
       log(`  [preflight] would verify the Cloudflare token can reach zone ${zoneForDomain(inst.domain)} before the address step`);
     }
   }
+  // Caddy preflight (task 1002860, ADR 0303): a box whose base Caddyfile has no tls-check ask
+  // can never certify this domain, so refuse before touching it. Injectable like the DNS check.
+  const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;
+  if (inst.domain && inst.hosting_shape !== 'dedicated' && apply) {
+    const gap = caddyCheck(boxExec, { domain: inst.domain });
+    if (gap) return { ok: false, error: `Caddy preflight failed: ${gap}` };
+  }
   const room = await capacityPreflight(inst, deps);   // box capacity (ADR 0285, task 1003927): an honest refusal BEFORE the status flip — never a silent oversubscribe
   if (room.ok === false) return room;
   if (apply) await provisioning.setInstanceStatus(db, inst.id, 'provisioning');
@@ -502,11 +509,14 @@ async function provisionInstance(inst, deps) {
   // Write the instance's OWN <slug>.caddy snippet (idempotent overwrite via the
   // injected writeFile — no read-modify-append to a shared Caddyfile), then reload.
   // The main Caddyfile carries a one-time `import <snippetDir>/*.caddy` (operator
-  // setup). The on-demand-ACME TLS hardening of this block is task P4 (#1945).
+  // setup) — verified after the write, since only a written snippet proves the import
+  // reaches it. The reload is loud: Caddy keeps its old config when it rejects the new one.
   log('  [caddy] write site snippet + reload');
   if (local) {
     boxWriteFile(caddySnippetPath(inst), caddyBlock(inst), { mode: 0o644, sudo: true });
-    boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
+    const gap = inst.domain && apply ? caddyCheck(boxExec, { domain: inst.domain, requireHost: true }) : null;
+    if (gap) return { ok: false, error: `Caddy wiring failed: ${gap}` };
+    boxExec(`${sudoP}systemctl reload caddy`);
   } else { log('    (Caddy on the droplet via cloud-init)'); }
 
   // ── step 7: healthz ───────────────────────────────────────────────────────
@@ -740,6 +750,11 @@ async function domainAttachInstance(inst, deps) {
     }
     log(`  [preflight] DNS token can reach zone ${scope.zone} ✓`);
   }
+  const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;   // Caddy preflight (task 1002860, ADR 0303)
+  if (apply) {
+    const gap = caddyCheck(boxExec, { domain: inst.domain });
+    if (gap) return { ok: false, error: `Caddy preflight failed: ${gap}` };
+  }
 
   // The A-record target — the same derivation as provisionInstance step 1.
   const recordIp = standalone
@@ -791,7 +806,9 @@ async function domainAttachInstance(inst, deps) {
   // (and tls-check stops vouching for it) with no separate un-wire step.
   log('  [caddy] write site snippet + reload');
   boxWriteFile(caddySnippetPath(inst), caddyBlock(inst), { mode: 0o644, sudo: true });
-  boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
+  const gap = apply ? caddyCheck(boxExec, { domain: inst.domain, requireHost: true }) : null;
+  if (gap) return { ok: false, error: `Caddy wiring failed: ${gap}` };
+  boxExec(`${sudoP}systemctl reload caddy`);
 
   // Release what the re-point moved off, AFTER the new address is wired: the DNS
   // record is the only half of an abandoned address the platform still holds, and

package/scripts/gds/ship-land.js

@@ -209,6 +209,8 @@ async function ciLandServer(taskId, branch, valueSummary) {
       return landBailed(`server publish failed — ${e}`, strandCommand(taskId, 'server'));
     }
     console.log(`  ci-land: server pushed ${branch} + PR ${r.data.pr_url} (auto-merge ${r.data.auto_merge ? 'enabled' : 'NOT enabled — merge it on GitHub'}).`);
+    const assigneeLine = prAssigneeLine(r.data.pr_assignee);
+    if (assigneeLine) console.log(assigneeLine);
     return pollServerPublish(taskId, branch);
   } finally {
     try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch (_) { /* best-effort */ }
@@ -332,6 +334,15 @@ function reconcileBlockedLines(taskId, reason) {
   ];
 }
 
+// task 1003991 — the server opens the PR with ITS credential, so "created by me" on
+// GitHub is empty for the builder; it assigns the PR to them instead, and this says
+// where that makes it findable. Null when the server assigned nobody. Pure + exported.
+function prAssigneeLine(login) {
+  return /^[A-Za-z\d_-]{1,39}$/.test(String(login || ''))
+    ? `  ci-land: the PR is assigned to @${login} — on GitHub it is under Pull requests → Assigned to you (the server opened it, so "Created by you" stays empty).`
+    : null;
+}
+
 // task 1003988 — what to tell a builder while their PR sits RED. The poll used to
 // wait out its nine minutes in silence, so a credential-less box learned only that
 // the land was "pending" and pushed the same commit again (PR 922: nine red runs).
@@ -724,6 +735,7 @@ module.exports = {
   landed,
   pickStaleGateReviewRun,
   reconcileBlockedLines,
+  prAssigneeLine,
   redPrLine,
   redPrLines,
   reconciledCardStatus,

package/scripts/status-mirror-sync.js

@@ -48,7 +48,7 @@ const { execFileSync } = require('node:child_process');
 
 const REPO_ROOT = path.resolve(__dirname, '..');
 const SRC = path.join(REPO_ROOT, 'modules', 'status-ui', 'public');
-const { branding, clientBranding } = require('../src/branding');
+const { branding, clientBranding, applyBrandConditionals } = require('../src/branding');
 
 // Stamp instance-identity tokens into the mirror HTML. The off-box mirror is
 // served by a static Pages host, NOT the branding-injecting Node server — so this
@@ -63,15 +63,19 @@ function brandTokens(html, brand = {}, publicOrigin = '', buildersOrigin = '') {
   const tagline = (brand.copy && brand.copy.tagline) || '';
   const cur = (brand.currency && brand.currency.label) || 'credits';
   const Cur = cur ? cur.charAt(0).toUpperCase() + cur.slice(1) : cur;
+  const company = (brand.identity && brand.identity.company) || {};
   const esc = (s) => String(s == null ? '' : s)
     .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
     .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
-  return html
+  return applyBrandConditionals(html, { companyName: company.name, companySite: company.site, companyTagline: company.tagline })
     .split('{{worldName}}').join(esc(world))
     .split('{{productName}}').join(esc(product))
     .split('{{Currency}}').join(esc(Cur))
     .split('{{currency}}').join(esc(cur))
     .split('{{tagline}}').join(esc(tagline))
+    .split('{{companyName}}').join(esc(company.name))
+    .split('{{companySite}}').join(esc(company.site))
+    .split('{{companyTagline}}').join(esc(company.tagline))
     .split('{{publicOrigin}}').join(esc(publicOrigin || ''))
     .split('{{buildersOrigin}}').join(esc(buildersOrigin || publicOrigin || ''));
 }

package/src/bongos/routes/auth.js

@@ -1066,20 +1066,41 @@ module.exports = function buildAuthRouter() {
         // The builder kills it from this same Settings page, under Active sessions.
         expiresAt: null,
       });
+      // NAME THE INSTANCE THAT MINTED THIS (task 1003722). A bearer is only
+      // meaningful against the instance that issued it, and the CLI cannot work
+      // that out on its own: paste-token resolves its base as env → the EXISTING
+      // session's api_base → branding default. So on any machine that has talked
+      // to another instance, the STALE api_base wins and a perfectly good token is
+      // verified against — and then bound to — the wrong host. That is the reported
+      // bug: a token minted here landed as a token for a different instance.
+      //
+      // The issuer is the one fact that cannot be recovered at the other end, so it
+      // travels with the token. Same discipline as configuredOAuthOrigin() above:
+      // this instance may state its OWN identity and must assume nothing about the
+      // recipient's machine.
+      const issuer = String(resolveEnv('PUBLIC_ORIGIN') || configuredOAuthOrigin() || '')
+        .trim().replace(/\/+$/, '');
       res.json({
         ok: true,
         token,
         expires_at: row.expires_at,
         builder_login: req.builder.github_login,
+        api_base: issuer || null,
         // A VERB, never a path (task 1003961). This string is composed HERE and run
         // THERE — on an instance, where the core is an installed dependency and
         // `scripts/gds/` does not exist, so the previous
         // `node scripts/gds/paste-token.js <token>` named a file the builder did not
         // have and the copy button handed out a command that could not run. `bongos`
         // is on PATH in any installed instance, so the verb form is layout- and
-        // directory-independent. Same discipline as configuredOAuthOrigin() above:
-        // nothing about the RECIPIENT's filesystem may be assumed here.
-        paste_command: `bongos paste-token ${token}`,
+        // directory-independent.
+        //
+        // The --api-base flag carries the issuer above. Omitted when this instance
+        // cannot state its own origin, because a flag with an empty value would be
+        // worse than none: paste-token would take '' as an explicit instruction and
+        // stop falling back to the resolution that works today.
+        paste_command: issuer
+          ? `bongos paste-token ${token} --api-base ${issuer}`
+          : `bongos paste-token ${token}`,
       });
     } catch (err) {
       log.error('[gds] POST /auth/cli-token/issue', err);

package/src/bongos/serve-internal.js

@@ -46,7 +46,7 @@ const { buildStampedHtml } = require('../asset-version');
 const { buildInfo } = require('../build-info');
 const { buildDevboxDownloads } = require('../devbox-downloads');
 const { buildBongosDownloads } = require('../bongos-downloads');
-const { clientBranding, branding } = require('../branding');
+const { clientBranding, branding, applyBrandConditionals } = require('../branding');
 const { prelaunchGate } = require('./prelaunch-gate');
 const { platformVisibilityGate } = require('./platform-visibility-gate');
 const { clientModules, isModuleEnabled } = require('../modules');
@@ -205,6 +205,8 @@ function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModul
 // served page can carry a correct cross-host href or canonical/og: URL: a client
 // fill cannot reach them, and a baked one would make every instance advertise
 // whichever instance happened to author the file (task 1002748, direction C5/C6).
+// {{companyName}} {{companySite}} {{companyTagline}} are optional, so a page wraps
+// each clause in a brand-if region that drops whole when its field is empty (task 1002853).
 // Pure + exported for the test; both origins are injectable so it drives with zero I/O.
 function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOrigin(), hallOrigin = safeBuildersOrigin(), sourceRepo = safeSourceRepoUrl(), instanceBase = safeInstanceBase(), hubOrigin = safeHubOrigin()) {
   const world = (brand.identity && brand.identity.worldName) || '';
@@ -213,12 +215,17 @@ function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOri
   const cur = (brand.currency && brand.currency.label) || 'credits';
   const Cur = cur ? cur.charAt(0).toUpperCase() + cur.slice(1) : cur;
   const hall = hallOrigin || origin || '';
-  return dropEmptyHrefLinks(String(html == null ? '' : html), { publicOrigin: origin || '', buildersOrigin: hall, sourceRepoUrl: sourceRepo || '' })
+  const company = (brand.identity && brand.identity.company) || {};
+  const conditioned = applyBrandConditionals(html == null ? '' : html, { companyName: company.name, companySite: company.site, companyTagline: company.tagline });
+  return dropEmptyHrefLinks(conditioned, { publicOrigin: origin || '', buildersOrigin: hall, sourceRepoUrl: sourceRepo || '' })
     .split('{{worldName}}').join(esc(world))
     .split('{{productName}}').join(esc(product))
     .split('{{Currency}}').join(esc(Cur))
     .split('{{currency}}').join(esc(cur))
     .split('{{tagline}}').join(esc(tagline))
+    .split('{{companyName}}').join(esc(company.name))
+    .split('{{companySite}}').join(esc(company.site))
+    .split('{{companyTagline}}').join(esc(company.tagline))
     .split('{{publicOrigin}}').join(esc(origin || ''))
     // a pack that names no hall of its own resolves to its OWN apex — never to
     // whichever instance authored the file