@bongos/core 1.19.847 → 1.19.848

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.847",
-  "core_contract": "1.19.847",
-  "source_commit": "2f39aee80129563c843fb3b14b31a00db502f851",
+  "core_version": "1.19.848",
+  "core_contract": "1.19.848",
+  "source_commit": "cec883a4362510c614bbf91576983ff03d6df2ce",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T19:42:18.427Z",
+  "built_at": "2026-09-17T19:52:14.256Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 496,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2795,
-  "tree_sha256": "6e729d424a5377af457b9b765d44e5af905a4228a5f2df22ee259583224231a0",
+  "tree_sha256": "31f2347b41b6fb4c9974eb45d6b3b99d10ae8827fec75f36b3f239159ecbe87c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -322,7 +322,7 @@
     {
       "path": "Dockerfile",
       "mode": "0000644",
-      "sha256": "25e2854dfdea46cda6b60268890ac1ec21ae6a35b29758257c1f8df35d16cbd6"
+      "sha256": "e0876b6353244e13917d10510d9f60f61dd85983dee9b19a5da762c574cbae4b"
     },
     {
       "path": "GOVERNANCE.md",
@@ -2582,7 +2582,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6ba668dea0868f1ab54467d18278e494c3fc4eb121d19313c6d85d2c80d89e63"
+      "sha256": "ed51b2e95fbd3cfd4d5aed5a54aea53a9fc147ee0c7075dd4ecf9eda265ec50e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2812,7 +2812,7 @@
     {
       "path": "docs/recipes/self-host.md",
       "mode": "0000644",
-      "sha256": "2108b55f6e3264af35c2db885b5a98ff8cc9a5c5c68881d3f5ce8037db1bf159"
+      "sha256": "135f3942a01e50af87c4645f8920b25e0b779aac45cb5101b39e62cacfa59168"
     },
     {
       "path": "docs/recipes/server-bring-up.md",
@@ -7907,12 +7907,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6adf112f9a6622910cb13b7dd741da5a7d1c84976c286e13068974bb8717c629"
+      "sha256": "c4a58e2d12411921c911607c5345671c595e34d7d7c8c51747d7ea5978cf21d4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f7dc6b6b5522f7b4e1bddf7f62cd371fda49d1304497cb6b5de979c5f7a2ac93"
+      "sha256": "a3b15f291e7851a3578a38113485b76f54b695dca7bf97859954a26707a24c2a"
     },
     {
       "path": "public-docs/index.html",
@@ -8767,7 +8767,7 @@
     {
       "path": "scripts/gds/package-core.js",
       "mode": "0000644",
-      "sha256": "d9a6748c0dadbff9954809df1c83345979e1356559312723e107f19949edfd7b"
+      "sha256": "4d439440fe0fe498382c7ee6e1684637a5bcad46ae67878c0d2c98d5de6cbbdd"
     },
     {
       "path": "scripts/gds/paste-token.js",
@@ -8837,7 +8837,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "c8d4ce3004cafbd1d70ee72845700c95c85da41ced29fe059af333869a75cc03"
+      "sha256": "b04300749c4f119912ecfb2e6df4a6703f004130570e47a4e5bfaffacd7e2118"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
@@ -8852,7 +8852,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "43dd54ec69ff29ad83e631d53a65c1a2d22b89ef07181e4df14581e5199bfa61"
+      "sha256": "cbf44d415e3c5bb803e68af7b70ebfb08e7d0ab2388cc7f17a114512f29662e8"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9847,7 +9847,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c2347ac91ce5aa5e5f46bcb3e0734bd151e2abbe1f2347290d75891229223a17"
+      "sha256": "f6dcadffbe81524b07bdc5821ae2cf1f5268eeea497354a09d0e7158673e3b85"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12427,7 +12427,7 @@
     {
       "path": "tests/package_core.mjs",
       "mode": "0000644",
-      "sha256": "a8278101d0de34bb8214f4c7a5a68760b5546099df27044c20d5c360fdc4442f"
+      "sha256": "7d64e3c217274af48f24557d49deeb2cb54d7929bd9e939f15b3d3ceb757336c"
     },
     {
       "path": "tests/parallel-load.mjs",
@@ -12702,7 +12702,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "5a1abd44776798ca89266f86663037086c1270aca569e54647607d4488cbfea9"
+      "sha256": "d763e2b5a10fbdd9a0e95fae493b524c7a52b437663125e3dbaf753435402e9c"
     },
     {
       "path": "tests/provision_caddy_wiring.mjs",

package/Dockerfile

@@ -15,8 +15,13 @@ FROM node:22-bookworm-slim
 
 # postgresql-client gives us `psql` for scripts/migrate.sh; bash runs it; tini
 # is a proper PID 1 so signals/zombies are handled. curl powers HEALTHCHECK.
+# git is the provisioning scaffold's only unmet tool (task 1003995): scaffoldStandaloneRepo
+# materializes a child instance's repo with `git init`/`clone` → commit → push, so without it
+# `provision.js run-intents --apply` cannot run here at all. The image still carries NO .git
+# of its own (.dockerignore excludes it by design) — that half is package-core's
+# --from-worktree rung, not an apt line.
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends postgresql-client bash tini curl ca-certificates \
+    && apt-get install -y --no-install-recommends postgresql-client bash tini curl ca-certificates git \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app

package/docs/module-api-changelog.md

@@ -2168,5 +2168,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.845 with no explicit bump. run 35264882014. (task 1002620)
   1.19.847 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.846 with no explicit bump. run 35266409194. (task 1002620)
+  1.19.848 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.847 with no explicit bump. run 35267380720. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/self-host.md

@@ -39,7 +39,7 @@ Author `config/branding.json` from the neutral starter — see [the branding con
 
 **Or scaffold it with `bongos init`** ([task #1204](https://example.com/builders#/task/1204)): a short interview (or `bongos init --from spec.json` for a hands-free / CI run) that writes both config files, **seeds your first version + its done-when goal**, and **files the human-only kickoff steps** (register a GitHub OAuth app, first owner sign-in, repo binding, admission) as real tracked tasks — so a fresh instance has a claimable queue on day one instead of an empty hall. It never invents your branding (it points you at the fill prompt for that). Preview the whole plan with `bongos init --dry-run`.
 
-**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image cannot run that today (no git in the image, systemd and a DigitalOcean token assumed; task 1002718), so on a compose self-host a new project waits indefinitely. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
+**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image now carries the tools the scaffold needs — git, and a core it can package out of its own `.git`-less checkout (task 1003995) — but the standup leg still assumes root + systemd, which a container has not got (task 1003997), so on a compose self-host a new project waits indefinitely. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
 
 ## Configuration surface
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.847",
+  "version": "1.19.848",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.847",
+      "version": "1.19.848",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.847",
+  "version": "1.19.848",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/package-core.js

@@ -51,9 +51,22 @@
 // The manifest ALSO records tarball.sha256 to verify the exact downloaded bytes.
 //
 // USAGE:
-//   node scripts/gds/package-core.js [--ref <git-ref>] [--out-dir dist]
+//   node scripts/gds/package-core.js [--ref <git-ref> | --from-worktree] [--out-dir dist]
 //        [--version <v>] [--droplet-ip <ip>] [--self-verify [--self-verify-boot]] [--publish [--live]]
 //   Defaults: --ref HEAD, --out-dir dist, --version = platform CORE_VERSION.
+//   --from-worktree  build from the files ON DISK instead of a commit, for a core checkout
+//                    that carries no git history — which is exactly what the shipped
+//                    self-host image is (.dockerignore excludes .git by design), and the
+//                    only way the provisioning scaffold inside it can vendor a core into a
+//                    child instance (task 1003995). Selection is unchanged (isPublishable);
+//                    the artifact simply has no commit to anchor to, so source_commit is null
+//                    and the tree_sha256 pin is the whole lineage. It packages what is ON DISK,
+//                    which in the image is exactly what `COPY . .` put there — so on a DEV
+//                    checkout prefer the ref build: measured on this repo the two select an
+//                    IDENTICAL 2793-file set, but a Windows working tree hands back CRLF where
+//                    the blob is LF, which changes every text file's hash and would ship a
+//                    CRLF shebang. That is why rung 4 in provision-repo.js is reached only
+//                    when there is no history to build from.
 //   --self-verify    after building, prove the artifact reproduces its pin (unpack the .tgz,
 //                    recompute tree_sha256 == manifest + verify tarball.sha256). Fatal on mismatch.
 //                    (task 1002218 / audit H3) — deterministic + network-free.
@@ -85,7 +98,7 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
 // Reuse — never re-type. The core definition, the redaction, and the tree parser
 // all already exist and are unit-tested at their homes.
-const { isPublishable } = require(path.join(REPO_ROOT, 'scripts/gds/publish-manifest.js'));
+const { isPublishable, PUBLISH_ALLOWLIST } = require(path.join(REPO_ROOT, 'scripts/gds/publish-manifest.js'));
 const {
   buildRedactionRules, collectSensitiveLiterals, findLeaks,
 } = require(path.join(REPO_ROOT, 'scripts/gds/mirror-redact.js'));
@@ -544,6 +557,47 @@ function buildTar(entries) {
   return zlib.gzipSync(tar, { level: 9 });
 }
 
+// ---- the git-LESS source: enumerate the working tree (task 1003995) --------
+//
+// Everything below the enumeration step is already git-free, so the ONE thing that
+// makes package-core unrunnable without history is `git ls-tree`. That matters because
+// the shipped self-host image IS a core checkout with no `.git` (.dockerignore excludes
+// it by design), and the provisioning scaffold inside it has no other way to build the
+// tarball it vendors into a child instance — the fourth rung of the ladder in
+// scripts/gds/provision-repo.js.
+//
+// The walk starts at PUBLISH_ALLOWLIST's own entries rather than the repo root. The
+// allowlist is already the single source of truth for what the core is, so starting
+// there means node_modules/ and dist/ are never descended into at all. Selection still
+// runs through isPublishable() in main(), so the denylist applies exactly as it does on
+// the git path — this function only decides what is OFFERED, never what is kept.
+//
+// Rows match parseLsTree's shape ({ path, type, mode }) minus `sha`: there is no object
+// to name, so main() reads these blobs off disk instead. Mode is derived the way git
+// derives it — the executable bit and nothing else. fs injectable for tests.
+function walkWorktreeEntries(root, { allow = PUBLISH_ALLOWLIST, fsImpl = fs } = {}) {
+  const out = [];
+  const addFile = (rel) => {
+    let st;
+    try { st = fsImpl.statSync(path.join(root, rel)); } catch { return; }   // absent here → simply not in the core set
+    if (st.isFile()) out.push({ path: rel, type: 'blob', mode: (st.mode & 0o111) ? '100755' : '100644' });
+  };
+  const walk = (rel) => {
+    let children;
+    try { children = fsImpl.readdirSync(path.join(root, rel), { withFileTypes: true }); } catch { return; }
+    for (const child of children) {
+      const childRel = `${rel}/${child.name}`;
+      if (child.isDirectory()) walk(childRel);
+      else if (child.isFile()) addFile(childRel);
+    }
+  };
+  for (const entry of allow) {
+    if (entry.endsWith('/')) walk(entry.replace(/\/$/, ''));
+    else addFile(entry);
+  }
+  return out.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+}
+
 // ---- git plumbing (impure) ------------------------------------------------
 function git(args) {
   return execFileSync('git', ['-C', REPO_ROOT, ...args], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
@@ -773,16 +827,22 @@ function selfVerify({ tgzPath, sidecar, outDir, boot }) {
 }
 
 function main() {
-  const ref = arg('--ref', 'HEAD');
+  // --from-worktree: build from the files on disk instead of a commit (task 1003995).
+  // The lineage anchor of such a build is the tree hash alone — there is no commit to
+  // name — so source_commit is null and source_ref says where it came from.
+  const fromWorktree = process.argv.includes('--from-worktree');
+  const ref = fromWorktree ? '(worktree)' : arg('--ref', 'HEAD');
   const outDir = path.resolve(REPO_ROOT, arg('--out-dir', 'dist'));
   const version = arg('--version', coreVersion());
   const contract = coreVersion();
   const dropletIp = arg('--droplet-ip', process.env.DROPLET_IP || null);
 
   // 1. Resolve the source ref → commit SHA (the lineage anchor of this artifact).
-  let sha;
-  try { sha = git(['rev-parse', ref]).trim(); }
-  catch (e) { console.error(`refusing: could not resolve --ref "${ref}": ${e.message}`); process.exit(2); }
+  let sha = null;
+  if (!fromWorktree) {
+    try { sha = git(['rev-parse', ref]).trim(); }
+    catch (e) { console.error(`refusing: could not resolve --ref "${ref}": ${e.message}`); process.exit(2); }
+  }
 
   // 2. Enumerate + partition the tree through the manifest (single source of truth).
   //    package.json/package-lock.json are SYNTHESIZED (task 1882, ADR 0108 §2) —
@@ -790,7 +850,12 @@ function main() {
   //    ships them verbatim), but the core package needs its OWN identity + a pruned
   //    dependency set, not the game's. Pulled out of the generic per-file loop below.
   const SYNTHESIZED_PATHS = new Set(['package.json', 'package-lock.json']);
-  const entries = parseLsTree(git(['ls-tree', '-r', sha])).filter((e) => e.type === 'blob');
+  const entries = fromWorktree
+    ? walkWorktreeEntries(REPO_ROOT)
+    : parseLsTree(git(['ls-tree', '-r', sha])).filter((e) => e.type === 'blob');
+  // A blob is named by its git object on the ref path and by its own path on the
+  // worktree path; everything downstream just wants the bytes.
+  const readBlob = (e) => (fromWorktree ? fs.readFileSync(path.join(REPO_ROOT, e.path)) : gitBuf(['cat-file', 'blob', e.sha]));
   const selected = entries.filter((e) => isPublishable(e.path) && !SYNTHESIZED_PATHS.has(e.path));
   // Drop npm-never-installed files (.gitignore, .npmignore, .npmrc) so the manifest +
   // tree_sha256 pin describe exactly what `npm install` materializes — otherwise the
@@ -798,7 +863,10 @@ function main() {
   // auto-rolls-back (idea 1000543). Done here, so they never reach the tarball or the pin.
   const npmStripped = selected.filter((e) => isNpmStripped(e.path));
   const publishable = selected.filter((e) => !isNpmStripped(e.path));
-  console.error(`[package-core] ${ref} = ${sha.slice(0, 12)} — ${entries.length} files, ${publishable.length} in the core (+2 synthesized), ${entries.length - publishable.length - 2} excluded.`);
+  // The worktree walk is already allowlist-scoped and never offers the two synthesized
+  // paths, so only the ref path discounts them from what it enumerated.
+  const excludedCount = entries.length - selected.length - (fromWorktree ? 0 : SYNTHESIZED_PATHS.size);
+  console.error(`[package-core] ${ref}${sha ? ` = ${sha.slice(0, 12)}` : ''} — ${entries.length} files, ${publishable.length} in the core (+2 synthesized), ${excludedCount} excluded.`);
   if (npmStripped.length) {
     console.error(`[package-core] dropped ${npmStripped.length} npm-never-installed file(s) from the pin (npm strips these on install; idea 1000543): ${npmStripped.map((e) => e.path).join(', ')}`);
   }
@@ -811,14 +879,24 @@ function main() {
   //     SOURCE files at this ref (never the live working tree, so --ref stays
   //     reproducible) — express+pg only, name @bongos/core, version = the
   //     platform version being packaged.
-  const pkgJsonBlob = entries.find((e) => e.path === 'package.json');
-  const pkgLockBlob = entries.find((e) => e.path === 'package-lock.json');
-  if (!pkgJsonBlob || !pkgLockBlob) {
-    console.error('refusing: source package.json/package-lock.json not found at this ref — cannot synthesize the core package.');
+  //     On the worktree path there is no ref to stay reproducible against, so the two
+  //     files come off disk beside everything else in the build.
+  const sourceRootFile = (rel) => {
+    if (fromWorktree) {
+      const abs = path.join(REPO_ROOT, rel);
+      return fs.existsSync(abs) ? fs.readFileSync(abs) : null;
+    }
+    const blob = entries.find((e) => e.path === rel);
+    return blob ? gitBuf(['cat-file', 'blob', blob.sha]) : null;
+  };
+  const pkgJsonRaw = sourceRootFile('package.json');
+  const pkgLockRaw = sourceRootFile('package-lock.json');
+  if (!pkgJsonRaw || !pkgLockRaw) {
+    console.error(`refusing: source package.json/package-lock.json not found at ${fromWorktree ? 'the repo root' : 'this ref'} — cannot synthesize the core package.`);
     process.exit(1);
   }
-  const sourcePkgJson = JSON.parse(gitBuf(['cat-file', 'blob', pkgJsonBlob.sha]).toString('utf8'));
-  const sourcePkgLock = JSON.parse(gitBuf(['cat-file', 'blob', pkgLockBlob.sha]).toString('utf8'));
+  const sourcePkgJson = JSON.parse(pkgJsonRaw.toString('utf8'));
+  const sourcePkgLock = JSON.parse(pkgLockRaw.toString('utf8'));
   const corePkgJson = buildPackageJson({ version, sourceDeps: sourcePkgJson.dependencies, sourceOverrides: sourcePkgJson.overrides });
   const corePkgLock = prunePackageLock(sourcePkgLock, {
     name: corePkgJson.name, version, rootRanges: { express: corePkgJson.dependencies.express, pg: corePkgJson.dependencies.pg },
@@ -865,7 +943,7 @@ function main() {
   let stubCount = 0; // agent docs (CLAUDE.md/AGENTS.md) replaced with the brand-free stub (task 2121)
   for (const e of publishable) {
     let raw;
-    try { raw = gitBuf(['cat-file', 'blob', e.sha]); }
+    try { raw = readBlob(e); }
     catch (err) { leaks.push({ path: e.path, label: `read-failed:${err.message}` }); continue; }
     const { buf, leaks: fileLeaks, advisories: fileAdvisories, kind } =
       processCoreFile({ pathRel: e.path, raw, rules, sensitiveLiterals, envSecrets, knownDocNames });
@@ -955,7 +1033,7 @@ function main() {
 
   console.error('');
   console.error(`[package-core] Cloud Bongos core v${version} packaged (contract ^${contract}).`);
-  console.error(`  source_commit  ${sha}`);
+  console.error(`  source_commit  ${sha || '(none — built from the working tree)'}`);
   console.error(`  file_count     ${filesMeta.length}`);
   console.error(`  tree_sha256    ${treeHash}`);
   console.error(`  tarball        ${path.relative(REPO_ROOT, tgzPath)}  (${(tgz.length / 1024).toFixed(1)} KiB, sha256 ${sidecar.tarball.sha256.slice(0, 12)}…)`);
@@ -1059,6 +1137,8 @@ module.exports = {
   leakScanVerdict,
   // task 1002217 (audit H4) — the fixed neutral floor injected into the doc-redaction + fail-closed gate
   PRIOR_INSTANCE_FLOOR,
+  // task 1003995 — --from-worktree's enumerator, for a core checkout with no git history
+  walkWorktreeEntries,
 };
 
 if (require.main === module) main();

package/scripts/gds/provision-repo.js

@@ -399,7 +399,17 @@ function installedCorePackDir({ instanceRoot, fsImpl = fs } = {}) {
   return null;
 }
 
-// Resolve a vendorable @bongos/core tarball — the three-rung ladder, freshest-correct
+// Can package-core.js enumerate this checkout from GIT? It builds the core set from
+// `git ls-tree` at a ref, so a checkout with no `.git` aborts at `git rev-parse HEAD` —
+// and that is not a broken install, it is the SHIPPED SELF-HOST IMAGE: .dockerignore
+// excludes .git by design, so /app is a complete core source tree with no history
+// (task 1003995). The presence of `.git` — a directory in a clone, a file in a linked
+// worktree — is the whole question. fs injectable for tests; read-only → dry-run safe.
+function coreCheckoutHasGit({ repoRoot = REPO_ROOT, fsImpl = fs } = {}) {
+  return fsImpl.existsSync(path.join(repoRoot, '.git'));
+}
+
+// Resolve a vendorable @bongos/core tarball — the four-rung ladder, freshest-correct
 // first, shared by the fresh scaffold and the re-provision pin refresh (task 1003050):
 //   1. a `file:`-pinned control plane reuses its own pinned tarball (task 1002275 —
 //      rebuilding via package-core.js aborts with an EMPTY core set when this runner
@@ -408,31 +418,37 @@ function installedCorePackDir({ instanceRoot, fsImpl = fs } = {}) {
 //      it has INSTALLED — the child pins the SAME, CURRENT core the hub runs, ending
 //      the frozen-old-tarball births (task 1002706, gap 13) without requiring the
 //      child's owner to hold a token for the still-private registry package;
-//   3. a genuine core source checkout rebuilds fresh via package-core.js.
+//   3. a genuine core source checkout rebuilds fresh via package-core.js;
+//   4. a core checkout with NO git history — the self-host image — packs its working
+//      tree via package-core.js --from-worktree (task 1003995). LAST because it is the
+//      only rung with no commit to anchor the artifact to: whenever history is there,
+//      rung 3's reproducible build is the better answer for the identical file set.
 // Returns { tgz, packDest } — packDest (set only on rung 2) is a temp dir the CALLER
 // must `rm -rf` once the tarball has been vendored.
-function resolveVendorableCoreTarball({ instanceRoot, exec, log, coreV, tag = '[core]' }) {
-  let tgz = installedCoreTarball({ instanceRoot });
-  let packDest = null;
-  if (tgz) {
-    log(`  ${tag} reusing the pinned core tarball this control plane runs (${path.basename(tgz)}) — no source rebuild (task 1002275)`);
+function resolveVendorableCoreTarball({ instanceRoot, repoRoot = REPO_ROOT, exec, log, coreV, tag = '[core]' }) {
+  const pinned = installedCoreTarball({ instanceRoot });
+  if (pinned) {
+    log(`  ${tag} reusing the pinned core tarball this control plane runs (${path.basename(pinned)}) — no source rebuild (task 1002275)`);
+    return { tgz: pinned, packDest: null };
+  }
+  const packSrc = installedCorePackDir({ instanceRoot });
+  if (packSrc) {
+    // Keyed by VERSION, not slug: no request-derived value enters this command, and
+    // two concurrent scaffolds of the same core pack identical bytes — collision-safe.
+    const packDest = path.join(os.tmpdir(), `bongos-core-pack-${packSrc.version}`);
+    log(`  ${tag} packing the registry-installed core this control plane runs (v${packSrc.version}) — no source rebuild (task 1002706)`);
+    exec(`mkdir -p ${packDest}`);
+    exec(`npm pack ${packSrc.dir} --pack-destination ${packDest}`);
+    return { tgz: path.join(packDest, packSrc.tarballName), packDest };
+  }
+  if (coreCheckoutHasGit({ repoRoot })) {
+    log(`  ${tag} building a fresh vendored tarball from source (package-core.js)`);
+    exec(`node scripts/gds/package-core.js`);                      // cwd = REPO_ROOT → dist/bongos-core-<v>.tgz
   } else {
-    const packSrc = installedCorePackDir({ instanceRoot });
-    if (packSrc) {
-      // Keyed by VERSION, not slug: no request-derived value enters this command, and
-      // two concurrent scaffolds of the same core pack identical bytes — collision-safe.
-      packDest = path.join(os.tmpdir(), `bongos-core-pack-${packSrc.version}`);
-      log(`  ${tag} packing the registry-installed core this control plane runs (v${packSrc.version}) — no source rebuild (task 1002706)`);
-      exec(`mkdir -p ${packDest}`);
-      exec(`npm pack ${packSrc.dir} --pack-destination ${packDest}`);
-      tgz = path.join(packDest, packSrc.tarballName);
-    } else {
-      log(`  ${tag} building a fresh vendored tarball from source (package-core.js)`);
-      exec(`node scripts/gds/package-core.js`);                    // cwd = REPO_ROOT → dist/bongos-core-<v>.tgz
-      tgz = path.join(REPO_ROOT, 'dist', `bongos-core-${coreV}.tgz`);
-    }
+    log(`  ${tag} this checkout IS the core and carries no git history — packing the working tree (package-core.js --from-worktree, task 1003995)`);
+    exec(`node scripts/gds/package-core.js --from-worktree`);
   }
-  return { tgz, packDest };
+  return { tgz: path.join(repoRoot, 'dist', `bongos-core-${coreV}.tgz`), packDest: null };
 }
 
 // The onboard mode a provisioning row carries (migration provisioning_004, task 1002562).
@@ -633,7 +649,7 @@ async function scaffoldStandaloneRepo(inst, deps) {
     const spec = instanceInitSpec(inst, { ownerLogin });
     const specPath = path.join(os.tmpdir(), `bongos-init-${inst.slug}.json`);
     writeFile(specPath, JSON.stringify(spec, null, 2));
-    // Vendored tarball — resolveVendorableCoreTarball's three-rung ladder (shared
+    // Vendored tarball — resolveVendorableCoreTarball's four-rung ladder (shared
     // with the re-provision pin refresh, task 1003050).
     const { tgz, packDest } = resolveVendorableCoreTarball({
       instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[scaffold] core install:',
@@ -1007,6 +1023,7 @@ module.exports = {
   ownerLoginOf,
   asPostgres,
   buildCorePinRefreshCommit,
+  coreCheckoutHasGit,
   dbCreateCmd,
   dbName,
   dbRoleCmd,

package/scripts/gds/provision.js

@@ -50,7 +50,7 @@ const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
-const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
+const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
@@ -1457,6 +1457,8 @@ module.exports = {
   parseTargetRef, instanceRepoRemote, instanceInitSpec, installedCoreTarball, installedCorePackDir, scaffoldStandaloneRepo, coreVersionSafe,
   // re-provision core-pin refresh (gap-list W3, task 1003050)
   resolveVendorableCoreTarball, planCorePinRefresh, safeVersionLabel, buildCorePinRefreshCommit, refreshStandaloneCorePin,
+  // the git-less core checkout — the self-host image's rung (task 1003995)
+  coreCheckoutHasGit,
   // adopt vs greenfield onboarding (ADR 0121, task 1002562)
   onboardMode, alreadyScaffolded,
   // private-repo deploy key (ADR 0176, task 1002735)

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.847'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.848'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/package_core.mjs

@@ -42,8 +42,11 @@ const {
   scanArtifactForLeaks, PRIOR_INSTANCE_LITERALS,
   // task 1002217 (audit H4) — the fixed neutral floor
   PRIOR_INSTANCE_FLOOR,
+  // task 1003995 — --from-worktree's enumerator, for a core checkout with no git history
+  walkWorktreeEntries,
 } = m;
 const { buildRedactionRules, collectSensitiveLiterals, redactText, findLeaks } = require('../scripts/gds/mirror-redact.js');
+const { isPublishable } = require('../scripts/gds/publish-manifest.js');
 
 // A synthetic instance brand for the classification tests (never the real OTB literals).
 const TEST_BRANDING = {
@@ -747,5 +750,67 @@ t('idea 1000543 (the fix): the isNpmStripped filter makes the pin reproduce agai
   } finally { rmSync(root, { recursive: true, force: true }); }
 });
 
+// ── --from-worktree: the git-less enumeration (task 1003995) ─────────────────────
+// package-core builds the core set from `git ls-tree`, so a core checkout with no .git —
+// the shipped self-host image, where .dockerignore excludes it by design — cannot build
+// the tarball its provisioning scaffold vendors into a child instance. walkWorktreeEntries
+// is the replacement source. It decides only what is OFFERED; isPublishable still decides
+// what is KEPT, so the core set stays defined in exactly one place.
+function worktreeFixture() {
+  const root = mkdtempSync(join(tmpdir(), 'wt-core-'));
+  const put = (rel, body = 'x') => {
+    mkdirSync(join(root, dirname(rel)), { recursive: true });
+    writeFileSync(join(root, rel), body);
+  };
+  put('src/module-api.js');
+  put('src/bongos/tasks.js');                       // nested, to prove the walk recurses
+  put('scripts/gds/package-core.js');
+  put('CLAUDE.md');                                  // an allowlisted FILE entry, not a subtree
+  put('node_modules/@bongos/core/index.js');         // huge + never core: must never be descended
+  put('dist/bongos-core-1.0.0.tgz');                 // this tool's own output
+  put('config/branding.json');                       // instance identity: outside every allowlist root
+  return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) };
+}
+
+t('walkWorktreeEntries: offers the allowlisted tree and never descends node_modules/ or dist/', () => {
+  const { root, cleanup } = worktreeFixture();
+  try {
+    const paths = walkWorktreeEntries(root).map((e) => e.path);
+    assert.deepEqual(
+      paths,
+      ['CLAUDE.md', 'scripts/gds/package-core.js', 'src/bongos/tasks.js', 'src/module-api.js'],
+      `unexpected set: ${paths.join(', ')}`,
+    );
+    assert.ok(!paths.some((p) => p.startsWith('node_modules/')), 'node_modules is never walked');
+    assert.ok(!paths.some((p) => p.startsWith('dist/')), 'the packager never re-enumerates its own output');
+    assert.ok(!paths.includes('config/branding.json'), 'instance identity is outside every allowlist root');
+  } finally { cleanup(); }
+});
+
+t('walkWorktreeEntries: rows match the git-tree shape — sorted blobs carrying a mode', () => {
+  const { root, cleanup } = worktreeFixture();
+  try {
+    const entries = walkWorktreeEntries(root);
+    assert.deepEqual([...entries].sort((a, b) => (a.path < b.path ? -1 : 1)), entries, 'sorted, so the pin is stable');
+    for (const e of entries) {
+      assert.equal(e.type, 'blob', 'only files, matching the ls-tree filter main() applies');
+      assert.ok(['100644', '100755'].includes(e.mode), `mode must be a git file mode, got ${e.mode}`);
+    }
+  } finally { cleanup(); }
+});
+
+t('walkWorktreeEntries: a DENIED path inside an allowlisted subtree is still offered — the denylist is main()’s job, not the walk’s', () => {
+  const { root, cleanup } = worktreeFixture();
+  try {
+    // A host-feature script lives under the allowlisted scripts/ root and is denied by name.
+    // If the walk pre-filtered it, the two enumeration paths would be applying different rules.
+    const denied = 'scripts/gds/art-stage.js';
+    writeFileSync(join(root, denied), 'x');
+    const offered = walkWorktreeEntries(root).map((e) => e.path);
+    assert.ok(offered.includes(denied), 'the walk offers it…');
+    assert.equal(isPublishable(denied), false, '…and isPublishable is what drops it');
+  } finally { cleanup(); }
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/provision.mjs

@@ -816,6 +816,78 @@ t('installedCorePackDir: a registry-pinned consumer with an installed core → i
   [reg, filePinned, uninstalled, bare2, alt2].forEach((d) => rmSync(d, { recursive: true, force: true }));
 });
 
+// ── the git-less core checkout: rung 4 (task 1003995) ────────────────────────────
+// The shipped self-host image is a complete core source tree with NO .git (.dockerignore
+// excludes it by design), so package-core.js's `git ls-tree` enumeration has nothing to
+// read and the scaffold inside the container could never build the tarball it vendors
+// into a child. Rung 4 packs the working tree instead.
+t('coreCheckoutHasGit: a clone (.git dir) and a linked worktree (.git file) both have history; the image does not', () => {
+  const clone = mkdtempSync(join(tmpdir(), 'cchg-clone-'));
+  mkdirSync(join(clone, '.git'));
+  assert.equal(P.coreCheckoutHasGit({ repoRoot: clone }), true, 'a clone carries a .git DIRECTORY');
+
+  // A linked worktree's .git is a FILE pointing at the real gitdir — every claim in this
+  // project is worked in one, so treating it as history-less would take the wrong rung on
+  // the machine that runs these tests.
+  const wt = mkdtempSync(join(tmpdir(), 'cchg-worktree-'));
+  writeFileSync(join(wt, '.git'), 'gitdir: /somewhere/.git/worktrees/task-1\n');
+  assert.equal(P.coreCheckoutHasGit({ repoRoot: wt }), true, 'a linked worktree carries a .git FILE');
+
+  const image = mkdtempSync(join(tmpdir(), 'cchg-image-'));
+  assert.equal(P.coreCheckoutHasGit({ repoRoot: image }), false, 'the self-host image has no .git at all');
+
+  [clone, wt, image].forEach((d) => rmSync(d, { recursive: true, force: true }));
+});
+
+t('resolveVendorableCoreTarball: the ladder picks file: pin → registry pack → git source → worktree, in that order', () => {
+  // One helper per rung so the ONLY thing varying between cases is which shape the
+  // control-plane root presents. Asserting on the recorded commands is what proves the
+  // ORDER: a rung that fires early leaves the later rung's command unrun.
+  const run = (instanceRoot, repoRoot) => {
+    const cmds = [];
+    const res = P.resolveVendorableCoreTarball({
+      instanceRoot, repoRoot, exec: (c) => { cmds.push(c); }, log: () => {}, coreV: '9.9.9',
+    });
+    return { cmds, ...res };
+  };
+  const gitRoot = mkdtempSync(join(tmpdir(), 'rvct-git-'));
+  mkdirSync(join(gitRoot, '.git'));
+  const bareRoot = mkdtempSync(join(tmpdir(), 'rvct-bare-'));   // no .git → the image shape
+
+  // Rung 1 — a file: pin wins even from a git-less root: nothing is rebuilt at all.
+  const filePinned = mkdtempSync(join(tmpdir(), 'rvct-file-'));
+  mkdirSync(join(filePinned, 'vendor'));
+  writeFileSync(join(filePinned, 'vendor', 'bongos-core-1.2.3.tgz'), 'x');
+  writeFileSync(join(filePinned, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': 'file:vendor/bongos-core-1.2.3.tgz' } }));
+  const r1 = run(filePinned, bareRoot);
+  assert.equal(r1.tgz, join(filePinned, 'vendor', 'bongos-core-1.2.3.tgz'));
+  assert.deepEqual(r1.cmds, [], 'rung 1 runs no command — it reuses bytes already on disk');
+
+  // Rung 2 — a registry-installed core packs, still without touching package-core.js.
+  const reg = mkdtempSync(join(tmpdir(), 'rvct-reg-'));
+  mkdirSync(join(reg, 'node_modules', '@bongos', 'core'), { recursive: true });
+  writeFileSync(join(reg, 'node_modules', '@bongos', 'core', 'package.json'), JSON.stringify({ name: '@bongos/core', version: '1.19.56' }));
+  writeFileSync(join(reg, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': '1.19.56' } }));
+  const r2 = run(reg, bareRoot);
+  assert.ok(r2.cmds.some((c) => c.startsWith('npm pack ')), 'rung 2 packs the installed core');
+  assert.ok(!r2.cmds.some((c) => /package-core\.js/.test(c)), 'rung 2 never reaches package-core.js');
+  assert.ok(r2.packDest, 'rung 2 returns the temp pack dir for the caller to clean up');
+
+  // Rung 3 — a source checkout WITH history rebuilds reproducibly from the ref.
+  const source = mkdtempSync(join(tmpdir(), 'rvct-src-'));
+  const r3 = run(source, gitRoot);
+  assert.deepEqual(r3.cmds, ['node scripts/gds/package-core.js'], 'history present → the ref build, NOT --from-worktree');
+  assert.equal(r3.tgz, join(gitRoot, 'dist', 'bongos-core-9.9.9.tgz'));
+  assert.equal(r3.packDest, null);
+
+  // Rung 4 — the same source checkout with its history stripped: the self-host image.
+  const r4 = run(source, bareRoot);
+  assert.deepEqual(r4.cmds, ['node scripts/gds/package-core.js --from-worktree'], 'no history → pack the working tree');
+  assert.equal(r4.tgz, join(bareRoot, 'dist', 'bongos-core-9.9.9.tgz'), 'the child still pins the running CORE_VERSION');
+
+  [gitRoot, bareRoot, filePinned, reg, source].forEach((d) => rmSync(d, { recursive: true, force: true }));
+});
+
 await ta('scaffoldStandaloneRepo: a REGISTRY-pinned consumer control plane PACKS its installed core — current version, no source rebuild (task 1002706)', async () => {
   const cp = mkdtempSync(join(tmpdir(), 'cpdir-cp-'));
   mkdirSync(join(cp, 'node_modules', '@bongos', 'core'), { recursive: true });