@bongos/core 1.19.839 → 1.19.841

package/modules/lifecycle/routes/tasks.js

@@ -46,6 +46,7 @@ const { makeAbandonHandler } = require('./abandon-handler');
 // longer imports the grader — it resolves the `grade` kernel PORT at grade time
 // (seams.resolveOptional('grade'), in POST /tasks/:id/grade below).
 const githubPush = require('../github-push');
+const prAssign = require('../pr-assign');
 const shipAssurance = require('../ship-assurance');
 const RECONCILE_PROOF = Object.freeze({ kind: 'proof', reason: 'publish-status reconcile: land proven' });
 const seams = api;
@@ -1125,12 +1126,25 @@ module.exports = function buildTasksRouter() {
       fs.writeFileSync(bundlePath, bundleBuf);
       const { head_sha: pushedSha } = await githubPush.pushBundle({ bundlePath, branch, headSha });
       const title = `task ${id}: ${deHashRefs(valueSummary) || branch}`.slice(0, 240);
+      // task 1003991: the server's credential is the PR's AUTHOR, so the builder who
+      // wrote the work is named in the body and made its assignee. The claim holder,
+      // not the caller — an Archon re-shipping someone's strand did not write it. A
+      // lookup that FAILS names nobody (a PR body is never rewritten, so a wrong name
+      // is permanent); only a never-claimed task falls back to the caller.
+      const builderLogin = await db.getLastClaimHolder(id)
+        .then((h) => (h ? h.github_login : req.builder.github_login), () => null);
+      const builderLine = prAssign.prBuilderLine(builderLogin);
       const body =
-        `Auto-opened by GDS server-mediated publish (ADR 0055) for task ${id}.\n\n` +
+        `Auto-opened by GDS server-mediated publish (ADR 0055) for task ${id}.` +
+        `${builderLine ? ` ${builderLine}` : ''}\n\n` +
         `${deHashRefs(valueSummary) || '(no value summary)'}\n\n` +
         `Merging triggers .github/workflows/deploy-prod.yml -> ${branding().domains.publicOrigin}. ` +
         `Auto-merge is enabled — GitHub lands it once the required checks pass.`;
       const pr = await githubPush.openOrFindPullRequest({ branch, title, body });
+      // Best-effort by contract (pr-assign.js never rejects); the catch is for a future
+      // edit that forgets — an assignment must not be able to fail a pushed ship.
+      const assignment = await prAssign.assignPullRequest({ number: pr.number, login: builderLogin })
+        .catch(() => ({ assigned: false }));
       // task 1001431: ask WHY when arming fails. `auto_merge: false` on its own told the
       // builder nothing, and the commonest cause is a repo with allow_auto_merge OFF —
       // a permanent condition that reads exactly like a transient blip.
@@ -1157,6 +1171,7 @@ module.exports = function buildTasksRouter() {
       }
       return res.status(201).json({
         ok: true, pr_url: pr.url, pr_number: pr.number, head_sha: pushedSha, auto_merge: autoMerge,
+        pr_assignee: assignment.assigned ? builderLogin : null,
         // Only present when arming failed — the publish itself still succeeded (201).
         ...(autoMerge ? {} : { auto_merge_reason: autoMergeResult.reason }),
       });

package/modules/provisioning/pollers/liveness-notify.js

@@ -0,0 +1,110 @@
+'use strict';
+
+// modules/provisioning/pollers/liveness-notify.js — the owner-facing half of the
+// liveness sweep: when does an outage become something worth saying out loud, and
+// in what words (task 1002894, from idea 1000703; the owner's YES of 2026-08-12,
+// scoped out of task 1002696).
+//
+// WHY. The sweep has knocked on every active project's /healthz every five minutes
+// since task 1002696 and told nobody — an owner learned their project had stopped
+// answering by opening the projects page. This turns that record into one message
+// on the DOWN edge, and one when it comes back.
+//
+// THE THREE RULES that keep a heartbeat from becoming a siren:
+//   * EDGE, not state. The fall is only visible in the row's PRIOR last_verified_up,
+//     which recordLivenessProbe now returns. A row that was already down when this
+//     process started has no edge to see, so a restarted control plane re-posts
+//     nothing — the notice state is deliberately in memory, seeded only by an edge
+//     this process observed.
+//   * CONFIRM before speaking. One failed probe is a blip; the notice waits for the
+//     outage to survive a second consecutive sweep, and a project that recovers in
+//     between was never announced, so nothing needs unsaying.
+//   * COLLAPSE a fan-out. When several projects fall in the same sweep, the cause is
+//     almost always on this side — a control-plane restart, a prober-side network
+//     blip — so they become ONE message that says so, never one per project.
+//
+// The copy is owner-audience and names a project only when the project is public on
+// the platform's map; a private one is described, never identified.
+
+const { execFile } = require('node:child_process');
+const path = require('node:path');
+
+// Consecutive down probes before an outage is announced. Two ≈ one sweep interval
+// of patience, which is what makes a single refused connection cost nothing.
+const DOWN_CONFIRM = Number(process.env.PROVISIONING_LIVENESS_DOWN_CONFIRM) || 2;
+// Simultaneous falls that mean "look at the platform, not the projects".
+const FLEET_GUARD = Number(process.env.PROVISIONING_LIVENESS_FLEET_GUARD) || 3;
+// scripts/discord/post.js is invoked from the repo root regardless of cwd.
+const REPO_ROOT = path.resolve(__dirname, '..', '..', '..');
+
+// What the owner reads. `name` is null for a project that is not public — it is
+// described rather than identified, so a private project's slug never rides a
+// Discord channel. A `count` with no name is the collapsed fleet message. PURE.
+function noticeText({ kind, name = null, count = 0 } = {}) {
+  if (!name && count > 1) {
+    return kind === 'up'
+      ? `✅ All ${count} projects that went quiet are answering again.`
+      : `⚠️ ${count} projects stopped answering at the same moment. When that many go quiet together it is usually the platform's own check that is having trouble, not the projects themselves — worth a look here first.`;
+  }
+  const who = name ? `**${name}**` : 'A private project';
+  if (kind === 'up') return `✅ ${who} is answering again.`;
+  return `⚠️ ${who} has stopped answering. The platform knocked twice in a row and heard nothing back. It will say so here when the project answers again.`;
+}
+
+// One collapsed message, or one per project — never both. PURE.
+function collapse(rows, kind, fleetGuard) {
+  if (!rows.length) return [];
+  if (rows.length >= fleetGuard) return [{ kind, ids: rows.map((r) => r.id), text: noticeText({ kind, count: rows.length }) }];
+  return rows.map((r) => ({ kind, ids: [r.id], text: noticeText({ kind, name: r.isPublic ? r.slug : null }) }));
+}
+
+// The decision, given this sweep's observations ({ id, slug, isPublic, up, prevUp })
+// and the notice state carried between sweeps. MUTATES `state` (a Map, id → { streak,
+// notified }) and returns what to post; everything else about it is pure, so the
+// rules above are unit-tested without a sweep, a database or a network.
+function planNotices(observations, state, { confirm = DOWN_CONFIRM, fleetGuard = FLEET_GUARD } = {}) {
+  const downs = [], ups = [];
+  for (const o of observations || []) {
+    const prev = state.get(o.id);
+    if (o.up) {
+      // Only a project we actually announced gets an all-clear; a blip that never
+      // reached a notice just drops its streak.
+      if (prev && prev.notified) ups.push(o);
+      state.delete(o.id);
+      continue;
+    }
+    let streak;
+    if (prev) streak = prev.streak + 1;
+    else if (o.prevUp === true) streak = 1;   // the fall, observed in this process
+    else continue;                            // already down before we were watching
+    const notified = !!(prev && prev.notified);
+    if (!notified && streak >= confirm) downs.push(o);
+    state.set(o.id, { streak, notified: notified || streak >= confirm });
+  }
+  const notices = [...collapse(downs, 'down', fleetGuard), ...collapse(ups, 'up', fleetGuard)];
+  const collapsedCount = (list) => (list.length >= fleetGuard ? list.length : 0);
+  return { notices, suppressed: collapsedCount(downs) + collapsedCount(ups) };
+}
+
+// Fire-and-forget to Discord #ship-news — the owner-facing feed the build broadcast
+// already uses (owner's call, 2026-09-17: no new channel, no new webhook to place).
+// Mirrors fireDiscordBroadcast in src/bongos/routes/builders.js: non-blocking,
+// CHAT_DRY_RUN=1 short-circuits for the smoke path, and a Discord hiccup can never
+// stall a sweep tick.
+function postNotice(notice, { log = console.log } = {}) {
+  const text = notice && notice.text;
+  if (!text) return;
+  if (process.env.CHAT_DRY_RUN === '1') {
+    log(`[liveness] [broadcast dry-run] would post: ${text}`);
+    return;
+  }
+  try {
+    execFile('node', ['scripts/discord/post.js', text], { cwd: REPO_ROOT, timeout: 10_000 }, (err) => {
+      if (err) log(`[liveness] notice broadcast failed (non-blocking): ${err.message}`);
+    });
+  } catch (e) {
+    log(`[liveness] notice broadcast failed (non-blocking): ${e && e.message ? e.message : e}`);
+  }
+}
+
+module.exports = { planNotices, noticeText, postNotice, DOWN_CONFIRM, FLEET_GUARD };

package/modules/provisioning/pollers/liveness-sweep.js

@@ -27,6 +27,19 @@ const dns = require('node:dns').promises;
 const { Agent: UndiciAgent } = require('undici');
 const api = require('../../../src/module-api');
 const provisioning = require('../provisioning');
+const { planNotices, postNotice } = require('./liveness-notify');
+
+// Notice state between sweeps (task 1002894): id → { streak, notified }. In memory
+// on purpose — it is seeded only by a fall this process observed, which is exactly
+// what stops a restarted control plane re-announcing an outage it arrived to find.
+const noticeState = new Map();
+function resetNoticeState() { noticeState.clear(); }
+
+// Name a project in an owner-facing message only when it is public on the platform's
+// map; a private or stealth one is described, never identified.
+function isPublicProject(row) {
+  try { return provisioning.effectiveSettings(row).visibility === 'public'; } catch (_) { return false; }
+}
 
 // ~5-minute cadence — matches the display contract's "fresh ≤ 2 cadences" window
 // and is cheap: one HTTP GET per active instance. Override for tests/ops.
@@ -198,8 +211,8 @@ async function sweepOnce(deps = {}) {
       pin = gate.pin || null;
     }
     const probe = await probeHealthz(url, { timeoutMs: deps.timeoutMs, fetchImpl: deps.fetchImpl, pin });
-    await provisioning.recordLivenessProbe(db, row.id, probe.up);
-    return { row, probed: true, ...probe };
+    const rec = await provisioning.recordLivenessProbe(db, row.id, probe.up);
+    return { row, probed: true, prevUp: rec ? rec.prev_up : null, ...probe };
   }));
 
   const probed = results.filter((r) => r.probed);
@@ -217,6 +230,17 @@ async function sweepOnce(deps = {}) {
   // Nothing active ⇒ nothing to say. A vanilla control plane would otherwise emit
   // an empty account every five minutes forever.
   if (rows.length) log(formatSweepLine(out));
+
+  // Tell the owner what changed (task 1002894). Best-effort like everything else
+  // here: a broadcast that throws is logged and the tick still returns its account.
+  const notify = deps.notify || ((n) => postNotice(n, { log }));
+  const plan = planNotices(
+    probed.map((r) => ({ id: r.row.id, slug: r.row.slug, isPublic: isPublicProject(r.row), up: !!r.up, prevUp: r.prevUp })),
+    noticeState
+  );
+  for (const notice of plan.notices) {
+    try { notify(notice); } catch (e) { log(`[liveness] notice failed (non-blocking): ${e && e.message ? e.message : e}`); }
+  }
   return out;
 }
 
@@ -255,6 +279,7 @@ module.exports = {
   stop,
   // exported for tests
   sweepOnce,
+  resetNoticeState,
   probeHealthz,
   healthzUrl,
   formatSweepLine,

package/modules/provisioning/provisioning.js

@@ -979,7 +979,7 @@ async function clearReleasedDomains(db, id) {
 // against it would only ever record a false "down". `limit` is a runaway guard.
 async function listActiveInstancesForLiveness(db, { limit = 500 } = {}) {
   const { rows } = await db.query(
-    `SELECT id, slug, domain, port FROM provisioning_instances
+    `SELECT id, slug, domain, port, settings FROM provisioning_instances
       WHERE status = 'active'
       ORDER BY id
       LIMIT $1`,
@@ -988,16 +988,16 @@ async function listActiveInstancesForLiveness(db, { limit = 500 } = {}) {
   return rows;
 }
 
-// Record ONE probe observation. Deliberately narrow: it writes the two overlay
-// columns and nothing else — not `status`, and not `updated_at` either, so a
-// 5-minute heartbeat can never reshuffle the owner's updated_at-ordered card list
-// or fake activity on an instance nobody touched.
+// Record ONE probe observation. Deliberately narrow: it writes the two overlay columns
+// and nothing else — not `status`, and not `updated_at` either, so a 5-minute heartbeat
+// can never reshuffle the owner's updated_at-ordered card list or fake activity on an
+// instance nobody touched. `prev_up` rides the RETURNING (task 1002894): the FALL is visible
+// only in the value this write replaces — one statement, so no separate SELECT races a sweep.
 async function recordLivenessProbe(db, id, up) {
   const { rows } = await db.query(
-    `UPDATE provisioning_instances
-        SET last_verified_at = now(), last_verified_up = $2
-      WHERE id = $1
-      RETURNING id, last_verified_at, last_verified_up`,
+    `UPDATE provisioning_instances p SET last_verified_at = now(), last_verified_up = $2
+       FROM (SELECT id, last_verified_up FROM provisioning_instances WHERE id = $1) prev WHERE p.id = prev.id
+      RETURNING p.id, p.last_verified_at, p.last_verified_up, prev.last_verified_up AS prev_up`,
     [id, !!up]
   );
   return rows[0] || null;

package/modules/provisioning/tests/liveness-notify.mjs

@@ -0,0 +1,199 @@
+// modules/provisioning/tests/liveness-notify.mjs
+//
+// The owner-facing outage notice the liveness sweep posts (task 1002894, from
+// idea 1000703). The sweep has probed every active instance since task 1002696 and
+// told nobody. Covered here:
+//   • planNotices — the edge rules: one notice per outage, silence afterwards, a
+//     single-sweep blip never posts, a restarted poller never re-posts a fall it
+//     did not see, recovery only after a down notice actually went out
+//   • the fleet guard — many falls at once collapse into ONE message, because that
+//     shape is the platform's own checker, not N projects
+//   • noticeText — owner-audience copy that never names a non-public project
+//   • sweepOnce — the notices ride the sweep, and a broadcast that throws cannot
+//     stall a tick
+//
+// DB-free, network-free: `db` is a recording fake and `notify` is injected.
+//
+// Run standalone: node modules/provisioning/tests/liveness-notify.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+// ESM named imports, not createRequire: knip cannot trace a require()'d export from a
+// test, so a test-only export would read as dead code in the CI ratchet.
+import { planNotices, noticeText, DOWN_CONFIRM, FLEET_GUARD } from '../pollers/liveness-notify.js';
+
+const require = createRequire(import.meta.url);
+const liveness = require('../pollers/liveness-sweep.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// One observation of one instance in one sweep. prevUp is what the row said
+// BEFORE this probe was recorded — the transition is only visible there.
+const obs = (over = {}) => ({ id: 1, slug: 'mercury', isPublic: true, up: false, prevUp: true, ...over });
+// Drive N sweeps through one state Map and collect what each would post.
+function sweeps(observations, { state = new Map(), opts = {} } = {}) {
+  return observations.map((row) => planNotices([].concat(row), state, opts).notices);
+}
+
+console.log('planNotices (the edge rules):');
+
+t('a fall posts exactly ONE notice, after the outage is confirmed, then stays quiet', () => {
+  assert.equal(DOWN_CONFIRM >= 2, true, 'one probe is a blip, not an outage');
+  const rounds = sweeps([
+    obs(),                                   // the fall: prior up, now down
+    obs({ prevUp: false }),                  // still down — confirms it
+    obs({ prevUp: false }),                  // and again
+    obs({ prevUp: false }),
+  ]);
+  assert.deepEqual(rounds.map((n) => n.length), [0, 1, 0, 0]);
+  assert.equal(rounds[1][0].kind, 'down');
+  assert.match(rounds[1][0].text, /mercury/);
+});
+
+t('a one-sweep blip never posts — it recovers before the outage is confirmed', () => {
+  const rounds = sweeps([obs(), obs({ up: true, prevUp: false })]);
+  assert.deepEqual(rounds.map((n) => n.length), [0, 0], 'nothing was said, so nothing needs unsaying');
+});
+
+t('a restarted poller never re-posts an outage that fell before it started', () => {
+  // Fresh state (the restart) and a row that is ALREADY down: no edge to see.
+  const rounds = sweeps([obs({ prevUp: false }), obs({ prevUp: false }), obs({ prevUp: false })]);
+  assert.deepEqual(rounds.map((n) => n.length), [0, 0, 0]);
+});
+
+t('recovery posts once, and only when a down notice actually went out', () => {
+  const state = new Map();
+  const rounds = sweeps([obs(), obs({ prevUp: false }), obs({ up: true, prevUp: false }), obs({ up: true, prevUp: true })], { state });
+  assert.deepEqual(rounds.map((n) => n.length), [0, 1, 1, 0]);
+  assert.equal(rounds[2][0].kind, 'up');
+  assert.equal(state.size, 0, 'a healed instance leaves no state behind');
+});
+
+t('a second outage on the same instance posts again — the notice is per outage, not per lifetime', () => {
+  const state = new Map();
+  const rounds = sweeps([obs(), obs({ prevUp: false }), obs({ up: true, prevUp: false }), obs(), obs({ prevUp: false })], { state });
+  assert.deepEqual(rounds.map((n) => n.length), [0, 1, 1, 0, 1]);
+  assert.equal(rounds[4][0].kind, 'down');
+});
+
+t('the fleet guard collapses a mass fall into ONE message and never fans out', () => {
+  const state = new Map();
+  const fleet = Array.from({ length: FLEET_GUARD }, (_, i) => ({ id: i + 1, slug: `p${i + 1}`, isPublic: true, up: false, prevUp: true }));
+  assert.equal(planNotices(fleet, state).notices.length, 0, 'still unconfirmed on the first sweep');
+  const second = planNotices(fleet.map((r) => ({ ...r, prevUp: false })), state);
+  assert.equal(second.notices.length, 1);
+  assert.equal(second.suppressed, FLEET_GUARD);
+  assert.match(second.notices[0].text, new RegExp(`${FLEET_GUARD} projects`));
+  assert.doesNotMatch(second.notices[0].text, /p1|p2/, 'a fleet-wide message names no project');
+  // …and the recovery collapses the same way, rather than posting one per project.
+  const back = planNotices(fleet.map((r) => ({ ...r, up: true, prevUp: false })), state);
+  assert.equal(back.notices.length, 1);
+  assert.equal(back.notices[0].kind, 'up');
+  assert.equal(state.size, 0);
+});
+
+t('below the guard, each project still gets its own named notice', () => {
+  const state = new Map();
+  const few = Array.from({ length: FLEET_GUARD - 1 }, (_, i) => ({ id: i + 1, slug: `p${i + 1}`, isPublic: true, up: false, prevUp: true }));
+  planNotices(few, state);
+  const out = planNotices(few.map((r) => ({ ...r, prevUp: false })), state);
+  assert.equal(out.notices.length, few.length);
+  assert.equal(out.suppressed, 0);
+  assert.match(out.notices[0].text, /p1/);
+});
+
+console.log('\nnoticeText (owner-audience copy):');
+
+t('a public project is named; a non-public one never is', () => {
+  const named = noticeText({ kind: 'down', name: 'mercury' });
+  assert.match(named, /mercury/);
+  const hidden = noticeText({ kind: 'down', name: null });
+  assert.doesNotMatch(hidden, /mercury|null|undefined/);
+  assert.match(hidden, /project/i);
+});
+
+t('the copy carries no jargon and no internals', () => {
+  for (const kind of ['down', 'up']) {
+    for (const name of ['mercury', null]) {
+      const text = noticeText({ kind, name, count: 4 });
+      assert.doesNotMatch(text, /healthz|probe|ECONNREFUSED|http \d|instance|sweep|poller|null|undefined/i, `${kind}/${name}: ${text}`);
+      assert.ok(text.length > 20 && text.length < 320, 'one short paragraph');
+    }
+  }
+});
+
+t('a non-public project is not named in the sweep observation either', () => {
+  const state = new Map();
+  const row = { id: 9, slug: 'secret-co', isPublic: false, up: false, prevUp: true };
+  planNotices([row], state);
+  const out = planNotices([{ ...row, prevUp: false }], state);
+  assert.equal(out.notices.length, 1);
+  assert.doesNotMatch(out.notices[0].text, /secret-co/);
+});
+
+console.log('\nsweepOnce (the notices ride the sweep):');
+
+// A fake db that answers the sweep's two statements, with the prior value the
+// edge rules read. `up` decides what the probe will find.
+function fakeDb(rows, priorUp = new Map()) {
+  return {
+    query: async (sql, params) => {
+      if (/FROM provisioning_instances/.test(sql) && /WHERE status = 'active'/.test(sql)) return { rows };
+      if (/UPDATE provisioning_instances/.test(sql)) {
+        const prev = priorUp.has(params[0]) ? priorUp.get(params[0]) : true;
+        priorUp.set(params[0], params[1]);
+        return { rows: [{ id: params[0], last_verified_at: new Date(), last_verified_up: params[1], prev_up: prev }] };
+      }
+      throw new Error(`unexpected SQL: ${sql}`);
+    },
+  };
+}
+
+await ta('a down instance posts one notice on the confirming sweep, through the injected broadcaster', async () => {
+  liveness.resetNoticeState();
+  const rows = [{ id: 1, slug: 'mercury', domain: null, port: 1, settings: {} }];
+  const db = fakeDb(rows);
+  const posted = [];
+  const deps = { pool: db, log: () => {}, timeoutMs: 50, notify: (n) => posted.push(n), fetchImpl: async () => { throw new Error('ECONNREFUSED'); } };
+  await liveness.sweepOnce(deps);
+  assert.equal(posted.length, 0, 'the first down is not yet an outage');
+  await liveness.sweepOnce(deps);
+  assert.equal(posted.length, 1);
+  assert.equal(posted[0].kind, 'down');
+  await liveness.sweepOnce(deps);
+  assert.equal(posted.length, 1, 'and it stays quiet');
+});
+
+await ta('a broadcaster that throws cannot stall a sweep tick', async () => {
+  liveness.resetNoticeState();
+  const rows = [{ id: 1, slug: 'mercury', domain: null, port: 1, settings: {} }];
+  const db = fakeDb(rows);
+  const deps = { pool: db, log: () => {}, timeoutMs: 50, notify: () => { throw new Error('discord is down'); }, fetchImpl: async () => { throw new Error('ECONNREFUSED'); } };
+  await liveness.sweepOnce(deps);
+  const out = await liveness.sweepOnce(deps);
+  assert.equal(out.down, 1, 'the sweep still reports what it saw');
+});
+
+await ta('a gated project is never named in what the sweep posts', async () => {
+  liveness.resetNoticeState();
+  const rows = [{ id: 7, slug: 'secret-co', domain: null, port: 1, settings: { visibility: 'private' } }];
+  const db = fakeDb(rows);
+  const posted = [];
+  const deps = { pool: db, log: () => {}, timeoutMs: 50, notify: (n) => posted.push(n), fetchImpl: async () => { throw new Error('ECONNREFUSED'); } };
+  await liveness.sweepOnce(deps);
+  await liveness.sweepOnce(deps);
+  assert.equal(posted.length, 1);
+  assert.doesNotMatch(posted[0].text, /secret-co/);
+});
+
+console.log(`\nprovisioning liveness notice: ${passed} passed, ${failed} failed`);
+process.exitCode = failed ? 1 : 0;

package/modules/provisioning/tests/liveness.mjs

@@ -59,10 +59,11 @@ function fakeDb(rows) {
   return {
     updates,
     query: async (sql, params) => {
-      if (/SELECT id, slug, domain, port FROM provisioning_instances/.test(sql)) return { rows };
-      if (/UPDATE provisioning_instances/.test(sql)) {
+      if (/FROM provisioning_instances/.test(sql) && /WHERE status = 'active'/.test(sql)) return { rows };
+      if (/^UPDATE provisioning_instances/.test(sql)) {
         updates.push({ sql, id: params[0], up: params[1] });
-        return { rows: [{ id: params[0], last_verified_at: new Date(), last_verified_up: params[1] }] };
+        // prev_up rides the write (task 1002894) — the notice reads the value replaced.
+        return { rows: [{ id: params[0], last_verified_at: new Date(), last_verified_up: params[1], prev_up: true }] };
       }
       throw new Error(`unexpected SQL: ${sql}`);
     },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.839",
+  "version": "1.19.841",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.839",
+      "version": "1.19.841",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.839",
+  "version": "1.19.841",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/paste-token.js

@@ -32,27 +32,71 @@ const { SESSION_FILENAMES, readSessionConfigSync } = require('../../src/instance
 // WRITE the session to the configured instance dir (OTB → ~/.config/otb,
 // unchanged; a fresh instance → its neutral dir). R61 / task 1200.
 const SESSION_PATH = ic.configPath(SESSION_FILENAMES[0]);
-// env → the EXISTING session's api_base → this instance's branding default.
-// On a RE-auth a session file already exists, and its api_base is the best signal
-// of which instance the builder is on — this file used to hardcode the founder
-// host here (a straggler the task 1002201 sweep missed), so a token minted by
-// another instance was verified against example.com and rejected 401 with a
-// perfectly valid token (task 1002427).
-const API_BASE = ic.resolveApiBase();
+
+// `--api-base <url>` / `--api-base=<url>`, plus the positional token. Hand-rolled
+// because this script has no arg parser and one flag does not earn a dependency.
+function parseArgs(argv) {
+  const out = { token: null, apiBase: null };
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = String(argv[i]);
+    if (a === '--api-base') { out.apiBase = argv[i + 1] === undefined ? '' : String(argv[i + 1]); i += 1; continue; }
+    if (a.startsWith('--api-base=')) { out.apiBase = a.slice('--api-base='.length); continue; }
+    if (out.token === null && !a.startsWith('-')) out.token = a;
+  }
+  return out;
+}
+
+// WHICH INSTANCE IS THIS TOKEN FOR? (task 1003722)
+//
+// The old order was env → the EXISTING session's api_base → branding default, on the
+// reasoning that a re-auth already knows which instance the builder is on. That holds
+// right up until the builder uses a SECOND instance: the stale api_base then wins over
+// the instance that actually minted the token, so the paste is verified against — and
+// written as — the wrong host. The reported symptom was a token from this instance
+// landing as a token for an unrelated one, after which every /builder-* command
+// authenticated somewhere unintended.
+//
+// A token is minted BY an instance, so the issuer is a property of the token, not of
+// the machine. The hall now stamps it into the paste command, and an explicit flag
+// outranks every inferred source: it is per-invocation, it came from the minting
+// instance, and it is the only source that is right by construction.
+//
+// Below the flag the old order is untouched, so an older instance whose paste command
+// carries no flag behaves exactly as before — and so does the founder-host regression
+// this file already guards (task 1002427: hardcoding a host here rejected a valid
+// token with a 401).
+function resolveBaseForPaste({ flag, resolve = () => ic.resolveApiBase() } = {}) {
+  const f = typeof flag === 'string' ? flag.trim() : '';
+  if (!f) return { base: resolve(), source: 'resolved' };
+  if (!/^https?:\/\/[^\s/]+/i.test(f)) return { base: null, source: 'invalid' };
+  return { base: f.replace(/\/+$/, ''), source: 'flag' };
+}
+
+const ARGS = parseArgs(process.argv.slice(2));
+const RESOLVED = resolveBaseForPaste({ flag: ARGS.apiBase });
+const API_BASE = RESOLVED.base;
 
 function usage(extra) {
   if (extra) console.error(extra);
   console.error('');
-  console.error('Usage: bongos paste-token <token>');
+  console.error('Usage: bongos paste-token <token> [--api-base <url>]');
   console.error('   (inside a core checkout: node scripts/gds/paste-token.js <token>)');
   console.error('');
-  console.error('Get a token on your Settings page: ' + API_BASE + '/builders/settings');
+  // Fall back to the inferred base for this hint when --api-base was the thing that
+  // was malformed — otherwise the error message that explains the bad flag would
+  // itself print "null/builders/settings".
+  const hintBase = API_BASE || ic.resolveApiBase();
+  console.error('Get a token on your Settings page: ' + hintBase + '/builders/settings');
   console.error('— under "CLI Access" click "Re-issue CLI token" (you must be signed in).');
   console.error('The page prints the exact paste-command — just run that line.');
 }
 
 async function main() {
-  const token = process.argv[2];
+  if (RESOLVED.source === 'invalid') {
+    usage(`--api-base must be an http(s) URL, got: ${ARGS.apiBase}`);
+    process.exit(2);
+  }
+  const token = ARGS.token;
   if (!token) {
     usage('No token argument provided.');
     process.exit(2);
@@ -138,7 +182,14 @@ async function main() {
   }
 }
 
-main().catch((err) => {
-  console.error('paste-token failed:', err && err.message ? err.message : err);
-  process.exit(1);
-});
+// Run only as a script. Exporting the two pure helpers lets the decision that caused
+// task 1003722 — WHICH instance a pasted token belongs to — be tested directly, rather
+// than inferred from a text scan of this file.
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('paste-token failed:', err && err.message ? err.message : err);
+    process.exit(1);
+  });
+}
+
+module.exports = { parseArgs, resolveBaseForPaste };

package/scripts/gds/provision-config.js

@@ -55,6 +55,9 @@ const CONFIG = {
   // <slug>.caddy file (idempotent overwrite, no fragile append to a shared file);
   // the main Caddyfile carries a one-time `import <dir>/*.caddy` (operator setup).
   caddySnippetDir: process.env.PROVISION_CADDY_SNIPPET_DIR || '/etc/caddy/sites',
+  // The base Caddyfile the running Caddy loads — read (never written) to prove it imports
+  // the snippets and carries the on-demand TLS ask (task 1002860, ADR 0303).
+  caddyfile: process.env.PROVISION_CADDYFILE || '/etc/caddy/Caddyfile',
   // Where nightly pg_dump backups land (db-backup-nightly.sh's GDS_BACKUP_DIR
   // default). Shared across co-tenant instances on one box — dumps are named
   // `<db>-<ts>.sql.gz`, so each instance's files + retention prune stay scoped to

package/scripts/gds/provision-net.js

@@ -240,6 +240,36 @@ function caddyBlock(inst) {
 function caddySnippetPath(inst, { snippetDir = CONFIG.caddySnippetDir } = {}) {
   return path.posix.join(snippetDir, `${inst.slug}.caddy`);
 }
+// Does the base Caddyfile carry what a provisioned domain needs (task 1002860, ADR 0303)?
+// Read from Caddy's RESOLVED config, not the file's text, so the answer holds whatever form
+// the operator wrote it in: an `ask` (2.7) or a `permission` module (2.8+), an absolute or
+// relative import, directives split across imported files. `requireHost` asks whether the
+// domain is served, which only a written snippet can make true. Returns the operator
+// instruction, or null when wired.
+function caddyWiringGap(adaptedJson, { domain, requireHost = false, caddyfile = CONFIG.caddyfile, snippetDir = CONFIG.caddySnippetDir } = {}) {
+  let apps;
+  try { apps = JSON.parse(adaptedJson).apps || {}; } catch (_) {
+    return `could not read Caddy's resolved config ('caddy adapt --config ${caddyfile}' printed no JSON)`;
+  }
+  const onDemand = apps.tls && apps.tls.automation && apps.tls.automation.on_demand;
+  if (!JSON.stringify(onDemand || {}).includes('/provisioning/tls-check')) {
+    return `${caddyfile} has no on_demand_tls ask for the provisioning tls-check, so no provisioned domain can get a certificate — add 'on_demand_tls { ask <platform origin>/api/bongos/provisioning/tls-check }' to its global options block and reload Caddy`;
+  }
+  if (requireHost && !JSON.stringify(apps.http || {}).includes(JSON.stringify(domain))) {
+    return `${caddyfile} does not import ${snippetDir}/*.caddy, so Caddy will never serve ${domain} — add 'import ${snippetDir}/*.caddy' at the top level of ${caddyfile} and reload Caddy`;
+  }
+  return null;
+}
+// `caddy adapt` reads config files only: no privilege, no certificate keys, no running server.
+function checkCaddyWiring(exec, opts = {}) {
+  const caddyfile = opts.caddyfile || CONFIG.caddyfile;
+  let res;
+  try { res = exec(`caddy adapt --config ${caddyfile} --adapter caddyfile`); } catch (e) {
+    const why = String((e && (e.stderr || e.message)) || e).trim().slice(0, 200);
+    return `'caddy adapt --config ${caddyfile}' failed (${why}) — the base Caddyfile must load before a site is added to it`;
+  }
+  return caddyWiringGap(res && res.stdout, { ...opts, caddyfile });
+}
 function healthzCmd(inst) {
   return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/healthz`;
 }
@@ -281,6 +311,8 @@ module.exports = {
   DNS_BLACKHOLE_IP,
   caddyBlock,
   caddySnippetPath,
+  caddyWiringGap,
+  checkCaddyWiring,
   checkDnsTokenScope,
   classifyZoneScope,
   dnsReleaseEnv,