@bongos/core 1.19.846 → 1.19.848

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.846",
-  "core_contract": "1.19.846",
-  "source_commit": "7875bef1fd719fda2b08d1c47132af0bf09470c0",
+  "core_version": "1.19.848",
+  "core_contract": "1.19.848",
+  "source_commit": "cec883a4362510c614bbf91576983ff03d6df2ce",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T19:26:58.935Z",
+  "built_at": "2026-09-17T19:52:14.256Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 495,
+    "docs_redacted": 496,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2273,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2794,
-  "tree_sha256": "0ce103dd9544b2dc4d8ad8534a617c7e83884733163303d5eb381d4d44f49cb3",
+  "file_count": 2795,
+  "tree_sha256": "31f2347b41b6fb4c9974eb45d6b3b99d10ae8827fec75f36b3f239159ecbe87c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -322,7 +322,7 @@
     {
       "path": "Dockerfile",
       "mode": "0000644",
-      "sha256": "25e2854dfdea46cda6b60268890ac1ec21ae6a35b29758257c1f8df35d16cbd6"
+      "sha256": "e0876b6353244e13917d10510d9f60f61dd85983dee9b19a5da762c574cbae4b"
     },
     {
       "path": "GOVERNANCE.md",
@@ -2009,10 +2009,15 @@
       "mode": "0000644",
       "sha256": "62ffb9c1aeeaaafd5c51767f1ffff1c67adb3563e8d55ceb81ef77511184faa4"
     },
+    {
+      "path": "docs/adr/0304-routine-reads-run-without-a-prompt-and-anything-a-flag-can-turn-into-a-write-is-exact-form.md",
+      "mode": "0000644",
+      "sha256": "104b5675fe52c1725dbbc78ab6fde9fd676b4020bf0e3f05411733c95d4342e0"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "48323e44fced698a0da997eeb16564ab3b04430c8233a8f7997c0fec2b123401"
+      "sha256": "61dd72c5f0d4157062fb93585252448e5493afd25cb014fb747bf0e20037a2ab"
     },
     {
       "path": "docs/api-reference.md",
@@ -2577,7 +2582,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d764a731750a2e1028c95a1fb94148e35ed3450b7394323d66c774959888105b"
+      "sha256": "ed51b2e95fbd3cfd4d5aed5a54aea53a9fc147ee0c7075dd4ecf9eda265ec50e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2807,7 +2812,7 @@
     {
       "path": "docs/recipes/self-host.md",
       "mode": "0000644",
-      "sha256": "2108b55f6e3264af35c2db885b5a98ff8cc9a5c5c68881d3f5ce8037db1bf159"
+      "sha256": "135f3942a01e50af87c4645f8920b25e0b779aac45cb5101b39e62cacfa59168"
     },
     {
       "path": "docs/recipes/server-bring-up.md",
@@ -7902,12 +7907,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4c1cac911818d09a26f42a791f1a2ce4a7add73cb38a8f7186ee0fd3d6425a3b"
+      "sha256": "c4a58e2d12411921c911607c5345671c595e34d7d7c8c51747d7ea5978cf21d4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d9c4e3866e590697c2a303536f799c9a7a99925295201df566d80e8c1b91f59f"
+      "sha256": "a3b15f291e7851a3578a38113485b76f54b695dca7bf97859954a26707a24c2a"
     },
     {
       "path": "public-docs/index.html",
@@ -8217,7 +8222,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "53411af3a058d5fb22029a2ae923ef259fb1a45b1e39c20fd28e004a8c4d369f"
+      "sha256": "de8dcb51a250334621b104e99f7bc5f857f4422718c3c3ed8519cd5d0ebc8739"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -8762,7 +8767,7 @@
     {
       "path": "scripts/gds/package-core.js",
       "mode": "0000644",
-      "sha256": "d9a6748c0dadbff9954809df1c83345979e1356559312723e107f19949edfd7b"
+      "sha256": "4d439440fe0fe498382c7ee6e1684637a5bcad46ae67878c0d2c98d5de6cbbdd"
     },
     {
       "path": "scripts/gds/paste-token.js",
@@ -8832,7 +8837,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "c8d4ce3004cafbd1d70ee72845700c95c85da41ced29fe059af333869a75cc03"
+      "sha256": "b04300749c4f119912ecfb2e6df4a6703f004130570e47a4e5bfaffacd7e2118"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
@@ -8847,7 +8852,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "43dd54ec69ff29ad83e631d53a65c1a2d22b89ef07181e4df14581e5199bfa61"
+      "sha256": "cbf44d415e3c5bb803e68af7b70ebfb08e7d0ab2388cc7f17a114512f29662e8"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9842,7 +9847,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7ed9c1945c4d366375bd4009c00e90dbcfb847de0fc086bcd73e4fbf33589b36"
+      "sha256": "f6dcadffbe81524b07bdc5821ae2cf1f5268eeea497354a09d0e7158673e3b85"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10407,7 +10412,7 @@
     {
       "path": "tests/box_ship_permissions.mjs",
       "mode": "0000644",
-      "sha256": "5347fc776e8edb533223534707ddc7085af21654298d9d2169d711ecc5cfce2c"
+      "sha256": "063c94d759fa8a79b8c402145801ae2a4d9863bef591fb5adf57697e15effc39"
     },
     {
       "path": "tests/box_sync.mjs",
@@ -10562,7 +10567,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "7acfe432856010881b234b258d45fcf65f976e0e711d01b823d90990a0c7179c"
+      "sha256": "42df08d261aaeb7cf94db3eef0e95b06af138d8d317b57f12dc4cb2c23d9f81a"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",
@@ -12422,7 +12427,7 @@
     {
       "path": "tests/package_core.mjs",
       "mode": "0000644",
-      "sha256": "a8278101d0de34bb8214f4c7a5a68760b5546099df27044c20d5c360fdc4442f"
+      "sha256": "7d64e3c217274af48f24557d49deeb2cb54d7929bd9e939f15b3d3ceb757336c"
     },
     {
       "path": "tests/parallel-load.mjs",
@@ -12697,7 +12702,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "5a1abd44776798ca89266f86663037086c1270aca569e54647607d4488cbfea9"
+      "sha256": "d763e2b5a10fbdd9a0e95fae493b524c7a52b437663125e3dbaf753435402e9c"
     },
     {
       "path": "tests/provision_caddy_wiring.mjs",

package/Dockerfile

@@ -15,8 +15,13 @@ FROM node:22-bookworm-slim
 
 # postgresql-client gives us `psql` for scripts/migrate.sh; bash runs it; tini
 # is a proper PID 1 so signals/zombies are handled. curl powers HEALTHCHECK.
+# git is the provisioning scaffold's only unmet tool (task 1003995): scaffoldStandaloneRepo
+# materializes a child instance's repo with `git init`/`clone` → commit → push, so without it
+# `provision.js run-intents --apply` cannot run here at all. The image still carries NO .git
+# of its own (.dockerignore excludes it by design) — that half is package-core's
+# --from-worktree rung, not an apt line.
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends postgresql-client bash tini curl ca-certificates \
+    && apt-get install -y --no-install-recommends postgresql-client bash tini curl ca-certificates git \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app

package/docs/adr/0304-routine-reads-run-without-a-prompt-and-anything-a-flag-can-turn-into-a-write-is-exact-form.md

@@ -0,0 +1,84 @@
+# ADR 0304 — Routine reads run without a prompt; anything a flag can turn into a write is exact-form
+
+**Status:** accepted · **Date:** 2026-09-17 · **Task:** [task 1003992](https://cloudbongos.com/builders#/task/1003992) (goal 1000095 — BONGOS-V2)
+
+**Related:** [ADR 0104](0104-trust-gds-api-channel-in-auto-mode.md) (the allow-list this extends — it named read wrappers as the next step) · [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (an allow-rule grants no authority) · [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (git-guard is the cooperative layer) · [ADR 0302](0302-the-third-identical-failure-stops-the-session-and-asks.md) (same investigation)
+
+## Context
+
+The shipped `.claude/settings.json` pre-allowed six commands. Much of what a session runs to look
+around — `gh pr view`, `git fetch origin`, `node scripts/gds/status.js` — stopped and asked the
+builder for permission. The 2026-09-17 investigation of a non-technical builder's stalls found
+this is a prompt they cannot evaluate: they are asked to approve a command they do not read, many
+times an hour, and the only safe answer they have is "yes". A prompt that is always answered yes
+protects nothing and teaches the builder to stop reading prompts.
+
+## Decision
+
+Pre-allow the **read-only subset**, in the core's `.claude/settings.json` and — rule for rule, in
+verb form — in the starter an instance receives (`STARTER_ALLOW`, task 1003962):
+
+- `git status` as a prefix rule.
+- `git branch` and `git fetch` as **exact forms only** (`git branch --list`, `--show-current`,
+  `-a`, `-vv`; `git fetch`, `git fetch origin`, `git fetch origin main`).
+- `gh pr view | checks | list` and `gh run view | list` as prefix rules.
+- The gds CLIs audited read-only under every flag they accept: `start`, `status`, `recall`, `me`,
+  `doctor`, `preflight`, `skill-preflight`, `ship-check`, `fitness`, `strand-watch`,
+  `stale-worktrees`, `read-session-export`. (`recall` POSTs, but to the search endpoint — a query.
+  `ship-check` and `fitness` run the repo's own checks, the same trust as the already-allowed
+  `ship.js`: a rule naming a script in the tree trusts the tree.) Audited and left out:
+  `backlog-review.js`, whose default walk POSTs promote / abandon, and `key-status.js`, whose
+  `--recheck` rewrites the local session file.
+
+**The rule behind the split.** `Bash(x:*)` is a prefix rule: it allows every flag that can follow
+`x`. So a command gets a prefix rule only when no flag turns it into a write or an exec.
+`git fetch --upload-pack=<cmd>` runs a command, `git fetch origin x:main` moves a local branch, and
+`git branch -D` deletes one — so those two subcommands are listed in the exact forms a session
+actually uses, and anything else under them still asks.
+
+**`git diff`, `git log` and `git show` get no rule at all.** The task asked for them, the first
+cut had them as prefix rules, and review caught what that did — both reproduced on this repo:
+`git log -1 --format=<text> --output=<path>` writes chosen content to any path (a
+`.git/hooks/pre-push` is code execution), and `git diff --no-index -- /dev/null <path>` prints any
+file, including the ones the `Read(...)` deny-list protects. Claude Code already runs the
+read-only forms of these commands without a prompt in every permission mode, and checks their
+flags when it does; an allow-rule is matched first and switches that check off. So for these three
+the rule bought nothing and cost the flag check. By this ADR's own test they fail it.
+
+**git-guard stays the backstop, and the lists are pinned.** A PreToolUse hook runs whether or not
+a command is pre-allowed, so git-guard still blocks its four shapes. `tests/box_ship_permissions.mjs`
+goes further: no allow-rule may *cover* a command git-guard blocks (blocked samples per guard rule;
+a new guard rule fails the suite until it has one); no allow-rule may cover a write dressed as a
+read (`--output`, `--no-index`, `--upload-pack`, a refspec); and the whole allow-list is pinned —
+every rule is a named gds script or one of the thirteen git/gh strings in the test — so
+widening it is a deliberate, reviewed edit.
+
+## Consequences
+
+- A session on a laptop or a box in auto mode reads PR and CI state, fetches, and runs the
+  read-only gds CLIs without interrupting the builder. `bypassPermissions` boxes are unaffected
+  (the rules are a no-op there).
+- An allow-rule matches the command text, not the program: it is a convenience, never a security
+  boundary. That is why the dangerous cases are handled by *not writing the rule* rather than by an
+  `ask` or `deny` pattern for `--output` — Claude Code's own docs note such argument patterns are
+  evaded by quoting (`--out''put`).
+- Rules are `Bash` only — the evidence is a hosted Linux box. `PowerShell(...)` twins are a
+  follow-up ([task 1004014](https://cloudbongos.com/builders#/task/1004014)), possible now that
+  [task 1003999](https://cloudbongos.com/builders#/task/1003999) has put that tool behind the same
+  guards; allowing first and guarding second was the wrong order.
+- An instance that already has a `.claude/settings.json` keeps its own; only a fresh starter carries
+  the new rules (the never-clobber rule of task 1003962).
+
+## Rejected
+
+- **`Bash(git:*)` or `Bash(gh:*)`.** One rule instead of thirteen, and it pre-allows `git push`,
+  `git reset --hard`, `gh pr merge` and `gh api -X DELETE`.
+- **Prefix rules for `git diff | log | show`, with `ask` rules for `--output` and `--no-index`.**
+  Evaluated in the order deny → ask → allow, so it works on the text a session normally writes — and
+  is evaded by quoting. The harness's built-in handling already covers the safe forms, so the pair
+  of rules would add a leaky guard to remove a prompt that does not exist.
+- **Prefix rules for `git fetch` / `git branch --list`.** `git branch --list -D x` is covered by the
+  prefix and blocked by git-guard — harmless in practice (git refuses the combination) but it makes
+  "nothing the guard blocks is allowed" false, and that sentence is worth keeping true.
+- **`bypassPermissions` everywhere** (task 1251's box default). It is a mode, not a list: a builder
+  who cycles modes or works from a laptop is back to prompts, and it removes the prompt for writes too.

package/docs/adr/README.md

@@ -395,3 +395,4 @@ This keeps the decision history honest and traceable.
 | 0301 | [**A red PR names its failing tests in a commit status, and says so when it cannot see** ([task 1003988](https://cloudbongos.com/builders#/task/1003988), goal 1000095). One pull request took nine red CI runs in four hours because the builder box could not learn which test failed: without Checks:read GitHub nulls every check-run node, the server dropped the holes silently, and the red PR was reported as a review-or-pending wait. Now the merge state carries checks_unreadable and a red, unreadable rollup reads failing_check_unreadable; the unit workflow posts the failing test names as a unit-report commit STATUS (readable without the permission) from a separate job that holds the only write token and checks out no PR code; the server returns it as failing_tests, reduced to test-list vocabulary because the PR controls the workflow that wrote it.](0301-a-red-pr-names-its-failing-tests-in-a-commit-status.md) | GDS / shipping pipeline |
 | 0302 | [**The third identical failure stops the session and asks** ([task 1003990](https://cloudbongos.com/builders#/task/1003990), goal 1000095). Sessions looped without noticing: one PR re-shipped into the same red check nine times, and 45 of 169 claim attempts were the same refusal retried minutes apart. A PostToolUse hook now counts walls per session — the signature is the `[otb-plain]` card's "What happened" line + the task id + the RED line, so a red check naming different failing tests each run reads as progress — and on the third identical one injects a single instruction: stop retrying, diagnose (path named), or /ask-for-help. Waiting cards ("Nothing to do…") are never counted; git-guard and worktree-guard count their own blocks through the same helper; it never blocks a tool call and echoes nothing a tool printed. Rejected: counting any repeated failing command (red→green is that), blocking the fourth attempt (a new gate, ADR 0162), server-side detection (cannot see guard blocks or speak into the session).](0302-the-third-identical-failure-stops-the-session-and-asks.md) | GDS / sessions / hooks |
 | 0303 | [**Provisioning verifies the base Caddyfile, and never edits it** ([task 1002860](https://cloudbongos.com/builders#/task/1002860), goal 1000106, from idea 1000524). The runner assumed the box's `/etc/caddy/Caddyfile` carried the `on_demand_tls` tls-check ask and `import /etc/caddy/sites/*.caddy`, and reloaded with `allowFail` — a box missing either provisioned "successfully" and the instance was unreachable. It now reads Caddy's RESOLVED config (`caddy adapt`: unprivileged, no key access, indifferent to how the directives are written) before touching the box (the ask) and after writing the snippet (the domain is served ⇒ the import reaches it), refusing with the exact line to add, and the reload is loud. Rejected: editing the base file (`on_demand_tls` must sit inside the global block an append cannot place, and a bad write takes down the control plane's own apex); `caddy validate` (loads certificate keys, needs root).](0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md) | provisioning / infra |
+| 0304 | [**Routine reads run without a prompt; anything a flag can turn into a write is exact-form** ([task 1003992](https://cloudbongos.com/builders#/task/1003992), goal 1000095). The shipped `.claude/settings.json` pre-allowed six commands, so every `gh pr view` or `git fetch` asked a non-technical builder to approve a command they cannot evaluate. The read-only subset is now pre-allowed — `git status`, `gh pr view/checks/list`, `gh run view/list` and the gds CLIs audited read-only under every flag as prefix rules; `git branch` and `git fetch` as exact forms only, because a flag turns either into a write or an exec — and the instance starter mirrors it rule for rule. `git diff/log/show` get NO rule: the harness already runs their read-only forms unprompted with a flag check, and a prefix rule switched that check off (`--output=<path>` writes anywhere, `diff --no-index` reads deny-listed files — both reproduced in review). A test pins the whole allow-list, that no rule covers a command git-guard blocks, and that no rule covers a write dressed as a read. Rejected: `Bash(git:*)`, prefix-plus-`ask` for diff/log/show (argument patterns are evaded by quoting), prefix rules for fetch/branch, `bypassPermissions` everywhere.](0304-routine-reads-run-without-a-prompt-and-anything-a-flag-can-turn-into-a-write-is-exact-form.md) | GDS / sessions / permissions |

package/docs/module-api-changelog.md

@@ -2166,5 +2166,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.844 with no explicit bump. run 35263096514. (task 1002620)
   1.19.846 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.845 with no explicit bump. run 35264882014. (task 1002620)
+  1.19.847 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.846 with no explicit bump. run 35266409194. (task 1002620)
+  1.19.848 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.847 with no explicit bump. run 35267380720. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/self-host.md

@@ -39,7 +39,7 @@ Author `config/branding.json` from the neutral starter — see [the branding con
 
 **Or scaffold it with `bongos init`** ([task #1204](https://example.com/builders#/task/1204)): a short interview (or `bongos init --from spec.json` for a hands-free / CI run) that writes both config files, **seeds your first version + its done-when goal**, and **files the human-only kickoff steps** (register a GitHub OAuth app, first owner sign-in, repo binding, admission) as real tracked tasks — so a fresh instance has a claimable queue on day one instead of an empty hall. It never invents your branding (it points you at the fill prompt for that). Preview the whole plan with `bongos init --dry-run`.
 
-**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image cannot run that today (no git in the image, systemd and a DigitalOcean token assumed; task 1002718), so on a compose self-host a new project waits indefinitely. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
+**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image now carries the tools the scaffold needs — git, and a core it can package out of its own `.git`-less checkout (task 1003995) — but the standup leg still assumes root + systemd, which a container has not got (task 1003997), so on a compose self-host a new project waits indefinitely. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
 
 ## Configuration surface
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.846",
+  "version": "1.19.848",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.846",
+      "version": "1.19.848",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.846",
+  "version": "1.19.848",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claude-materialize.js

@@ -347,6 +347,37 @@ const STARTER_ALLOW = [
   'Bash(bongos reauth:*)',
   'Bash(bongos paste-token:*)',
   'Bash(bongos exec scripts/gds/api.js:*)',
+  // The read-only subset (task 1003992, ADR 0304). `git branch` and `git fetch`
+  // are exact forms on purpose: a flag turns either into a write or an exec. No
+  // `git diff|log|show` rule, also on purpose: the harness already runs their
+  // read-only forms unprompted, and a prefix rule would switch off its flag check
+  // (`--output=<file>` writes anywhere, `diff --no-index` reads any file).
+  // tests/box_ship_permissions.mjs pins this list to the core's, rule for rule.
+  'Bash(bongos start:*)',
+  'Bash(bongos status:*)',
+  'Bash(bongos recall:*)',
+  'Bash(bongos exec scripts/gds/me.js:*)',
+  'Bash(bongos doctor:*)',
+  'Bash(bongos exec scripts/gds/preflight.js:*)',
+  'Bash(bongos exec scripts/gds/skill-preflight.js:*)',
+  'Bash(bongos exec scripts/gds/ship-check.js:*)',
+  'Bash(bongos exec scripts/gds/fitness.js:*)',
+  'Bash(bongos exec scripts/gds/strand-watch.js:*)',
+  'Bash(bongos exec scripts/gds/stale-worktrees.js:*)',
+  'Bash(bongos exec scripts/gds/read-session-export.js:*)',
+  'Bash(git status:*)',
+  'Bash(git branch --list)',
+  'Bash(git branch --show-current)',
+  'Bash(git branch -a)',
+  'Bash(git branch -vv)',
+  'Bash(git fetch)',
+  'Bash(git fetch origin)',
+  'Bash(git fetch origin main)',
+  'Bash(gh pr view:*)',
+  'Bash(gh pr checks:*)',
+  'Bash(gh pr list:*)',
+  'Bash(gh run view:*)',
+  'Bash(gh run list:*)',
 ];
 
 // The starter an instance gets when the core root carries no settings.json — a

package/scripts/gds/package-core.js

@@ -51,9 +51,22 @@
 // The manifest ALSO records tarball.sha256 to verify the exact downloaded bytes.
 //
 // USAGE:
-//   node scripts/gds/package-core.js [--ref <git-ref>] [--out-dir dist]
+//   node scripts/gds/package-core.js [--ref <git-ref> | --from-worktree] [--out-dir dist]
 //        [--version <v>] [--droplet-ip <ip>] [--self-verify [--self-verify-boot]] [--publish [--live]]
 //   Defaults: --ref HEAD, --out-dir dist, --version = platform CORE_VERSION.
+//   --from-worktree  build from the files ON DISK instead of a commit, for a core checkout
+//                    that carries no git history — which is exactly what the shipped
+//                    self-host image is (.dockerignore excludes .git by design), and the
+//                    only way the provisioning scaffold inside it can vendor a core into a
+//                    child instance (task 1003995). Selection is unchanged (isPublishable);
+//                    the artifact simply has no commit to anchor to, so source_commit is null
+//                    and the tree_sha256 pin is the whole lineage. It packages what is ON DISK,
+//                    which in the image is exactly what `COPY . .` put there — so on a DEV
+//                    checkout prefer the ref build: measured on this repo the two select an
+//                    IDENTICAL 2793-file set, but a Windows working tree hands back CRLF where
+//                    the blob is LF, which changes every text file's hash and would ship a
+//                    CRLF shebang. That is why rung 4 in provision-repo.js is reached only
+//                    when there is no history to build from.
 //   --self-verify    after building, prove the artifact reproduces its pin (unpack the .tgz,
 //                    recompute tree_sha256 == manifest + verify tarball.sha256). Fatal on mismatch.
 //                    (task 1002218 / audit H3) — deterministic + network-free.
@@ -85,7 +98,7 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
 // Reuse — never re-type. The core definition, the redaction, and the tree parser
 // all already exist and are unit-tested at their homes.
-const { isPublishable } = require(path.join(REPO_ROOT, 'scripts/gds/publish-manifest.js'));
+const { isPublishable, PUBLISH_ALLOWLIST } = require(path.join(REPO_ROOT, 'scripts/gds/publish-manifest.js'));
 const {
   buildRedactionRules, collectSensitiveLiterals, findLeaks,
 } = require(path.join(REPO_ROOT, 'scripts/gds/mirror-redact.js'));
@@ -544,6 +557,47 @@ function buildTar(entries) {
   return zlib.gzipSync(tar, { level: 9 });
 }
 
+// ---- the git-LESS source: enumerate the working tree (task 1003995) --------
+//
+// Everything below the enumeration step is already git-free, so the ONE thing that
+// makes package-core unrunnable without history is `git ls-tree`. That matters because
+// the shipped self-host image IS a core checkout with no `.git` (.dockerignore excludes
+// it by design), and the provisioning scaffold inside it has no other way to build the
+// tarball it vendors into a child instance — the fourth rung of the ladder in
+// scripts/gds/provision-repo.js.
+//
+// The walk starts at PUBLISH_ALLOWLIST's own entries rather than the repo root. The
+// allowlist is already the single source of truth for what the core is, so starting
+// there means node_modules/ and dist/ are never descended into at all. Selection still
+// runs through isPublishable() in main(), so the denylist applies exactly as it does on
+// the git path — this function only decides what is OFFERED, never what is kept.
+//
+// Rows match parseLsTree's shape ({ path, type, mode }) minus `sha`: there is no object
+// to name, so main() reads these blobs off disk instead. Mode is derived the way git
+// derives it — the executable bit and nothing else. fs injectable for tests.
+function walkWorktreeEntries(root, { allow = PUBLISH_ALLOWLIST, fsImpl = fs } = {}) {
+  const out = [];
+  const addFile = (rel) => {
+    let st;
+    try { st = fsImpl.statSync(path.join(root, rel)); } catch { return; }   // absent here → simply not in the core set
+    if (st.isFile()) out.push({ path: rel, type: 'blob', mode: (st.mode & 0o111) ? '100755' : '100644' });
+  };
+  const walk = (rel) => {
+    let children;
+    try { children = fsImpl.readdirSync(path.join(root, rel), { withFileTypes: true }); } catch { return; }
+    for (const child of children) {
+      const childRel = `${rel}/${child.name}`;
+      if (child.isDirectory()) walk(childRel);
+      else if (child.isFile()) addFile(childRel);
+    }
+  };
+  for (const entry of allow) {
+    if (entry.endsWith('/')) walk(entry.replace(/\/$/, ''));
+    else addFile(entry);
+  }
+  return out.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+}
+
 // ---- git plumbing (impure) ------------------------------------------------
 function git(args) {
   return execFileSync('git', ['-C', REPO_ROOT, ...args], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
@@ -773,16 +827,22 @@ function selfVerify({ tgzPath, sidecar, outDir, boot }) {
 }
 
 function main() {
-  const ref = arg('--ref', 'HEAD');
+  // --from-worktree: build from the files on disk instead of a commit (task 1003995).
+  // The lineage anchor of such a build is the tree hash alone — there is no commit to
+  // name — so source_commit is null and source_ref says where it came from.
+  const fromWorktree = process.argv.includes('--from-worktree');
+  const ref = fromWorktree ? '(worktree)' : arg('--ref', 'HEAD');
   const outDir = path.resolve(REPO_ROOT, arg('--out-dir', 'dist'));
   const version = arg('--version', coreVersion());
   const contract = coreVersion();
   const dropletIp = arg('--droplet-ip', process.env.DROPLET_IP || null);
 
   // 1. Resolve the source ref → commit SHA (the lineage anchor of this artifact).
-  let sha;
-  try { sha = git(['rev-parse', ref]).trim(); }
-  catch (e) { console.error(`refusing: could not resolve --ref "${ref}": ${e.message}`); process.exit(2); }
+  let sha = null;
+  if (!fromWorktree) {
+    try { sha = git(['rev-parse', ref]).trim(); }
+    catch (e) { console.error(`refusing: could not resolve --ref "${ref}": ${e.message}`); process.exit(2); }
+  }
 
   // 2. Enumerate + partition the tree through the manifest (single source of truth).
   //    package.json/package-lock.json are SYNTHESIZED (task 1882, ADR 0108 §2) —
@@ -790,7 +850,12 @@ function main() {
   //    ships them verbatim), but the core package needs its OWN identity + a pruned
   //    dependency set, not the game's. Pulled out of the generic per-file loop below.
   const SYNTHESIZED_PATHS = new Set(['package.json', 'package-lock.json']);
-  const entries = parseLsTree(git(['ls-tree', '-r', sha])).filter((e) => e.type === 'blob');
+  const entries = fromWorktree
+    ? walkWorktreeEntries(REPO_ROOT)
+    : parseLsTree(git(['ls-tree', '-r', sha])).filter((e) => e.type === 'blob');
+  // A blob is named by its git object on the ref path and by its own path on the
+  // worktree path; everything downstream just wants the bytes.
+  const readBlob = (e) => (fromWorktree ? fs.readFileSync(path.join(REPO_ROOT, e.path)) : gitBuf(['cat-file', 'blob', e.sha]));
   const selected = entries.filter((e) => isPublishable(e.path) && !SYNTHESIZED_PATHS.has(e.path));
   // Drop npm-never-installed files (.gitignore, .npmignore, .npmrc) so the manifest +
   // tree_sha256 pin describe exactly what `npm install` materializes — otherwise the
@@ -798,7 +863,10 @@ function main() {
   // auto-rolls-back (idea 1000543). Done here, so they never reach the tarball or the pin.
   const npmStripped = selected.filter((e) => isNpmStripped(e.path));
   const publishable = selected.filter((e) => !isNpmStripped(e.path));
-  console.error(`[package-core] ${ref} = ${sha.slice(0, 12)} — ${entries.length} files, ${publishable.length} in the core (+2 synthesized), ${entries.length - publishable.length - 2} excluded.`);
+  // The worktree walk is already allowlist-scoped and never offers the two synthesized
+  // paths, so only the ref path discounts them from what it enumerated.
+  const excludedCount = entries.length - selected.length - (fromWorktree ? 0 : SYNTHESIZED_PATHS.size);
+  console.error(`[package-core] ${ref}${sha ? ` = ${sha.slice(0, 12)}` : ''} — ${entries.length} files, ${publishable.length} in the core (+2 synthesized), ${excludedCount} excluded.`);
   if (npmStripped.length) {
     console.error(`[package-core] dropped ${npmStripped.length} npm-never-installed file(s) from the pin (npm strips these on install; idea 1000543): ${npmStripped.map((e) => e.path).join(', ')}`);
   }
@@ -811,14 +879,24 @@ function main() {
   //     SOURCE files at this ref (never the live working tree, so --ref stays
   //     reproducible) — express+pg only, name @bongos/core, version = the
   //     platform version being packaged.
-  const pkgJsonBlob = entries.find((e) => e.path === 'package.json');
-  const pkgLockBlob = entries.find((e) => e.path === 'package-lock.json');
-  if (!pkgJsonBlob || !pkgLockBlob) {
-    console.error('refusing: source package.json/package-lock.json not found at this ref — cannot synthesize the core package.');
+  //     On the worktree path there is no ref to stay reproducible against, so the two
+  //     files come off disk beside everything else in the build.
+  const sourceRootFile = (rel) => {
+    if (fromWorktree) {
+      const abs = path.join(REPO_ROOT, rel);
+      return fs.existsSync(abs) ? fs.readFileSync(abs) : null;
+    }
+    const blob = entries.find((e) => e.path === rel);
+    return blob ? gitBuf(['cat-file', 'blob', blob.sha]) : null;
+  };
+  const pkgJsonRaw = sourceRootFile('package.json');
+  const pkgLockRaw = sourceRootFile('package-lock.json');
+  if (!pkgJsonRaw || !pkgLockRaw) {
+    console.error(`refusing: source package.json/package-lock.json not found at ${fromWorktree ? 'the repo root' : 'this ref'} — cannot synthesize the core package.`);
     process.exit(1);
   }
-  const sourcePkgJson = JSON.parse(gitBuf(['cat-file', 'blob', pkgJsonBlob.sha]).toString('utf8'));
-  const sourcePkgLock = JSON.parse(gitBuf(['cat-file', 'blob', pkgLockBlob.sha]).toString('utf8'));
+  const sourcePkgJson = JSON.parse(pkgJsonRaw.toString('utf8'));
+  const sourcePkgLock = JSON.parse(pkgLockRaw.toString('utf8'));
   const corePkgJson = buildPackageJson({ version, sourceDeps: sourcePkgJson.dependencies, sourceOverrides: sourcePkgJson.overrides });
   const corePkgLock = prunePackageLock(sourcePkgLock, {
     name: corePkgJson.name, version, rootRanges: { express: corePkgJson.dependencies.express, pg: corePkgJson.dependencies.pg },
@@ -865,7 +943,7 @@ function main() {
   let stubCount = 0; // agent docs (CLAUDE.md/AGENTS.md) replaced with the brand-free stub (task 2121)
   for (const e of publishable) {
     let raw;
-    try { raw = gitBuf(['cat-file', 'blob', e.sha]); }
+    try { raw = readBlob(e); }
     catch (err) { leaks.push({ path: e.path, label: `read-failed:${err.message}` }); continue; }
     const { buf, leaks: fileLeaks, advisories: fileAdvisories, kind } =
       processCoreFile({ pathRel: e.path, raw, rules, sensitiveLiterals, envSecrets, knownDocNames });
@@ -955,7 +1033,7 @@ function main() {
 
   console.error('');
   console.error(`[package-core] Cloud Bongos core v${version} packaged (contract ^${contract}).`);
-  console.error(`  source_commit  ${sha}`);
+  console.error(`  source_commit  ${sha || '(none — built from the working tree)'}`);
   console.error(`  file_count     ${filesMeta.length}`);
   console.error(`  tree_sha256    ${treeHash}`);
   console.error(`  tarball        ${path.relative(REPO_ROOT, tgzPath)}  (${(tgz.length / 1024).toFixed(1)} KiB, sha256 ${sidecar.tarball.sha256.slice(0, 12)}…)`);
@@ -1059,6 +1137,8 @@ module.exports = {
   leakScanVerdict,
   // task 1002217 (audit H4) — the fixed neutral floor injected into the doc-redaction + fail-closed gate
   PRIOR_INSTANCE_FLOOR,
+  // task 1003995 — --from-worktree's enumerator, for a core checkout with no git history
+  walkWorktreeEntries,
 };
 
 if (require.main === module) main();

package/scripts/gds/provision-repo.js

@@ -399,7 +399,17 @@ function installedCorePackDir({ instanceRoot, fsImpl = fs } = {}) {
   return null;
 }
 
-// Resolve a vendorable @bongos/core tarball — the three-rung ladder, freshest-correct
+// Can package-core.js enumerate this checkout from GIT? It builds the core set from
+// `git ls-tree` at a ref, so a checkout with no `.git` aborts at `git rev-parse HEAD` —
+// and that is not a broken install, it is the SHIPPED SELF-HOST IMAGE: .dockerignore
+// excludes .git by design, so /app is a complete core source tree with no history
+// (task 1003995). The presence of `.git` — a directory in a clone, a file in a linked
+// worktree — is the whole question. fs injectable for tests; read-only → dry-run safe.
+function coreCheckoutHasGit({ repoRoot = REPO_ROOT, fsImpl = fs } = {}) {
+  return fsImpl.existsSync(path.join(repoRoot, '.git'));
+}
+
+// Resolve a vendorable @bongos/core tarball — the four-rung ladder, freshest-correct
 // first, shared by the fresh scaffold and the re-provision pin refresh (task 1003050):
 //   1. a `file:`-pinned control plane reuses its own pinned tarball (task 1002275 —
 //      rebuilding via package-core.js aborts with an EMPTY core set when this runner
@@ -408,31 +418,37 @@ function installedCorePackDir({ instanceRoot, fsImpl = fs } = {}) {
 //      it has INSTALLED — the child pins the SAME, CURRENT core the hub runs, ending
 //      the frozen-old-tarball births (task 1002706, gap 13) without requiring the
 //      child's owner to hold a token for the still-private registry package;
-//   3. a genuine core source checkout rebuilds fresh via package-core.js.
+//   3. a genuine core source checkout rebuilds fresh via package-core.js;
+//   4. a core checkout with NO git history — the self-host image — packs its working
+//      tree via package-core.js --from-worktree (task 1003995). LAST because it is the
+//      only rung with no commit to anchor the artifact to: whenever history is there,
+//      rung 3's reproducible build is the better answer for the identical file set.
 // Returns { tgz, packDest } — packDest (set only on rung 2) is a temp dir the CALLER
 // must `rm -rf` once the tarball has been vendored.
-function resolveVendorableCoreTarball({ instanceRoot, exec, log, coreV, tag = '[core]' }) {
-  let tgz = installedCoreTarball({ instanceRoot });
-  let packDest = null;
-  if (tgz) {
-    log(`  ${tag} reusing the pinned core tarball this control plane runs (${path.basename(tgz)}) — no source rebuild (task 1002275)`);
+function resolveVendorableCoreTarball({ instanceRoot, repoRoot = REPO_ROOT, exec, log, coreV, tag = '[core]' }) {
+  const pinned = installedCoreTarball({ instanceRoot });
+  if (pinned) {
+    log(`  ${tag} reusing the pinned core tarball this control plane runs (${path.basename(pinned)}) — no source rebuild (task 1002275)`);
+    return { tgz: pinned, packDest: null };
+  }
+  const packSrc = installedCorePackDir({ instanceRoot });
+  if (packSrc) {
+    // Keyed by VERSION, not slug: no request-derived value enters this command, and
+    // two concurrent scaffolds of the same core pack identical bytes — collision-safe.
+    const packDest = path.join(os.tmpdir(), `bongos-core-pack-${packSrc.version}`);
+    log(`  ${tag} packing the registry-installed core this control plane runs (v${packSrc.version}) — no source rebuild (task 1002706)`);
+    exec(`mkdir -p ${packDest}`);
+    exec(`npm pack ${packSrc.dir} --pack-destination ${packDest}`);
+    return { tgz: path.join(packDest, packSrc.tarballName), packDest };
+  }
+  if (coreCheckoutHasGit({ repoRoot })) {
+    log(`  ${tag} building a fresh vendored tarball from source (package-core.js)`);
+    exec(`node scripts/gds/package-core.js`);                      // cwd = REPO_ROOT → dist/bongos-core-<v>.tgz
   } else {
-    const packSrc = installedCorePackDir({ instanceRoot });
-    if (packSrc) {
-      // Keyed by VERSION, not slug: no request-derived value enters this command, and
-      // two concurrent scaffolds of the same core pack identical bytes — collision-safe.
-      packDest = path.join(os.tmpdir(), `bongos-core-pack-${packSrc.version}`);
-      log(`  ${tag} packing the registry-installed core this control plane runs (v${packSrc.version}) — no source rebuild (task 1002706)`);
-      exec(`mkdir -p ${packDest}`);
-      exec(`npm pack ${packSrc.dir} --pack-destination ${packDest}`);
-      tgz = path.join(packDest, packSrc.tarballName);
-    } else {
-      log(`  ${tag} building a fresh vendored tarball from source (package-core.js)`);
-      exec(`node scripts/gds/package-core.js`);                    // cwd = REPO_ROOT → dist/bongos-core-<v>.tgz
-      tgz = path.join(REPO_ROOT, 'dist', `bongos-core-${coreV}.tgz`);
-    }
+    log(`  ${tag} this checkout IS the core and carries no git history — packing the working tree (package-core.js --from-worktree, task 1003995)`);
+    exec(`node scripts/gds/package-core.js --from-worktree`);
   }
-  return { tgz, packDest };
+  return { tgz: path.join(repoRoot, 'dist', `bongos-core-${coreV}.tgz`), packDest: null };
 }
 
 // The onboard mode a provisioning row carries (migration provisioning_004, task 1002562).
@@ -633,7 +649,7 @@ async function scaffoldStandaloneRepo(inst, deps) {
     const spec = instanceInitSpec(inst, { ownerLogin });
     const specPath = path.join(os.tmpdir(), `bongos-init-${inst.slug}.json`);
     writeFile(specPath, JSON.stringify(spec, null, 2));
-    // Vendored tarball — resolveVendorableCoreTarball's three-rung ladder (shared
+    // Vendored tarball — resolveVendorableCoreTarball's four-rung ladder (shared
     // with the re-provision pin refresh, task 1003050).
     const { tgz, packDest } = resolveVendorableCoreTarball({
       instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[scaffold] core install:',
@@ -1007,6 +1023,7 @@ module.exports = {
   ownerLoginOf,
   asPostgres,
   buildCorePinRefreshCommit,
+  coreCheckoutHasGit,
   dbCreateCmd,
   dbName,
   dbRoleCmd,

package/scripts/gds/provision.js

@@ -50,7 +50,7 @@ const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
-const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
+const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
@@ -1457,6 +1457,8 @@ module.exports = {
   parseTargetRef, instanceRepoRemote, instanceInitSpec, installedCoreTarball, installedCorePackDir, scaffoldStandaloneRepo, coreVersionSafe,
   // re-provision core-pin refresh (gap-list W3, task 1003050)
   resolveVendorableCoreTarball, planCorePinRefresh, safeVersionLabel, buildCorePinRefreshCommit, refreshStandaloneCorePin,
+  // the git-less core checkout — the self-host image's rung (task 1003995)
+  coreCheckoutHasGit,
   // adopt vs greenfield onboarding (ADR 0121, task 1002562)
   onboardMode, alreadyScaffolded,
   // private-repo deploy key (ADR 0176, task 1002735)

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.846'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.848'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_ship_permissions.mjs

@@ -12,11 +12,15 @@ import { strict as assert } from 'node:assert';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { skipUnlessPresent } from './helpers.mjs';
+import { createRequire } from 'node:module';
+import { skipUnlessPresent, requireHostModule } from './helpers.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const settingsPath = path.join(__dirname, '..', '.claude', 'settings.json');
 skipUnlessPresent('.claude/settings.json');
+const require = createRequire(import.meta.url);
+const guard = requireHostModule(require, '../.claude/hooks/git-guard.js');
+const { STARTER_ALLOW, bongosify } = require('../scripts/gds/claude-materialize.js');
 
 let passed = 0, failed = 0;
 function test(name, fn) {
@@ -68,6 +72,131 @@ test('every allow-rule points at a script that actually exists (no inert rules)'
   }
 });
 
+// ---------------------------------------------------------------------------
+// task 1003992 — the read-only subset (ADR 0304). A non-technical builder was
+// interrupted for every `gh pr view` and `git fetch`; those are now pre-allowed.
+// An allow-rule skips the prompt, so the list must never reach a command
+// git-guard blocks, and must stay read-only.
+// ---------------------------------------------------------------------------
+
+// How Claude Code reads a Bash rule: `Bash(x:*)` covers x and anything starting
+// "x "; `Bash(x)` covers exactly x. A chained command is covered only when every
+// part is, so `git status && git stash` is not covered by a `git status` rule.
+function ruleCovers(rule, part) {
+  const m = rule.match(/^Bash\((.*?)(:\*)?\)$/);
+  if (!m) return false;
+  return part === m[1] || (Boolean(m[2]) && part.startsWith(`${m[1]} `));
+}
+function allowCovers(allow, command) {
+  const parts = command.split(/&&|\|\||[;|&\n]/).map((s) => s.trim()).filter(Boolean);
+  return parts.every((part) => allow.some((rule) => ruleCovers(rule, part)));
+}
+const isBlocked = (command) => guard.decide({ tool_name: 'Bash', tool_input: { command } }, {}).block;
+
+// At least one sample per git-guard rule, keyed by the rule's own name.
+const BLOCKED_SAMPLES = {
+  'git stash': ['git stash', 'git stash pop', 'git stash push -m wip', 'git status && git stash'],
+  'git worktree remove': ['git worktree remove ../wt', 'git worktree remove --force ../wt'],
+  'git push origin main': ['git push origin main', 'git push -u origin HEAD:main', 'git push --force origin task-1:main'],
+  'git branch -D': ['git branch -D task-1', 'git branch --list -D task-1', 'git branch -a -D task-1'],
+};
+
+test('every git-guard rule has blocked samples here (a new rule forces a new sample)', () => {
+  for (const [name] of guard.RULES) {
+    assert.ok((BLOCKED_SAMPLES[name] || []).length, `no blocked sample for git-guard rule "${name}"`);
+  }
+  for (const samples of Object.values(BLOCKED_SAMPLES)) {
+    for (const cmd of samples) assert.ok(isBlocked(cmd), `sample is not actually blocked by git-guard: ${cmd}`);
+  }
+});
+
+test('no allow-rule covers a command git-guard blocks', () => {
+  const allow = settings.permissions.allow;
+  for (const rule of allow) {
+    const text = rule.replace(/^Bash\(/, '').replace(/(:\*)?\)$/, '');
+    assert.ok(!isBlocked(text), `allow-rule is itself a git-guard-blocked command: ${rule}`);
+  }
+  for (const cmd of Object.values(BLOCKED_SAMPLES).flat()) {
+    assert.ok(!allowCovers(allow, cmd), `an allow-rule covers a git-guard-blocked command: ${cmd}`);
+  }
+});
+
+test('the check has teeth: a too-broad git rule IS caught', () => {
+  const samples = Object.values(BLOCKED_SAMPLES).flat();
+  for (const broad of ['Bash(git:*)', 'Bash(git stash:*)', 'Bash(git worktree:*)', 'Bash(git push:*)', 'Bash(git branch:*)', 'Bash(git branch --list:*)']) {
+    assert.ok(samples.some((cmd) => allowCovers([broad], cmd)), `${broad} should cover a blocked sample`);
+  }
+});
+
+// The whole git/gh allow-list, pinned. A flag can turn a read into a write or an
+// exec (`git fetch --upload-pack=<cmd>`, `git fetch origin x:main`, `git branch -D`),
+// so `branch` and `fetch` appear only as the exact commands a session runs.
+//
+// NO `git diff|log|show` rule, on purpose. Claude Code already runs their read-only
+// forms without a prompt in every mode and checks their flags; a prefix rule would
+// switch that check off (see WRITES_DRESSED_AS_READS below — both were reproduced).
+const GIT_GH_RULES = [
+  'Bash(git status:*)',
+  'Bash(git branch --list)', 'Bash(git branch --show-current)', 'Bash(git branch -a)', 'Bash(git branch -vv)',
+  'Bash(git fetch)', 'Bash(git fetch origin)', 'Bash(git fetch origin main)',
+  'Bash(gh pr view:*)', 'Bash(gh pr checks:*)', 'Bash(gh pr list:*)', 'Bash(gh run view:*)', 'Bash(gh run list:*)',
+];
+// gds CLIs audited read-only under EVERY flag they take — a prefix rule allows them all.
+// Audited and left OUT: backlog-review.js (POSTs from its default walk) and
+// key-status.js (`--recheck` rewrites the local session file).
+const READ_ONLY_CLIS = ['start', 'status', 'recall', 'me', 'doctor', 'preflight', 'skill-preflight',
+  'ship-check', 'fitness', 'strand-watch', 'stale-worktrees', 'read-session-export'];
+const BLESSED_WRITERS = ['ship', 'claim', 'reauth', 'release', 'paste-token', 'api']; // tasks 1051 / 1716
+
+const SCRIPT_RULE = /^Bash\(node scripts\/gds\/([a-z-]+)\.js:\*\)$/;
+
+test('every allow-rule that is not a gds script is in the pinned git/gh set (adding one is a deliberate edit here)', () => {
+  // Catches `Bash(gh:*)`, `Bash(gh *)`, `Bash(git -C x status:*)`, a bare `Bash` — anything unlisted.
+  const rest = settings.permissions.allow.filter((rule) => !SCRIPT_RULE.test(rule));
+  assert.deepEqual([...rest].sort(), [...GIT_GH_RULES].sort());
+});
+
+// "Read" commands whose flags write a file, read one the Read deny-list protects,
+// run a command, or move a branch. None may ever run without a prompt.
+const WRITES_DRESSED_AS_READS = [
+  "git log -1 --format='#!/bin/sh' --output=.git/hooks/pre-push",
+  'git show --output=/tmp/x HEAD',
+  'git diff --output=/tmp/x',
+  'git diff --no-index -- /dev/null .env',
+  'git fetch --upload-pack=./x origin',
+  'git fetch origin task-1:main',
+];
+
+test('no allow-rule lets a write dressed as a read through (--output, --no-index, --upload-pack, a refspec)', () => {
+  for (const cmd of WRITES_DRESSED_AS_READS) {
+    assert.ok(!allowCovers(settings.permissions.allow, cmd), `runs without a prompt: ${cmd}`);
+  }
+  // Teeth: the prefix rules this list deliberately does NOT carry would let them through.
+  const tempting = ['Bash(git log:*)', 'Bash(git show:*)', 'Bash(git diff:*)', 'Bash(git fetch:*)'];
+  for (const cmd of WRITES_DRESSED_AS_READS) assert.ok(allowCovers(tempting, cmd), `teeth: ${cmd}`);
+});
+
+test('every gds-script allow-rule is a blessed writer or an audited read-only CLI', () => {
+  const known = new Set([...BLESSED_WRITERS, ...READ_ONLY_CLIS]);
+  for (const rule of settings.permissions.allow) {
+    const m = rule.match(SCRIPT_RULE);
+    if (m) assert.ok(known.has(m[1]), `${m[1]}.js is pre-allowed but not audited here — a prefix rule allows every flag it takes`);
+  }
+});
+
+test('the read-only subset is pre-allowed', () => {
+  const allow = settings.permissions.allow;
+  for (const cmd of ['git status', 'git status --short', 'git branch --list', 'git fetch origin',
+    'gh pr view 922', 'gh pr checks 922', 'gh pr list', 'gh run view 1 --log-failed', 'gh run list --limit 5',
+    ...READ_ONLY_CLIS.map((s) => `node scripts/gds/${s}.js`)]) {
+    assert.ok(allowCovers(allow, cmd), `should run without a prompt: ${cmd}`);
+  }
+});
+
+test('the instance starter mirrors this list in verb form (claude-materialize.js STARTER_ALLOW)', () => {
+  assert.deepEqual([...STARTER_ALLOW].sort(), settings.permissions.allow.map((rule) => bongosify(rule)).sort());
+});
+
 console.log('');
 console.log(`box_ship_permissions: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/claude_materialize.mjs

@@ -729,6 +729,7 @@ t('every allow-rule names a verb the CLI actually registers', () => {
   // is silently inert — it looks like a permission and grants nothing, so the
   // builder still meets the classifier and nobody can see why.
   for (const rule of m.STARTER_ALLOW) {
+    if (!rule.startsWith('Bash(bongos ')) continue; // the git/gh reads (task 1003992) name no verb
     const inner = rule.replace(/^Bash\(/, '').replace(/:\*\)$/, '');
     const verb = inner.split(' ')[1];
     assert.ok(cliVerbs[verb], `allow-rule "${rule}" names "${verb}", which is not a registered bongos verb`);

package/tests/package_core.mjs

@@ -42,8 +42,11 @@ const {
   scanArtifactForLeaks, PRIOR_INSTANCE_LITERALS,
   // task 1002217 (audit H4) — the fixed neutral floor
   PRIOR_INSTANCE_FLOOR,
+  // task 1003995 — --from-worktree's enumerator, for a core checkout with no git history
+  walkWorktreeEntries,
 } = m;
 const { buildRedactionRules, collectSensitiveLiterals, redactText, findLeaks } = require('../scripts/gds/mirror-redact.js');
+const { isPublishable } = require('../scripts/gds/publish-manifest.js');
 
 // A synthetic instance brand for the classification tests (never the real OTB literals).
 const TEST_BRANDING = {
@@ -747,5 +750,67 @@ t('idea 1000543 (the fix): the isNpmStripped filter makes the pin reproduce agai
   } finally { rmSync(root, { recursive: true, force: true }); }
 });
 
+// ── --from-worktree: the git-less enumeration (task 1003995) ─────────────────────
+// package-core builds the core set from `git ls-tree`, so a core checkout with no .git —
+// the shipped self-host image, where .dockerignore excludes it by design — cannot build
+// the tarball its provisioning scaffold vendors into a child instance. walkWorktreeEntries
+// is the replacement source. It decides only what is OFFERED; isPublishable still decides
+// what is KEPT, so the core set stays defined in exactly one place.
+function worktreeFixture() {
+  const root = mkdtempSync(join(tmpdir(), 'wt-core-'));
+  const put = (rel, body = 'x') => {
+    mkdirSync(join(root, dirname(rel)), { recursive: true });
+    writeFileSync(join(root, rel), body);
+  };
+  put('src/module-api.js');
+  put('src/bongos/tasks.js');                       // nested, to prove the walk recurses
+  put('scripts/gds/package-core.js');
+  put('CLAUDE.md');                                  // an allowlisted FILE entry, not a subtree
+  put('node_modules/@bongos/core/index.js');         // huge + never core: must never be descended
+  put('dist/bongos-core-1.0.0.tgz');                 // this tool's own output
+  put('config/branding.json');                       // instance identity: outside every allowlist root
+  return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) };
+}
+
+t('walkWorktreeEntries: offers the allowlisted tree and never descends node_modules/ or dist/', () => {
+  const { root, cleanup } = worktreeFixture();
+  try {
+    const paths = walkWorktreeEntries(root).map((e) => e.path);
+    assert.deepEqual(
+      paths,
+      ['CLAUDE.md', 'scripts/gds/package-core.js', 'src/bongos/tasks.js', 'src/module-api.js'],
+      `unexpected set: ${paths.join(', ')}`,
+    );
+    assert.ok(!paths.some((p) => p.startsWith('node_modules/')), 'node_modules is never walked');
+    assert.ok(!paths.some((p) => p.startsWith('dist/')), 'the packager never re-enumerates its own output');
+    assert.ok(!paths.includes('config/branding.json'), 'instance identity is outside every allowlist root');
+  } finally { cleanup(); }
+});
+
+t('walkWorktreeEntries: rows match the git-tree shape — sorted blobs carrying a mode', () => {
+  const { root, cleanup } = worktreeFixture();
+  try {
+    const entries = walkWorktreeEntries(root);
+    assert.deepEqual([...entries].sort((a, b) => (a.path < b.path ? -1 : 1)), entries, 'sorted, so the pin is stable');
+    for (const e of entries) {
+      assert.equal(e.type, 'blob', 'only files, matching the ls-tree filter main() applies');
+      assert.ok(['100644', '100755'].includes(e.mode), `mode must be a git file mode, got ${e.mode}`);
+    }
+  } finally { cleanup(); }
+});
+
+t('walkWorktreeEntries: a DENIED path inside an allowlisted subtree is still offered — the denylist is main()’s job, not the walk’s', () => {
+  const { root, cleanup } = worktreeFixture();
+  try {
+    // A host-feature script lives under the allowlisted scripts/ root and is denied by name.
+    // If the walk pre-filtered it, the two enumeration paths would be applying different rules.
+    const denied = 'scripts/gds/art-stage.js';
+    writeFileSync(join(root, denied), 'x');
+    const offered = walkWorktreeEntries(root).map((e) => e.path);
+    assert.ok(offered.includes(denied), 'the walk offers it…');
+    assert.equal(isPublishable(denied), false, '…and isPublishable is what drops it');
+  } finally { cleanup(); }
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/provision.mjs

@@ -816,6 +816,78 @@ t('installedCorePackDir: a registry-pinned consumer with an installed core → i
   [reg, filePinned, uninstalled, bare2, alt2].forEach((d) => rmSync(d, { recursive: true, force: true }));
 });
 
+// ── the git-less core checkout: rung 4 (task 1003995) ────────────────────────────
+// The shipped self-host image is a complete core source tree with NO .git (.dockerignore
+// excludes it by design), so package-core.js's `git ls-tree` enumeration has nothing to
+// read and the scaffold inside the container could never build the tarball it vendors
+// into a child. Rung 4 packs the working tree instead.
+t('coreCheckoutHasGit: a clone (.git dir) and a linked worktree (.git file) both have history; the image does not', () => {
+  const clone = mkdtempSync(join(tmpdir(), 'cchg-clone-'));
+  mkdirSync(join(clone, '.git'));
+  assert.equal(P.coreCheckoutHasGit({ repoRoot: clone }), true, 'a clone carries a .git DIRECTORY');
+
+  // A linked worktree's .git is a FILE pointing at the real gitdir — every claim in this
+  // project is worked in one, so treating it as history-less would take the wrong rung on
+  // the machine that runs these tests.
+  const wt = mkdtempSync(join(tmpdir(), 'cchg-worktree-'));
+  writeFileSync(join(wt, '.git'), 'gitdir: /somewhere/.git/worktrees/task-1\n');
+  assert.equal(P.coreCheckoutHasGit({ repoRoot: wt }), true, 'a linked worktree carries a .git FILE');
+
+  const image = mkdtempSync(join(tmpdir(), 'cchg-image-'));
+  assert.equal(P.coreCheckoutHasGit({ repoRoot: image }), false, 'the self-host image has no .git at all');
+
+  [clone, wt, image].forEach((d) => rmSync(d, { recursive: true, force: true }));
+});
+
+t('resolveVendorableCoreTarball: the ladder picks file: pin → registry pack → git source → worktree, in that order', () => {
+  // One helper per rung so the ONLY thing varying between cases is which shape the
+  // control-plane root presents. Asserting on the recorded commands is what proves the
+  // ORDER: a rung that fires early leaves the later rung's command unrun.
+  const run = (instanceRoot, repoRoot) => {
+    const cmds = [];
+    const res = P.resolveVendorableCoreTarball({
+      instanceRoot, repoRoot, exec: (c) => { cmds.push(c); }, log: () => {}, coreV: '9.9.9',
+    });
+    return { cmds, ...res };
+  };
+  const gitRoot = mkdtempSync(join(tmpdir(), 'rvct-git-'));
+  mkdirSync(join(gitRoot, '.git'));
+  const bareRoot = mkdtempSync(join(tmpdir(), 'rvct-bare-'));   // no .git → the image shape
+
+  // Rung 1 — a file: pin wins even from a git-less root: nothing is rebuilt at all.
+  const filePinned = mkdtempSync(join(tmpdir(), 'rvct-file-'));
+  mkdirSync(join(filePinned, 'vendor'));
+  writeFileSync(join(filePinned, 'vendor', 'bongos-core-1.2.3.tgz'), 'x');
+  writeFileSync(join(filePinned, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': 'file:vendor/bongos-core-1.2.3.tgz' } }));
+  const r1 = run(filePinned, bareRoot);
+  assert.equal(r1.tgz, join(filePinned, 'vendor', 'bongos-core-1.2.3.tgz'));
+  assert.deepEqual(r1.cmds, [], 'rung 1 runs no command — it reuses bytes already on disk');
+
+  // Rung 2 — a registry-installed core packs, still without touching package-core.js.
+  const reg = mkdtempSync(join(tmpdir(), 'rvct-reg-'));
+  mkdirSync(join(reg, 'node_modules', '@bongos', 'core'), { recursive: true });
+  writeFileSync(join(reg, 'node_modules', '@bongos', 'core', 'package.json'), JSON.stringify({ name: '@bongos/core', version: '1.19.56' }));
+  writeFileSync(join(reg, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': '1.19.56' } }));
+  const r2 = run(reg, bareRoot);
+  assert.ok(r2.cmds.some((c) => c.startsWith('npm pack ')), 'rung 2 packs the installed core');
+  assert.ok(!r2.cmds.some((c) => /package-core\.js/.test(c)), 'rung 2 never reaches package-core.js');
+  assert.ok(r2.packDest, 'rung 2 returns the temp pack dir for the caller to clean up');
+
+  // Rung 3 — a source checkout WITH history rebuilds reproducibly from the ref.
+  const source = mkdtempSync(join(tmpdir(), 'rvct-src-'));
+  const r3 = run(source, gitRoot);
+  assert.deepEqual(r3.cmds, ['node scripts/gds/package-core.js'], 'history present → the ref build, NOT --from-worktree');
+  assert.equal(r3.tgz, join(gitRoot, 'dist', 'bongos-core-9.9.9.tgz'));
+  assert.equal(r3.packDest, null);
+
+  // Rung 4 — the same source checkout with its history stripped: the self-host image.
+  const r4 = run(source, bareRoot);
+  assert.deepEqual(r4.cmds, ['node scripts/gds/package-core.js --from-worktree'], 'no history → pack the working tree');
+  assert.equal(r4.tgz, join(bareRoot, 'dist', 'bongos-core-9.9.9.tgz'), 'the child still pins the running CORE_VERSION');
+
+  [gitRoot, bareRoot, filePinned, reg, source].forEach((d) => rmSync(d, { recursive: true, force: true }));
+});
+
 await ta('scaffoldStandaloneRepo: a REGISTRY-pinned consumer control plane PACKS its installed core — current version, no source rebuild (task 1002706)', async () => {
   const cp = mkdtempSync(join(tmpdir(), 'cpdir-cp-'));
   mkdirSync(join(cp, 'node_modules', '@bongos', 'core'), { recursive: true });