@bongos/core 1.19.839 → 1.19.840

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.839",
-  "core_contract": "1.19.839",
-  "source_commit": "2799589e44782acf35629e14f332ac30686ed028",
+  "core_version": "1.19.840",
+  "core_contract": "1.19.840",
+  "source_commit": "47fbba53d86033101f57cf1e1a85aef7367fe320",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T17:25:32.211Z",
+  "built_at": "2026-09-17T17:45:41.665Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 494,
+    "docs_redacted": 495,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2258,
+    "functional_verbatim": 2262,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2778,
-  "tree_sha256": "209c682e3b1a302720d23b8e207501aba43d917dc24ebe0fe4d11836c49a6af8",
+  "file_count": 2783,
+  "tree_sha256": "5ddd99652c37c0ad56f34d618732a671733aed9b055c1c4ee161135581d0c80a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "7f48743a6878f01e484b8f2884b4b12588b956db307fd6bc83a67a19df61a52b"
+      "sha256": "031abfbccd58bf9d6cdf9368f0d3bc862ddcd2f373b585a6911196b28596fae2"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1999,10 +1999,15 @@
       "mode": "0000644",
       "sha256": "08ea781a488d7454ca49b17e9540bb4c7bb9f1925aedf8ad4634057a89dd0d22"
     },
+    {
+      "path": "docs/adr/0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md",
+      "mode": "0000644",
+      "sha256": "62ffb9c1aeeaaafd5c51767f1ffff1c67adb3563e8d55ceb81ef77511184faa4"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "5c20d4bf4c0202a391a617d99daaa97d8a566d9d5c8534b5bd060faa8f8afe02"
+      "sha256": "48323e44fced698a0da997eeb16564ab3b04430c8233a8f7997c0fec2b123401"
     },
     {
       "path": "docs/api-reference.md",
@@ -2012,12 +2017,12 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "11ffe0dfc04855064064f335396b1b57887a1d4e61b21559c376d279ea7513fd"
+      "sha256": "a0107dc012a5355baacf3668c92b17675b35ce0cffc96052b1d92d99533c5744"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "02a8f7f07465f7059bc888a367793812c78d689f2335d333529712833c452116"
+      "sha256": "029e8c5a9562171251df353e08791f1520c2e17fa7d286c7b4d278dea195c6d7"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2567,7 +2572,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "689361320ab6192aade8cb602c862af1f14454238575da829015077f55743628"
+      "sha256": "f8fa8c024b4d6741ea672a7be33957d6cc58c6b85867ef2b5499bcc31fdf4b50"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5682,7 +5687,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "f9c22388c70ba8476a6dba8cd072d92abc44da79c296a4685abab81e24edf6ed"
+      "sha256": "84114ecaf06c6ac52b7d7e4b5eaff97086908d6f7df0a3e07e4be3aa923935bc"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -5804,6 +5809,11 @@
       "mode": "0000644",
       "sha256": "81ed257d2156988e911d737e10cba2b8375f47fc6e27bf77c06d9dc18258380b"
     },
+    {
+      "path": "modules/lifecycle/pr-assign.js",
+      "mode": "0000644",
+      "sha256": "08ace9d2690ef7f563455bdd52f89e8f60587eb399a246726cdb6ae06e98699f"
+    },
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
@@ -5912,7 +5922,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "22a55af5d5c8453a5c27351a74b03bd635638ea177f599763513752f88f7a224"
+      "sha256": "760c76c6ce7ba52991991e7c5fd00a48466d4ad8ae8e61620d962cd4496ea06c"
     },
     {
       "path": "modules/lifecycle/routes/version-route-authz.js",
@@ -7867,12 +7877,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "fe22ff711989f39c34fa95045c0736e26abc2400d698548f353121fbd1ff8828"
+      "sha256": "d54803c0123c3ee0b857092be850581f787ed85dc36cae70e737977f14f0356b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f15fdfca04599ce879e85f8229aeba9019d17476e6020ebdec4ea03a98d4bd76"
+      "sha256": "0a21605b0152921f84f2e67716df7e251b09a23b24c3b9569d3332d8d98e754c"
     },
     {
       "path": "public-docs/index.html",
@@ -8727,7 +8737,7 @@
     {
       "path": "scripts/gds/paste-token.js",
       "mode": "0000644",
-      "sha256": "b61317006e5df92afb5744bd9fb9b3180bf8a674b7f691773114280660a42a2a"
+      "sha256": "cfc9e6a9640f8392a38077a7fa50bd1caae671a60c4735d2758c0cc5a6d10610"
     },
     {
       "path": "scripts/gds/plain-cards.js",
@@ -8767,7 +8777,7 @@
     {
       "path": "scripts/gds/provision-config.js",
       "mode": "0000644",
-      "sha256": "1f60ee3d585ad3ab8c84c6b0abac99573ed218183b8e8403f2ddf3e951ff6b3d"
+      "sha256": "b5ec038d150da93b4c54eeb864586a70e46610655ccb5bf10bd1adaa0432a305"
     },
     {
       "path": "scripts/gds/provision-core-upgrade.js",
@@ -8782,7 +8792,7 @@
     {
       "path": "scripts/gds/provision-net.js",
       "mode": "0000644",
-      "sha256": "cab7a609869465fcac7234c69e4202f259293e69842163f8ff7b6edfd5d30b4a"
+      "sha256": "f1ca176ff8cdb8de65940af1e30316db600cb5df529abbc997697abf1cbc2c2d"
     },
     {
       "path": "scripts/gds/provision-repo-auth.js",
@@ -8807,7 +8817,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "94a77427cb16c8a959eb279866f3777830d7a33617f02aed5eedb383ca26e84a"
+      "sha256": "43dd54ec69ff29ad83e631d53a65c1a2d22b89ef07181e4df14581e5199bfa61"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9182,7 +9192,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "fafa751359543787133e26a7aa18307fec163b0955eea38677a1b319d4dc6162"
+      "sha256": "805017578a7d69ca2c79d105e21add7862b41e352256e5fbdfad3e3740e69ced"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -9692,7 +9702,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "66abf424a565cdcc4de85350774d91e93be826a3b01a23ad75fee1feb7977a3c"
+      "sha256": "c29f47f08ea45126a8ddd6fd432bdf5c17a98cac0ad6f6ae527bf23e62ffa001"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -9802,7 +9812,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "027988bab5433e279e5b5cd479a768f655dd68bc1e7e19d31279d140be462d2a"
+      "sha256": "8bfa67a85b56ce33dbb502537edced8bf39de30551c7949bf3aa9460a1deffa3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10277,7 +10287,7 @@
     {
       "path": "tests/bongos_cli.mjs",
       "mode": "0000644",
-      "sha256": "ef01af16d62c55325a3b12cc7968a9d797994d2f46364149668bf4e2839cb0e0"
+      "sha256": "4e845333aa949256b8b5c6dc73bf75fcc77047543b0f5e15e89172cad4161772"
     },
     {
       "path": "tests/bongos_dispatch.mjs",
@@ -10562,7 +10572,7 @@
     {
       "path": "tests/cli_token_reissue.mjs",
       "mode": "0000644",
-      "sha256": "a82544c109464d884e44731cbdd73e9e141d31d8e18a9241222d6a26223e19c2"
+      "sha256": "da6b45619e6848c37ebc8d53ffc9d8f9d5379df26563c9030b339a8c389e645d"
     },
     {
       "path": "tests/client_baseurl_guard.mjs",
@@ -12374,6 +12384,11 @@
       "mode": "0000644",
       "sha256": "fd69c44ebf3d246ecedf527275448389cca809e231d1c6cb34e4c12bfdc38111"
     },
+    {
+      "path": "tests/paste_token_api_base.mjs",
+      "mode": "0000644",
+      "sha256": "e48806b48a9f7a4f9f9c010f45750e6b440d2de68feacdabacd9bd25d98f2046"
+    },
     {
       "path": "tests/patch_gate_ordering.mjs",
       "mode": "0000644",
@@ -12434,6 +12449,11 @@
       "mode": "0000644",
       "sha256": "08a7496090f4617cef7e270afddcef8ee3a0b58bff6920b56bc2f2bbb49ed4ca"
     },
+    {
+      "path": "tests/pr_assign.mjs",
+      "mode": "0000644",
+      "sha256": "1f422614784bff05cfddff5196fabfb9458e8b1247e6e6ecb636f1e4f236fc78"
+    },
     {
       "path": "tests/pre_compact.mjs",
       "mode": "0000644",
@@ -12627,7 +12647,12 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "09a759a1b1e0cac3ddafdd64adca4daed0f6a8ab4c48a07f42954f38ed510433"
+      "sha256": "5a1abd44776798ca89266f86663037086c1270aca569e54647607d4488cbfea9"
+    },
+    {
+      "path": "tests/provision_caddy_wiring.mjs",
+      "mode": "0000644",
+      "sha256": "a4d448622c05e963602cbc0488215ba168c909bd12cd0db20eaa6fcb7de7a91e"
     },
     {
       "path": "tests/provision_disconnect.mjs",

package/clients/bongos-client/index.d.ts

@@ -216,7 +216,7 @@ export interface PostAuthAppPairStartRequest { device_name?: string; platform?:
 export interface PostAuthAppPairStartResponse { pair_code: unknown; poll_token: unknown; verify_path: unknown; verify_url: unknown; expires_in: unknown; interval: unknown }
 export interface PostAuthBackchannelLogoutRequest { logout_token: string }
 export interface PostAuthBackchannelLogoutResponse { ok: boolean }
-export interface PostAuthCliTokenIssueResponse { ok: boolean; token: unknown; expires_at: unknown; builder_login: unknown; paste_command: unknown }
+export interface PostAuthCliTokenIssueResponse { ok: boolean; token: unknown; expires_at: unknown; builder_login: unknown; api_base: unknown; paste_command: unknown }
 export interface PostAuthDeviceExchangeRequest { assertion: string }
 export interface PostAuthDeviceExchangeResponse { token: unknown; builder: unknown }
 export interface PostAuthDevicePollRequest { device_code: string }

package/docs/adr/0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md

@@ -0,0 +1,49 @@
+# ADR 0303 — Provisioning verifies the base Caddyfile, and never edits it
+
+**Status:** accepted · **Date:** 2026-09-17 · **Task:** [task 1002860](https://cloudbongos.com/builders#/task/1002860) (goal 1000106 — project hosting & fleet; from idea 1000524)
+
+**Related:** [ADR 0111](0111-instance-hosting-provisioning-module.md) §4 (on-demand ACME behind the tls-check ask) · [ADR 0128](0128-provisioning-runner-privilege-and-db-auth-model.md) (the runner writes snippets under `sudo install`; it found the live Caddyfile missing the ask)
+
+## Context
+
+The provisioning runner writes one `<slug>.caddy` site snippet per instance and reloads Caddy. It
+depends on two lines in the box's base `/etc/caddy/Caddyfile` that it never checked:
+`on_demand_tls { ask …/provisioning/tls-check }` and `import /etc/caddy/sites/*.caddy`. Both were
+hand-applied on the live boxes. The reload ran with `allowFail: true`. So on a box missing
+either line, provisioning reported success and the instance was simply unreachable, with no
+signal to anyone. The base Caddyfile is not in this repository. It is host configuration, and
+it also serves the platform's own apex.
+
+## Decision
+
+1. **Detect and refuse, never edit.** The runner reads the base Caddyfile and does not write it.
+   A missing directive stops the run with the exact line to add and the file to add it to.
+   An automatic edit was rejected for two reasons. `on_demand_tls` has to sit inside the
+   global options block, which an append cannot place and a rewrite could corrupt. And a bad
+   write to that file takes down every site on the box, the control plane's own apex included.
+   The directives are a one-time setup per box, so the refusal only ever fires on a box that
+   was never configured.
+2. **Read Caddy's resolved config, not the file's text.** The check runs
+   `caddy adapt --config <Caddyfile> --adapter caddyfile`. That command reads config files only,
+   so it needs no privilege and never touches certificate keys, and the runner's scoped sudo is
+   not widened. It inspects the JSON. The ask must appear under `apps.tls.automation.on_demand`,
+   which covers both Caddy 2.7's `ask` string and 2.8+'s `permission` module. The domain must
+   appear under `apps.http`. Because this is the resolved config, it doesn't matter how the operator
+   wrote the directives: an absolute or relative import, a split across imported files, a
+   `/api/gds` alias. The base path is `PROVISION_CADDYFILE`, default `/etc/caddy/Caddyfile`.
+3. **Two checkpoints.** A preflight checks the ask before the box is touched, in both the
+   provision and domain-attach legs, beside the DNS-scope preflight. The import can only be
+   proven once a snippet exists, so a second check runs after the write and requires the domain
+   to be served. It fails the run before any reload. A snippet in a directory nothing imports
+   is inert, so leaving it on disk is safe.
+4. **The reload is loud.** `systemctl reload caddy` no longer passes `allowFail`. Caddy's
+   graceful reload validates and swaps atomically, and it keeps the old config when it rejects
+   the new one. A failed reload fails the run and never leaves Caddy half-configured. There is
+   no separate `caddy validate` step: it would load certificate keys, which needs root, and
+   `caddy adapt` plus the reload already cover what it would catch.
+
+## Consequences
+
+- A box that was never set up gets a named instruction instead of a silently unreachable project.
+- Domainless instances, dry runs and dedicated droplets (Caddy comes from cloud-init) skip the check.
+- `caddy` must be on the runner's `PATH` on the box that serves the snippet. Every supported shape already has it there, because it reloads that Caddy.

package/docs/adr/README.md

@@ -394,3 +394,4 @@ This keeps the decision history honest and traceable.
 | 0300 | [**A missing protected-surface registry is a broken install, not a module opt-out** ([task 1003662](https://cloudbongos.com/builders#/task/1003662), goal 1000091). Filed as a bug with a remedy attached: `require('./module-scope-map')` throws when `modules/government/protected-surfaces.json` is absent, so make it degrade to an empty protected set + a warning, matching `resolveOptional`. The throw reproduces, and the rest is wrong four times over. **The throw is not in the named file** — `module-scope-map.js` has no throw and no file read; it requires `permission-path-check.js`, whose `loadRegistry()` throws at module scope. **It is a written contract, not an oversight** — that file's header says FAIL-CLOSED in capitals and already pre-answers the layering worry (the read is `fs`, never `require`, so ADR 0083's one-way rule holds; static data, not code; `route-rank-check.js` reads `modules/*/routes/*.js` the same way). **Disabling the module cannot cause it** — enablement is a runtime flag, never a file deletion, and the read never consults it. **"Not yet materialized" cannot either** — no `files[]` allowlist, so `npm pack --dry-run` puts the 13,274-byte registry in the tarball; per ADR 0108 §1 you cannot have `@bongos/core` without it. The `resolveOptional` precedent does not transfer: that is the module **seam/port** resolver for a missing runtime *capability*, whereas this is the static data the boundary is made of, read where there is no server and no DB (a git hook, a CI job) — borrowing it converts "the boundary is unreadable" into "there is no boundary". **Decision: fail-closed stays, no behavior change, the remedy is rejected — and the one genuine defect is fixed: the message now names the cause and the fix** (reinstall the core; do not empty the set), because stating a refusal without a remedy is exactly how a reader concludes the module is optional and files this task. The asymmetry is the point: a false "nothing is protected" is silent, permanent and grants authority; a false "this install is broken" is loud and grants nothing. Revisit only if a core-only checkout without `modules/` becomes legitimate — and then the question is *where the registry lives*, not whether it is optional.](0300-a-missing-protected-surface-registry-is-a-broken-install.md) | governance / permissions |
 | 0301 | [**A red PR names its failing tests in a commit status, and says so when it cannot see** ([task 1003988](https://cloudbongos.com/builders#/task/1003988), goal 1000095). One pull request took nine red CI runs in four hours because the builder box could not learn which test failed: without Checks:read GitHub nulls every check-run node, the server dropped the holes silently, and the red PR was reported as a review-or-pending wait. Now the merge state carries checks_unreadable and a red, unreadable rollup reads failing_check_unreadable; the unit workflow posts the failing test names as a unit-report commit STATUS (readable without the permission) from a separate job that holds the only write token and checks out no PR code; the server returns it as failing_tests, reduced to test-list vocabulary because the PR controls the workflow that wrote it.](0301-a-red-pr-names-its-failing-tests-in-a-commit-status.md) | GDS / shipping pipeline |
 | 0302 | [**The third identical failure stops the session and asks** ([task 1003990](https://cloudbongos.com/builders#/task/1003990), goal 1000095). Sessions looped without noticing: one PR re-shipped into the same red check nine times, and 45 of 169 claim attempts were the same refusal retried minutes apart. A PostToolUse hook now counts walls per session — the signature is the `[otb-plain]` card's "What happened" line + the task id + the RED line, so a red check naming different failing tests each run reads as progress — and on the third identical one injects a single instruction: stop retrying, diagnose (path named), or /ask-for-help. Waiting cards ("Nothing to do…") are never counted; git-guard and worktree-guard count their own blocks through the same helper; it never blocks a tool call and echoes nothing a tool printed. Rejected: counting any repeated failing command (red→green is that), blocking the fourth attempt (a new gate, ADR 0162), server-side detection (cannot see guard blocks or speak into the session).](0302-the-third-identical-failure-stops-the-session-and-asks.md) | GDS / sessions / hooks |
+| 0303 | [**Provisioning verifies the base Caddyfile, and never edits it** ([task 1002860](https://cloudbongos.com/builders#/task/1002860), goal 1000106, from idea 1000524). The runner assumed the box's `/etc/caddy/Caddyfile` carried the `on_demand_tls` tls-check ask and `import /etc/caddy/sites/*.caddy`, and reloaded with `allowFail` — a box missing either provisioned "successfully" and the instance was unreachable. It now reads Caddy's RESOLVED config (`caddy adapt`: unprivileged, no key access, indifferent to how the directives are written) before touching the box (the ask) and after writing the snippet (the domain is served ⇒ the import reaches it), refusing with the exact line to add, and the reload is loud. Rejected: editing the base file (`on_demand_tls` must sit inside the global block an append cannot place, and a bad write takes down the control plane's own apex); `caddy validate` (loads certificate keys, needs root).](0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md) | provisioning / infra |

package/docs/api/openapi.json

@@ -20991,6 +20991,7 @@
           "token": {},
           "expires_at": {},
           "builder_login": {},
+          "api_base": {},
           "paste_command": {}
         },
         "required": [
@@ -20998,6 +20999,7 @@
           "token",
           "expires_at",
           "builder_login",
+          "api_base",
           "paste_command"
         ]
       },

package/docs/architecture.md

@@ -14,7 +14,7 @@
 - **Cloud Bongos control-plane droplet (NEW 2026-07-05, [ADR 0126](adr/0126-dedicated-cloudbongos-control-plane-droplet.md), task [#2063](https://example.com/builders#/task/2063)):** DigitalOcean, hostname `cloudbongos`, IPv4 `REDACTED_IP`, NYC3, `s-1vcpu-2gb` (2 GB / 1 vCPU), Ubuntu 24.04, ~$12/mo, tag `cloudbongos-control`. Runs **cloudbongos.com + `builders.` + `status.`** (`src/platform-server.js`, Cloud Bongos brand, port 3002, own `cloudbongos` DB, checkout `/home/lars/cloudbongos-instance`, the root subscribed to the nightly core-patch sweep) and is the **sole token-holding control plane** — a SECOND root, `/home/lars/cloudbongos`, survives only to vendor `infra/` (the box cloud-init the core package does not ship, ADR 0150); it is not subscribed, so nothing may resolve core code from it (task 1002738, [ADR 0144](adr/0144-devbox-rehome-onto-cloudbongos-plane.md) follow-up 5) — `/etc/cloudbongos/box.env` holds the account-wide Cloudflare token (IP-locked to this box) + the DigitalOcean token; this is where `provision.js` provisions instance subdomains. **Structurally separate SSH** (own `cloudbongos_ed25519` key). IPv6 egress disabled so the IPv4-locked CF token can't be spuriously rejected. cloudbongos.com was previously a co-tenant on the co-hosting box; that unit was decommissioned at cutover. **Follow-ups:** deploy automation (task [#2064](https://example.com/builders#/task/2064)) + fully stripping cloud tokens off the co-hosting box (task [#2065](https://example.com/builders#/task/2065)).
 - **Server stack:** Node.js 22 LTS · PostgreSQL 16 · Caddy 2.11.2. `example.service` (systemd) runs `node server.js` as user `lars` on `127.0.0.1:3000`; restart-on-failure.
 - **Hardening:** `lars` user with passwordless sudo; SSH key-only (root login disabled, password auth disabled); ufw allows 22/80/443; fail2ban active; unattended-upgrades enabled; timezone `America/New_York`.
-- **TLS:** Origin cert at `/etc/caddy/origin.crt` + `/etc/caddy/origin.key` for the example apexes on the co-hosting box. **cloudbongos.com's apexes moved to the dedicated control-plane droplet** ([ADR 0126](adr/0126-dedicated-cloudbongos-control-plane-droplet.md)) with their own copy of the Cloudflare Origin Cert (SAN `*.cloudbongos.com, cloudbongos.com`) at `/etc/caddy/cloudbongos-origin.{crt,key}` on `REDACTED_IP`. Cloudflare SSL/TLS mode = Full (strict). Renewal is a non-issue for ~15 years. **Provisioned instance hosts use a different, coexisting posture** ([ADR 0111](adr/0111-instance-hosting-provisioning-module.md) §4 / task P4): Caddy **on-demand ACME** (Let's Encrypt) via the global `on_demand_tls { ask … }` block, gated to hostnames the `provisioning` module actually stood up (`/api/bongos/provisioning/tls-check`). Their DNS records are **proxied=false (grey cloud)** so the ACME challenge reaches Caddy — the opposite of the origin-cert apexes; do not enable the proxy on them or renewal breaks silently ([ADR 0003](adr/0003-cloudflare-origin-cert-over-letsencrypt.md)). Per-instance site snippets live in `/etc/caddy/sites/*.caddy` (`import`ed by `infra/Caddyfile`). **Tradeoff (accepted, SEC review of task 1945):** `proxied=false` publishes the box's real origin IP in public DNS for every co-tenant provisioned hostname — defeating, for those names, the Cloudflare-proxy IP-hiding the apexes enjoy (a co-tenant host resolves to the same `REDACTED_IP` that serves the main game). This is inherent to on-demand ACME (the challenge must hit the origin) and acceptable under the budget/trust model; prefer a **dedicated droplet** (its own IP) for any instance expected to draw hostile attention.
+- **TLS:** Origin cert at `/etc/caddy/origin.crt` + `/etc/caddy/origin.key` for the example apexes on the co-hosting box. **cloudbongos.com's apexes moved to the dedicated control-plane droplet** ([ADR 0126](adr/0126-dedicated-cloudbongos-control-plane-droplet.md)) with their own copy of the Cloudflare Origin Cert (SAN `*.cloudbongos.com, cloudbongos.com`) at `/etc/caddy/cloudbongos-origin.{crt,key}` on `REDACTED_IP`. Cloudflare SSL/TLS mode = Full (strict). Renewal is a non-issue for ~15 years. **Provisioned instance hosts use a different, coexisting posture** ([ADR 0111](adr/0111-instance-hosting-provisioning-module.md) §4 / task P4): Caddy **on-demand ACME** (Let's Encrypt) via the global `on_demand_tls { ask … }` block, gated to hostnames the `provisioning` module actually stood up (`/api/bongos/provisioning/tls-check`). Their DNS records are **proxied=false (grey cloud)** so the ACME challenge reaches Caddy — the opposite of the origin-cert apexes; do not enable the proxy on them or renewal breaks silently ([ADR 0003](adr/0003-cloudflare-origin-cert-over-letsencrypt.md)). Per-instance site snippets live in `/etc/caddy/sites/*.caddy` (`import`ed by `infra/Caddyfile`); the provisioning runner verifies the box's resolved Caddy config carries that import and the `on_demand_tls` ask before it reports a domain wired, and refuses with the line to add rather than editing the base file ([ADR 0303](adr/0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md)). **Tradeoff (accepted, SEC review of task 1945):** `proxied=false` publishes the box's real origin IP in public DNS for every co-tenant provisioned hostname — defeating, for those names, the Cloudflare-proxy IP-hiding the apexes enjoy (a co-tenant host resolves to the same `REDACTED_IP` that serves the main game). This is inherent to on-demand ACME (the challenge must hit the origin) and acceptable under the budget/trust model; prefer a **dedicated droplet** (its own IP) for any instance expected to draw hostile attention.
 - **Platform observability — REMOVED 2026-09-15 ([ADR 0284](adr/0284-the-control-plane-carries-no-metrics-stack.md), task 1003876):** the control plane runs **no Grafana and no Prometheus**, and `metrics.cloudbongos.com` has no Caddy site. They cost ~300 MB RSS + 2.5 GB of data on the box every provisioned project shares, and scraped none of those projects. Every instance still exports `/metrics` ([`src/bongos/metrics.js`](../src/bongos/metrics.js), loopback or `METRICS_TOKEN`), so a scraper can return from a box that is *not* the control plane. The rest of this bullet is the **historical** ADR 0127 layout, kept so its leftovers (co-hosting-box forwarders, instance `infra/` copies) can be found: this watched the **Bongos API** (`gds_http`/`tasks`/`claims`/`builders`/`auth`), not any one game, so it lived **on the control-plane box** (REDACTED_IP) at **`https://metrics.cloudbongos.com`** and observed the **whole fleet**. **Prometheus** (`127.0.0.1:9090`, loopback-only) scrapes every instance's `/metrics` ([`src/bongos/metrics.js`](../src/bongos/metrics.js)), each tagged with a `project` label ([`infra/prometheus/prometheus.yml`](../infra/prometheus/prometheus.yml)): **cloudbongos** locally (`:3002`); **example + emersonian-circles** on the co-hosting box, reached over the **private VPC** via `socat` forwarders on `10.108.0.2:9101/9102` (→ their loopback `:3000`/`:3004`), ufw-locked to the control-plane box's private IP — raw TCP relays, so the exporter still sees a loopback request and needs no token; nothing is public. **Grafana** (`127.0.0.1:3003`, loopback-only) renders the 4 provisioned-as-code dashboards (folder **Cloud Bongos**: system-overview, error-watch, builder-activity, auth-security), each with a **`project`** template variable for per-instance / fleet views. Reverse-proxied on the `*.cloudbongos.com` origin cert — Archon-only, gated by Caddy `basic_auth` (user `archon`) **and** Grafana's own admin login (both secrets owner-held, never in the repo). Grafana config is a systemd `GF_*` env drop-in (`grafana-server.service.d/override.conf`, `chmod 600`). ~256 MB RAM. A future dedicated-droplet instance is added as a `METRICS_TOKEN` Bearer target instead of a VPC forwarder.
 
 **Application stack:**
@@ -226,7 +226,7 @@ Bongos views: `claimable_tasks` (rebuilt in 006 to use SELECT t.*; rebuilt again
 - Own-scoped session self-service ([ADR 0206](adr/0206-own-scoped-session-revocation-no-absolute-ceiling.md), task 1003341), in [`src/bongos/routes/my-sessions.js`](../src/bongos/routes/my-sessions.js): `GET /me/sessions` (every live session on the caller's own account — source, user agent, created/last-used/expires, a `current` flag; the token value is never selected), `POST /me/sessions/revoke` (`{session_id}` — one of your own; a miss answers `revoked: 0` so a stranger's id cannot be probed) and `POST /me/sessions/revoke-all` (sign out everywhere, the requesting session included). All three gate on `requireBuilder` alone and key every statement on `req.builder.id` — an account is never named in the query, body or path. They exist because a bearer refreshes to `now()+24h` on every call, so a leaked one never expires, and the cross-builder pair (`POST /auth/revoke`, `/auth/revoke-all`, both still gated on the admin `auth.session.revoke` atom) needed an Archon the victim might not have. Surfaced in the hall at Settings → Active sessions.
 - Authenticated CLI/web: `GET /me` (returns `rank`), `GET /versions[/progress]`, `GET /tasks[?version=&status=&kind=&discipline=]`, `GET /tasks/claimable[?version=&discipline=]`, `GET /tasks/:id`, `POST /tasks` (accepts `discipline` + `criterion_ids`; **metic+** — [ADR 0090](adr/0090-metic-task-authoring.md)), `PATCH /tasks/:id` (supports `parent_task_id`, `kind`, `discipline`, `goal_id` — (re)assign the task's goal; must be a goal in the task's own version, task 1763; **metic+**), `POST /tasks/:id/promote` (**metic+**), `POST /claims`, `POST /claims/:id/resolve`, `POST /cost`.
 - Criterion rollup + task↔criterion links ([ADR 0025](adr/0025-structured-criterion-task-link.md), [#435](https://example.com/builders#/task/435)/[#438](https://example.com/builders#/task/438)): `GET /versions/:id/progress` rolls up each done-when criterion → its gating tasks (via `task_criteria`) → live status counts + the not-yet-shipped `remaining[]` + `unattributed_tasks` (the read behind the `/status` skill, in `src/bongos/done-when.js criterionProgress`). The link CRUD mirrors the dependency endpoints: `GET /tasks/:id/criteria`, `POST /tasks/:id/criteria` (**metic+** — [ADR 0090](adr/0090-metic-task-authoring.md)) and `DELETE /tasks/:id/criteria/:criterionId` (**metic+**). A criterion ref is a numeric `done_when_criteria.id`, a positional `"Cn"` token, or a `criterion_id` slug, resolved against the task's version (`POST /tasks` links at create time so `/status` counts the task with no backfill).
-- Server-mediated branch publish (ADR 0055 / [#1025](https://example.com/builders#/task/1025) — lets a dev box with no GitHub push credential ship). Owner-gated like ship: `POST /tasks/:id/publish-branch` (`requireBuilder` + `gateTaskOwnership`, **NOT** `allowBoxScope` → a box-scoped session is `403 box_scope`, so the builder must `/builder-reauth` first; own 32 MB json parser for the base64 thin-bundle body, 20 MB decoded cap; the server pushes the branch + opens the PR + auto-merges with a server-side push credential — a **GitHub App** installation token (short-lived, repo-scoped; preferred, [ADR 0055](adr/0055-server-mediated-branch-publish.md) update / task 1028) or the `GITHUB_PUSH_TOKEN` PAT fallback; `503 push_unconfigured` when neither is set; `400 tip_mismatch` if the bundle tip ≠ the claimed `head_sha`) and `GET /tasks/:id/publish-status?branch=…` (polls PR + deploy-prod state derived live from GitHub). When the PR is still open it also carries `merge_driver`, whose `reason` says why it has not merged; on a red PR `failing_tests` names the failing unit tests (read from the `unit-report` commit status the `unit` workflow posts) and `checks_unreadable: true` says the check list is blind because the App lacks `Checks: read` — so an empty `checks[]` is never read as "nothing failed" (task 1003988, ADR 0301). `ship.js` uses these in `ci` mode only when `pushVia()` resolves to server (a box, or `OTB_PUSH_VIA_SERVER=1`); a laptop with `gh` keeps the local push path unchanged. Implementation in `src/bongos/github-push.js`.
+- Server-mediated branch publish (ADR 0055 / [#1025](https://example.com/builders#/task/1025) — lets a dev box with no GitHub push credential ship). Owner-gated like ship: `POST /tasks/:id/publish-branch` (`requireBuilder` + `gateTaskOwnership`, **NOT** `allowBoxScope` → a box-scoped session is `403 box_scope`, so the builder must `/builder-reauth` first; own 32 MB json parser for the base64 thin-bundle body, 20 MB decoded cap; the server pushes the branch + opens the PR + auto-merges with a server-side push credential — a **GitHub App** installation token (short-lived, repo-scoped; preferred, [ADR 0055](adr/0055-server-mediated-branch-publish.md) update / task 1028) or the `GITHUB_PUSH_TOKEN` PAT fallback; `503 push_unconfigured` when neither is set; `400 tip_mismatch` if the bundle tip ≠ the claimed `head_sha`) and `GET /tasks/:id/publish-status?branch=…` (polls PR + deploy-prod state derived live from GitHub). When the PR is still open it also carries `merge_driver`, whose `reason` says why it has not merged; on a red PR `failing_tests` names the failing unit tests (read from the `unit-report` commit status the `unit` workflow posts) and `checks_unreadable: true` says the check list is blind because the App lacks `Checks: read` — so an empty `checks[]` is never read as "nothing failed" (task 1003988, ADR 0301). Because the server's credential is the PR's AUTHOR, publish also **assigns the PR to the task's claim holder** and names them in the body (`modules/lifecycle/pr-assign.js`, task 1003991) — best-effort: the 201 carries `pr_assignee` (the login, or `null` when GitHub would not assign it) and a failed assignment never fails the publish. `ship.js` uses these in `ci` mode only when `pushVia()` resolves to server (a box, or `OTB_PUSH_VIA_SERVER=1`); a laptop with `gh` keeps the local push path unchanged. Implementation in `src/bongos/github-push.js`.
 - Archon monitoring reads backing the `/watch` page (ADR 0036): `GET /builders/roster`, `GET /grades/by-builder[?days=N]` (**archon-only**, [#726](https://example.com/builders#/task/726) — per-builder grade breakdown for the MARKS section; the project-wide aggregate stays public at `/public/grades`), `GET /audit-log`, `GET /override-requests`, `GET /access-requests`, `GET /security/reports`. Personal-prefs writes backing `/settings`: `GET/PATCH /me/skill-prefs`, `PATCH /me/disciplines`.
 - Per-builder "needs" + own Gemini key ([ADR 0073](adr/0073-builder-needs-signal-and-byok-gemini-key.md), [#1013](https://example.com/builders#/task/1013)): `GET /me` now also carries `needs` ({items, action_needed_count} — the consistent "the system needs an input from you" signal; `modules/builder-settings/builder-needs.js` is the SSOT — carved out in BV1.R80, resolved by `GET /me` via the `builder-settings` kernel port — rendered by the hall Standing card + the CLI `printNeedsNudge`). The own-key (pragmatic BYOK) endpoints, all own-scoped: `GET /me/art-key/own` (masked meta — last4 only), `PUT /me/art-key/own` (validate-on-save via a Google list-models call → encrypt with `src/bongos/secret-box.js` → store; `503 storage_not_configured` until `BUILDER_SECRET_KEY` is set, `422 invalid_key` on a bad key), `DELETE /me/art-key/own`. The existing `GET /me/art-key` (shared-key box-sync delivery) is extended to also deliver the decrypted own key, which `scripts/gds/fetch-art-key.js` syncs into the local `gemini_api_key` slot (own key wins in the `gen_api.py` cascade).
 - Builder memory (ADR 0024 cloneable memory + ADR 0026 BFG). Self-scoped (owner is always `req.builder.id`, never input): `POST /memory/sync` (push own memory; own 64 MB parser, vs the global 64 KB), `GET /memory/files`, `GET /memory/file`, `DELETE /memory/file` (the BFG delete affordance, 6C.2). Cross-builder (input-owner) endpoints — all privileged + audit-logged fail-closed: `GET /memory/builders/:id/files`+`/file` (**archon forensic** read), `GET /memory/bfg/builders/:id/files`+`/file` (**BFG-principal only**, 6B.1 read), and the one cross-builder WRITE `POST /memory/builders/:id/bfg-write` (**BFG-principal only**, kill-switched `BFG_WRITE_ENABLED` default-OFF, namespaced `bfg/`, attributed `author: BFG`, write+audit in one tx — dreams + transparent corrections, 6C.1/6C.2).

package/docs/module-api-changelog.md

@@ -2152,5 +2152,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.837 with no explicit bump. run 35250225228. (task 1002620)
   1.19.839 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.838 with no explicit bump. run 35252591179. (task 1002620)
+  1.19.840 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.839 with no explicit bump. run 35254616836. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/github-push.js

@@ -1479,8 +1479,8 @@ module.exports = {
   landProvenForTask,
   prReferencesTask,
   findTaskPullRequest,
-  scrubCredential,
-  truncateLoudly,   // task 1003222 — exported so its behaviour is testable, not just its effect
+  scrubCredential, ghHeaders,
+  truncateLoudly,  // task 1003222 — exported so its behaviour is testable, not just its effect
   STDERR_MAX,
   isAncestorOfDefaultBranch,
   resolveToken,

package/modules/lifecycle/pr-assign.js

@@ -0,0 +1,77 @@
+// modules/lifecycle/pr-assign.js — assign a ship's pull request to the builder who wrote
+// it, and name them in its body (task 1003991).
+//
+// WHY. A builder box holds no GitHub credential (ADR 0055), so the server opens the PR
+// with its own — and GitHub records the credential's account as the AUTHOR: 259 of the
+// last 300 PRs. The builder's commits are theirs, but "created by me" is empty for them,
+// and the PR is where CI and merge state live. An ASSIGNEE is the one PR-level link to a
+// person the server can set for someone else; "assigned to me" then finds their work.
+//
+// A COURTESY, NEVER A GATE. assignPullRequest resolves { assigned, reason? } on every
+// path and never rejects: a login GitHub will not assign (not a collaborator — it
+// answers 201 and silently drops the name), a missing permission or a network fault
+// must not be able to fail a ship that already pushed. A sibling of github-push.js
+// rather than a function in it because that file sits at the line cap.
+
+'use strict';
+
+const githubPush = require('./github-push');
+
+// GitHub's own login rule: 1–39 chars, alphanumeric with single inner hyphens — plus
+// the underscore a managed-user login carries (`name_shortcode`). The login is
+// interpolated into a PR body as an @-mention, so anything else never gets that far.
+const GITHUB_LOGIN_RE = /^[a-z\d](?:[a-z\d]|[-_](?=[a-z\d])){0,38}$/i;
+// The assignment is the one OPTIONAL call between a finished push and the route's 201:
+// a stalled GitHub must not make a ship that succeeded read as a failed publish.
+const ASSIGN_TIMEOUT_MS = 5000;
+
+function isGithubLogin(login) {
+  return typeof login === 'string' && GITHUB_LOGIN_RE.test(login);
+}
+
+// The sentence the PR body carries, or '' when there is no usable login.
+function prBuilderLine(login) {
+  return isGithubLogin(login) ? `Built by @${login}.` : '';
+}
+
+function logAssignFailure(reason, number, logImpl) {
+  try {
+    const sink = logImpl || require('../../src/module-api').logger('lifecycle');
+    sink.warn('pull request could not be assigned to its builder (the ship is unaffected)',
+      { reason: githubPush.scrubCredential(String(reason)), pr: number });
+  } catch (_) { /* logging is never load-bearing */ }
+}
+
+async function assignPullRequest({ number, login }, deps = {}) {
+  const miss = (reason, detail) => {
+    logAssignFailure(detail ? `${reason}: ${detail}` : reason, number, deps.logImpl);
+    return { assigned: false, reason };
+  };
+  try {
+    if (!isGithubLogin(login)) return miss('bad_login');
+    if (!Number.isInteger(number) || number <= 0) return miss('bad_pr_number');
+    const token = await githubPush.resolveToken(deps);
+    const repoInfo = deps.repoInfo || require('../../src/module-api').repoInfo.loadRepoInfo();
+    if (!token || !repoInfo || repoInfo.error) return miss('unconfigured');
+
+    const doFetch = deps.fetchImpl || fetch;
+    const res = await doFetch(
+      `https://api.github.com/repos/${repoInfo.owner}/${repoInfo.repo}/issues/${number}/assignees`,
+      {
+        method: 'POST',
+        headers: { ...githubPush.ghHeaders(token), 'Content-Type': 'application/json' },
+        body: JSON.stringify({ assignees: [login] }),
+        signal: AbortSignal.timeout(ASSIGN_TIMEOUT_MS),
+      }
+    );
+    if (!res.ok) return miss(`http_${res.status}`);
+    const issue = await res.json();
+    const took = ((issue && issue.assignees) || [])
+      .some((a) => String(a && a.login).toLowerCase() === login.toLowerCase());
+    return took ? { assigned: true } : miss('not_assignable');
+  } catch (e) {
+    return miss('threw', (e && e.message) || '');
+  }
+}
+
+module.exports = { assignPullRequest, prBuilderLine };

package/modules/lifecycle/routes/tasks.js

@@ -46,6 +46,7 @@ const { makeAbandonHandler } = require('./abandon-handler');
 // longer imports the grader — it resolves the `grade` kernel PORT at grade time
 // (seams.resolveOptional('grade'), in POST /tasks/:id/grade below).
 const githubPush = require('../github-push');
+const prAssign = require('../pr-assign');
 const shipAssurance = require('../ship-assurance');
 const RECONCILE_PROOF = Object.freeze({ kind: 'proof', reason: 'publish-status reconcile: land proven' });
 const seams = api;
@@ -1125,12 +1126,25 @@ module.exports = function buildTasksRouter() {
       fs.writeFileSync(bundlePath, bundleBuf);
       const { head_sha: pushedSha } = await githubPush.pushBundle({ bundlePath, branch, headSha });
       const title = `task ${id}: ${deHashRefs(valueSummary) || branch}`.slice(0, 240);
+      // task 1003991: the server's credential is the PR's AUTHOR, so the builder who
+      // wrote the work is named in the body and made its assignee. The claim holder,
+      // not the caller — an Archon re-shipping someone's strand did not write it. A
+      // lookup that FAILS names nobody (a PR body is never rewritten, so a wrong name
+      // is permanent); only a never-claimed task falls back to the caller.
+      const builderLogin = await db.getLastClaimHolder(id)
+        .then((h) => (h ? h.github_login : req.builder.github_login), () => null);
+      const builderLine = prAssign.prBuilderLine(builderLogin);
       const body =
-        `Auto-opened by GDS server-mediated publish (ADR 0055) for task ${id}.\n\n` +
+        `Auto-opened by GDS server-mediated publish (ADR 0055) for task ${id}.` +
+        `${builderLine ? ` ${builderLine}` : ''}\n\n` +
         `${deHashRefs(valueSummary) || '(no value summary)'}\n\n` +
         `Merging triggers .github/workflows/deploy-prod.yml -> ${branding().domains.publicOrigin}. ` +
         `Auto-merge is enabled — GitHub lands it once the required checks pass.`;
       const pr = await githubPush.openOrFindPullRequest({ branch, title, body });
+      // Best-effort by contract (pr-assign.js never rejects); the catch is for a future
+      // edit that forgets — an assignment must not be able to fail a pushed ship.
+      const assignment = await prAssign.assignPullRequest({ number: pr.number, login: builderLogin })
+        .catch(() => ({ assigned: false }));
       // task 1001431: ask WHY when arming fails. `auto_merge: false` on its own told the
       // builder nothing, and the commonest cause is a repo with allow_auto_merge OFF —
       // a permanent condition that reads exactly like a transient blip.
@@ -1157,6 +1171,7 @@ module.exports = function buildTasksRouter() {
       }
       return res.status(201).json({
         ok: true, pr_url: pr.url, pr_number: pr.number, head_sha: pushedSha, auto_merge: autoMerge,
+        pr_assignee: assignment.assigned ? builderLogin : null,
         // Only present when arming failed — the publish itself still succeeded (201).
         ...(autoMerge ? {} : { auto_merge_reason: autoMergeResult.reason }),
       });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.839",
+  "version": "1.19.840",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.839",
+      "version": "1.19.840",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.839",
+  "version": "1.19.840",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",