@bongos/core 1.19.847 → 1.19.849

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.847",
-  "core_contract": "1.19.847",
-  "source_commit": "2f39aee80129563c843fb3b14b31a00db502f851",
+  "core_version": "1.19.849",
+  "core_contract": "1.19.849",
+  "source_commit": "a027efb6aa355bb0aa4454dba3a3e2de3627f108",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T19:42:18.427Z",
+  "built_at": "2026-09-17T20:09:50.093Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 496,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2273,
+    "functional_verbatim": 2276,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2795,
-  "tree_sha256": "6e729d424a5377af457b9b765d44e5af905a4228a5f2df22ee259583224231a0",
+  "file_count": 2798,
+  "tree_sha256": "894ee6e6b895465db909d512fe4cff3a9ac80665702d069dcdb6c5cafdc61050",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -322,7 +322,7 @@
     {
       "path": "Dockerfile",
       "mode": "0000644",
-      "sha256": "25e2854dfdea46cda6b60268890ac1ec21ae6a35b29758257c1f8df35d16cbd6"
+      "sha256": "e0876b6353244e13917d10510d9f60f61dd85983dee9b19a5da762c574cbae4b"
     },
     {
       "path": "GOVERNANCE.md",
@@ -2582,7 +2582,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6ba668dea0868f1ab54467d18278e494c3fc4eb121d19313c6d85d2c80d89e63"
+      "sha256": "5795b2567e4a68c109fb1c36a46346dd3b40ded0ea206d4368ec58cd23916849"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2812,7 +2812,7 @@
     {
       "path": "docs/recipes/self-host.md",
       "mode": "0000644",
-      "sha256": "2108b55f6e3264af35c2db885b5a98ff8cc9a5c5c68881d3f5ce8037db1bf159"
+      "sha256": "135f3942a01e50af87c4645f8920b25e0b779aac45cb5101b39e62cacfa59168"
     },
     {
       "path": "docs/recipes/server-bring-up.md",
@@ -7907,12 +7907,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6adf112f9a6622910cb13b7dd741da5a7d1c84976c286e13068974bb8717c629"
+      "sha256": "3a5f72a3b77cc19f6404799e646685ee91e3996ebb614b66b756722a6c23edc5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f7dc6b6b5522f7b4e1bddf7f62cd371fda49d1304497cb6b5de979c5f7a2ac93"
+      "sha256": "61c0a90cce564a70963e5ab3b301e6349e89c135e56767a94107df0817a42c31"
     },
     {
       "path": "public-docs/index.html",
@@ -8767,12 +8767,12 @@
     {
       "path": "scripts/gds/package-core.js",
       "mode": "0000644",
-      "sha256": "d9a6748c0dadbff9954809df1c83345979e1356559312723e107f19949edfd7b"
+      "sha256": "4d439440fe0fe498382c7ee6e1684637a5bcad46ae67878c0d2c98d5de6cbbdd"
     },
     {
       "path": "scripts/gds/paste-token.js",
       "mode": "0000644",
-      "sha256": "cfc9e6a9640f8392a38077a7fa50bd1caae671a60c4735d2758c0cc5a6d10610"
+      "sha256": "9c3fd12318b04062382d8f1309d2da64de7436c93ff7bb25d2b1f5ac5cec7795"
     },
     {
       "path": "scripts/gds/plain-cards.js",
@@ -8837,7 +8837,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "c8d4ce3004cafbd1d70ee72845700c95c85da41ced29fe059af333869a75cc03"
+      "sha256": "b04300749c4f119912ecfb2e6df4a6703f004130570e47a4e5bfaffacd7e2118"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
@@ -8852,7 +8852,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "43dd54ec69ff29ad83e631d53a65c1a2d22b89ef07181e4df14581e5199bfa61"
+      "sha256": "cbf44d415e3c5bb803e68af7b70ebfb08e7d0ab2388cc7f17a114512f29662e8"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9189,6 +9189,11 @@
       "mode": "0000644",
       "sha256": "96ad972d929f3733f871d45df1a9ff7013f9f74154f9e37d5e2df55e7959c1a5"
     },
+    {
+      "path": "scripts/gds/ship-escalation.js",
+      "mode": "0000644",
+      "sha256": "500c73254cb071f9e9ef08e4a3fc934f6a49a25193be9975c39704fb19e67429"
+    },
     {
       "path": "scripts/gds/ship-finish.js",
       "mode": "0000644",
@@ -9197,7 +9202,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "c29075a13419ef2bc13f2ff1fd921c725c633ab1e3284dbe9531e1fb55219678"
+      "sha256": "4b8179e5c1aae3fc4845457a4089c57f6cf105c33d03d21d3ade99776371e50f"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -9847,7 +9852,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c2347ac91ce5aa5e5f46bcb3e0734bd151e2abbe1f2347290d75891229223a17"
+      "sha256": "2b2515e91e33976af14b7538bff4d39a0ea053a33b84fb86a848254a4c3e9af7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12354,6 +12359,11 @@
       "mode": "0000644",
       "sha256": "c57c0211709ab041ee895bbb4ade9f4b146b43147570bf282e6d6a808560db76"
     },
+    {
+      "path": "tests/no_artifact_escalation.mjs",
+      "mode": "0000644",
+      "sha256": "3d2b03a39cbefc02565a190dee0612e14576edbf32ea0fccf798d6ed28fee8f1"
+    },
     {
       "path": "tests/oauth_secret.mjs",
       "mode": "0000644",
@@ -12427,7 +12437,7 @@
     {
       "path": "tests/package_core.mjs",
       "mode": "0000644",
-      "sha256": "a8278101d0de34bb8214f4c7a5a68760b5546099df27044c20d5c360fdc4442f"
+      "sha256": "7d64e3c217274af48f24557d49deeb2cb54d7929bd9e939f15b3d3ceb757336c"
     },
     {
       "path": "tests/parallel-load.mjs",
@@ -12444,6 +12454,11 @@
       "mode": "0000644",
       "sha256": "e48806b48a9f7a4f9f9c010f45750e6b440d2de68feacdabacd9bd25d98f2046"
     },
+    {
+      "path": "tests/paste_token_session_store.mjs",
+      "mode": "0000644",
+      "sha256": "9901e8e0b857c3061421909180bb1e34f1752a1ccfaca8150a52e7a79bf1227b"
+    },
     {
       "path": "tests/patch_gate_ordering.mjs",
       "mode": "0000644",
@@ -12702,7 +12717,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "5a1abd44776798ca89266f86663037086c1270aca569e54647607d4488cbfea9"
+      "sha256": "d763e2b5a10fbdd9a0e95fae493b524c7a52b437663125e3dbaf753435402e9c"
     },
     {
       "path": "tests/provision_caddy_wiring.mjs",

package/Dockerfile

@@ -15,8 +15,13 @@ FROM node:22-bookworm-slim
 
 # postgresql-client gives us `psql` for scripts/migrate.sh; bash runs it; tini
 # is a proper PID 1 so signals/zombies are handled. curl powers HEALTHCHECK.
+# git is the provisioning scaffold's only unmet tool (task 1003995): scaffoldStandaloneRepo
+# materializes a child instance's repo with `git init`/`clone` → commit → push, so without it
+# `provision.js run-intents --apply` cannot run here at all. The image still carries NO .git
+# of its own (.dockerignore excludes it by design) — that half is package-core's
+# --from-worktree rung, not an apt line.
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends postgresql-client bash tini curl ca-certificates \
+    && apt-get install -y --no-install-recommends postgresql-client bash tini curl ca-certificates git \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app

package/docs/module-api-changelog.md

@@ -2168,5 +2168,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.845 with no explicit bump. run 35264882014. (task 1002620)
   1.19.847 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.846 with no explicit bump. run 35266409194. (task 1002620)
+  1.19.848 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.847 with no explicit bump. run 35267380720. (task 1002620)
+  1.19.849 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.848 with no explicit bump. run 35269098215. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/self-host.md

@@ -39,7 +39,7 @@ Author `config/branding.json` from the neutral starter — see [the branding con
 
 **Or scaffold it with `bongos init`** ([task #1204](https://example.com/builders#/task/1204)): a short interview (or `bongos init --from spec.json` for a hands-free / CI run) that writes both config files, **seeds your first version + its done-when goal**, and **files the human-only kickoff steps** (register a GitHub OAuth app, first owner sign-in, repo binding, admission) as real tracked tasks — so a fresh instance has a claimable queue on day one instead of an empty hall. It never invents your branding (it points you at the fill prompt for that). Preview the whole plan with `bongos init --dry-run`.
 
-**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image cannot run that today (no git in the image, systemd and a DigitalOcean token assumed; task 1002718), so on a compose self-host a new project waits indefinitely. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
+**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image now carries the tools the scaffold needs — git, and a core it can package out of its own `.git`-less checkout (task 1003995) — but the standup leg still assumes root + systemd, which a container has not got (task 1003997), so on a compose self-host a new project waits indefinitely. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
 
 ## Configuration surface
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.847",
+  "version": "1.19.849",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.847",
+      "version": "1.19.849",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.847",
+  "version": "1.19.849",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/package-core.js

@@ -51,9 +51,22 @@
 // The manifest ALSO records tarball.sha256 to verify the exact downloaded bytes.
 //
 // USAGE:
-//   node scripts/gds/package-core.js [--ref <git-ref>] [--out-dir dist]
+//   node scripts/gds/package-core.js [--ref <git-ref> | --from-worktree] [--out-dir dist]
 //        [--version <v>] [--droplet-ip <ip>] [--self-verify [--self-verify-boot]] [--publish [--live]]
 //   Defaults: --ref HEAD, --out-dir dist, --version = platform CORE_VERSION.
+//   --from-worktree  build from the files ON DISK instead of a commit, for a core checkout
+//                    that carries no git history — which is exactly what the shipped
+//                    self-host image is (.dockerignore excludes .git by design), and the
+//                    only way the provisioning scaffold inside it can vendor a core into a
+//                    child instance (task 1003995). Selection is unchanged (isPublishable);
+//                    the artifact simply has no commit to anchor to, so source_commit is null
+//                    and the tree_sha256 pin is the whole lineage. It packages what is ON DISK,
+//                    which in the image is exactly what `COPY . .` put there — so on a DEV
+//                    checkout prefer the ref build: measured on this repo the two select an
+//                    IDENTICAL 2793-file set, but a Windows working tree hands back CRLF where
+//                    the blob is LF, which changes every text file's hash and would ship a
+//                    CRLF shebang. That is why rung 4 in provision-repo.js is reached only
+//                    when there is no history to build from.
 //   --self-verify    after building, prove the artifact reproduces its pin (unpack the .tgz,
 //                    recompute tree_sha256 == manifest + verify tarball.sha256). Fatal on mismatch.
 //                    (task 1002218 / audit H3) — deterministic + network-free.
@@ -85,7 +98,7 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
 // Reuse — never re-type. The core definition, the redaction, and the tree parser
 // all already exist and are unit-tested at their homes.
-const { isPublishable } = require(path.join(REPO_ROOT, 'scripts/gds/publish-manifest.js'));
+const { isPublishable, PUBLISH_ALLOWLIST } = require(path.join(REPO_ROOT, 'scripts/gds/publish-manifest.js'));
 const {
   buildRedactionRules, collectSensitiveLiterals, findLeaks,
 } = require(path.join(REPO_ROOT, 'scripts/gds/mirror-redact.js'));
@@ -544,6 +557,47 @@ function buildTar(entries) {
   return zlib.gzipSync(tar, { level: 9 });
 }
 
+// ---- the git-LESS source: enumerate the working tree (task 1003995) --------
+//
+// Everything below the enumeration step is already git-free, so the ONE thing that
+// makes package-core unrunnable without history is `git ls-tree`. That matters because
+// the shipped self-host image IS a core checkout with no `.git` (.dockerignore excludes
+// it by design), and the provisioning scaffold inside it has no other way to build the
+// tarball it vendors into a child instance — the fourth rung of the ladder in
+// scripts/gds/provision-repo.js.
+//
+// The walk starts at PUBLISH_ALLOWLIST's own entries rather than the repo root. The
+// allowlist is already the single source of truth for what the core is, so starting
+// there means node_modules/ and dist/ are never descended into at all. Selection still
+// runs through isPublishable() in main(), so the denylist applies exactly as it does on
+// the git path — this function only decides what is OFFERED, never what is kept.
+//
+// Rows match parseLsTree's shape ({ path, type, mode }) minus `sha`: there is no object
+// to name, so main() reads these blobs off disk instead. Mode is derived the way git
+// derives it — the executable bit and nothing else. fs injectable for tests.
+function walkWorktreeEntries(root, { allow = PUBLISH_ALLOWLIST, fsImpl = fs } = {}) {
+  const out = [];
+  const addFile = (rel) => {
+    let st;
+    try { st = fsImpl.statSync(path.join(root, rel)); } catch { return; }   // absent here → simply not in the core set
+    if (st.isFile()) out.push({ path: rel, type: 'blob', mode: (st.mode & 0o111) ? '100755' : '100644' });
+  };
+  const walk = (rel) => {
+    let children;
+    try { children = fsImpl.readdirSync(path.join(root, rel), { withFileTypes: true }); } catch { return; }
+    for (const child of children) {
+      const childRel = `${rel}/${child.name}`;
+      if (child.isDirectory()) walk(childRel);
+      else if (child.isFile()) addFile(childRel);
+    }
+  };
+  for (const entry of allow) {
+    if (entry.endsWith('/')) walk(entry.replace(/\/$/, ''));
+    else addFile(entry);
+  }
+  return out.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+}
+
 // ---- git plumbing (impure) ------------------------------------------------
 function git(args) {
   return execFileSync('git', ['-C', REPO_ROOT, ...args], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
@@ -773,16 +827,22 @@ function selfVerify({ tgzPath, sidecar, outDir, boot }) {
 }
 
 function main() {
-  const ref = arg('--ref', 'HEAD');
+  // --from-worktree: build from the files on disk instead of a commit (task 1003995).
+  // The lineage anchor of such a build is the tree hash alone — there is no commit to
+  // name — so source_commit is null and source_ref says where it came from.
+  const fromWorktree = process.argv.includes('--from-worktree');
+  const ref = fromWorktree ? '(worktree)' : arg('--ref', 'HEAD');
   const outDir = path.resolve(REPO_ROOT, arg('--out-dir', 'dist'));
   const version = arg('--version', coreVersion());
   const contract = coreVersion();
   const dropletIp = arg('--droplet-ip', process.env.DROPLET_IP || null);
 
   // 1. Resolve the source ref → commit SHA (the lineage anchor of this artifact).
-  let sha;
-  try { sha = git(['rev-parse', ref]).trim(); }
-  catch (e) { console.error(`refusing: could not resolve --ref "${ref}": ${e.message}`); process.exit(2); }
+  let sha = null;
+  if (!fromWorktree) {
+    try { sha = git(['rev-parse', ref]).trim(); }
+    catch (e) { console.error(`refusing: could not resolve --ref "${ref}": ${e.message}`); process.exit(2); }
+  }
 
   // 2. Enumerate + partition the tree through the manifest (single source of truth).
   //    package.json/package-lock.json are SYNTHESIZED (task 1882, ADR 0108 §2) —
@@ -790,7 +850,12 @@ function main() {
   //    ships them verbatim), but the core package needs its OWN identity + a pruned
   //    dependency set, not the game's. Pulled out of the generic per-file loop below.
   const SYNTHESIZED_PATHS = new Set(['package.json', 'package-lock.json']);
-  const entries = parseLsTree(git(['ls-tree', '-r', sha])).filter((e) => e.type === 'blob');
+  const entries = fromWorktree
+    ? walkWorktreeEntries(REPO_ROOT)
+    : parseLsTree(git(['ls-tree', '-r', sha])).filter((e) => e.type === 'blob');
+  // A blob is named by its git object on the ref path and by its own path on the
+  // worktree path; everything downstream just wants the bytes.
+  const readBlob = (e) => (fromWorktree ? fs.readFileSync(path.join(REPO_ROOT, e.path)) : gitBuf(['cat-file', 'blob', e.sha]));
   const selected = entries.filter((e) => isPublishable(e.path) && !SYNTHESIZED_PATHS.has(e.path));
   // Drop npm-never-installed files (.gitignore, .npmignore, .npmrc) so the manifest +
   // tree_sha256 pin describe exactly what `npm install` materializes — otherwise the
@@ -798,7 +863,10 @@ function main() {
   // auto-rolls-back (idea 1000543). Done here, so they never reach the tarball or the pin.
   const npmStripped = selected.filter((e) => isNpmStripped(e.path));
   const publishable = selected.filter((e) => !isNpmStripped(e.path));
-  console.error(`[package-core] ${ref} = ${sha.slice(0, 12)} — ${entries.length} files, ${publishable.length} in the core (+2 synthesized), ${entries.length - publishable.length - 2} excluded.`);
+  // The worktree walk is already allowlist-scoped and never offers the two synthesized
+  // paths, so only the ref path discounts them from what it enumerated.
+  const excludedCount = entries.length - selected.length - (fromWorktree ? 0 : SYNTHESIZED_PATHS.size);
+  console.error(`[package-core] ${ref}${sha ? ` = ${sha.slice(0, 12)}` : ''} — ${entries.length} files, ${publishable.length} in the core (+2 synthesized), ${excludedCount} excluded.`);
   if (npmStripped.length) {
     console.error(`[package-core] dropped ${npmStripped.length} npm-never-installed file(s) from the pin (npm strips these on install; idea 1000543): ${npmStripped.map((e) => e.path).join(', ')}`);
   }
@@ -811,14 +879,24 @@ function main() {
   //     SOURCE files at this ref (never the live working tree, so --ref stays
   //     reproducible) — express+pg only, name @bongos/core, version = the
   //     platform version being packaged.
-  const pkgJsonBlob = entries.find((e) => e.path === 'package.json');
-  const pkgLockBlob = entries.find((e) => e.path === 'package-lock.json');
-  if (!pkgJsonBlob || !pkgLockBlob) {
-    console.error('refusing: source package.json/package-lock.json not found at this ref — cannot synthesize the core package.');
+  //     On the worktree path there is no ref to stay reproducible against, so the two
+  //     files come off disk beside everything else in the build.
+  const sourceRootFile = (rel) => {
+    if (fromWorktree) {
+      const abs = path.join(REPO_ROOT, rel);
+      return fs.existsSync(abs) ? fs.readFileSync(abs) : null;
+    }
+    const blob = entries.find((e) => e.path === rel);
+    return blob ? gitBuf(['cat-file', 'blob', blob.sha]) : null;
+  };
+  const pkgJsonRaw = sourceRootFile('package.json');
+  const pkgLockRaw = sourceRootFile('package-lock.json');
+  if (!pkgJsonRaw || !pkgLockRaw) {
+    console.error(`refusing: source package.json/package-lock.json not found at ${fromWorktree ? 'the repo root' : 'this ref'} — cannot synthesize the core package.`);
     process.exit(1);
   }
-  const sourcePkgJson = JSON.parse(gitBuf(['cat-file', 'blob', pkgJsonBlob.sha]).toString('utf8'));
-  const sourcePkgLock = JSON.parse(gitBuf(['cat-file', 'blob', pkgLockBlob.sha]).toString('utf8'));
+  const sourcePkgJson = JSON.parse(pkgJsonRaw.toString('utf8'));
+  const sourcePkgLock = JSON.parse(pkgLockRaw.toString('utf8'));
   const corePkgJson = buildPackageJson({ version, sourceDeps: sourcePkgJson.dependencies, sourceOverrides: sourcePkgJson.overrides });
   const corePkgLock = prunePackageLock(sourcePkgLock, {
     name: corePkgJson.name, version, rootRanges: { express: corePkgJson.dependencies.express, pg: corePkgJson.dependencies.pg },
@@ -865,7 +943,7 @@ function main() {
   let stubCount = 0; // agent docs (CLAUDE.md/AGENTS.md) replaced with the brand-free stub (task 2121)
   for (const e of publishable) {
     let raw;
-    try { raw = gitBuf(['cat-file', 'blob', e.sha]); }
+    try { raw = readBlob(e); }
     catch (err) { leaks.push({ path: e.path, label: `read-failed:${err.message}` }); continue; }
     const { buf, leaks: fileLeaks, advisories: fileAdvisories, kind } =
       processCoreFile({ pathRel: e.path, raw, rules, sensitiveLiterals, envSecrets, knownDocNames });
@@ -955,7 +1033,7 @@ function main() {
 
   console.error('');
   console.error(`[package-core] Cloud Bongos core v${version} packaged (contract ^${contract}).`);
-  console.error(`  source_commit  ${sha}`);
+  console.error(`  source_commit  ${sha || '(none — built from the working tree)'}`);
   console.error(`  file_count     ${filesMeta.length}`);
   console.error(`  tree_sha256    ${treeHash}`);
   console.error(`  tarball        ${path.relative(REPO_ROOT, tgzPath)}  (${(tgz.length / 1024).toFixed(1)} KiB, sha256 ${sidecar.tarball.sha256.slice(0, 12)}…)`);
@@ -1059,6 +1137,8 @@ module.exports = {
   leakScanVerdict,
   // task 1002217 (audit H4) — the fixed neutral floor injected into the doc-redaction + fail-closed gate
   PRIOR_INSTANCE_FLOOR,
+  // task 1003995 — --from-worktree's enumerator, for a core checkout with no git history
+  walkWorktreeEntries,
 };
 
 if (require.main === module) main();

package/scripts/gds/paste-token.js

@@ -28,6 +28,13 @@ const ic = require('../../src/instance-config');
 // Destructured for the same reason as cli-lib: a namespace-only `ic.X` read is
 // invisible to knip, which then calls the export dead code.
 const { SESSION_FILENAMES, readSessionConfigSync } = require('../../src/instance-config');
+// SESSIONS ARE PER INSTANCE (ADR 0269), and saveSession is what makes that true — see
+// step 4. Requiring cli-lib here was weighed rather than assumed: it costs ~13ms and
+// prints nothing at load (undici and the surface machinery are all lazy), and login.js
+// — the sibling pre-session flow, shipped in the same standalone on-ramp bundle as this
+// script — already requires it. So this adds no module to the package and no visible
+// cost to a paste. (task 1004003)
+const { saveSession } = require('./cli-lib');
 
 // WRITE the session to the configured instance dir (OTB → ~/.config/otb,
 // unchanged; a fresh instance → its neutral dir). R61 / task 1200.
@@ -160,10 +167,20 @@ async function main() {
     api_base: API_BASE,
   };
 
-  // 4. Ensure dir exists with safe perms, then write 0600.
+  // 4. Ensure dir exists with safe perms, then save 0600 THROUGH saveSession.
+  //
+  // WHY NOT A BARE writeFileSync HERE (task 1004003). This used to write SESSION_PATH
+  // directly, which is the ACTIVE POINTER and nothing else. Under ADR 0269 a machine has
+  // several instances, and saveSession is the only writer that knows it: it archives the
+  // OUTGOING session into the host-keyed store before overwriting the pointer, and files
+  // the incoming one there too. Writing the pointer directly skipped both, so pasting a
+  // token for instance B while signed in to instance A destroyed A's session with no
+  // archive — and `bongos login <A>`, which exists to switch back without a device flow,
+  // reads that store and found nothing, so the switch back cost a full re-auth. The state
+  // was unrecoverable, because the pointer is the file that was overwritten.
   try {
     fs.mkdirSync(path.dirname(SESSION_PATH), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(SESSION_PATH, JSON.stringify(next, null, 2), { mode: 0o600 });
+    await saveSession(next);
     // chmod again in case the file already existed with looser perms (writeFile's
     // mode arg is ignored when the file already exists on some platforms).
     fs.chmodSync(SESSION_PATH, 0o600);

package/scripts/gds/provision-repo.js

@@ -399,7 +399,17 @@ function installedCorePackDir({ instanceRoot, fsImpl = fs } = {}) {
   return null;
 }
 
-// Resolve a vendorable @bongos/core tarball — the three-rung ladder, freshest-correct
+// Can package-core.js enumerate this checkout from GIT? It builds the core set from
+// `git ls-tree` at a ref, so a checkout with no `.git` aborts at `git rev-parse HEAD` —
+// and that is not a broken install, it is the SHIPPED SELF-HOST IMAGE: .dockerignore
+// excludes .git by design, so /app is a complete core source tree with no history
+// (task 1003995). The presence of `.git` — a directory in a clone, a file in a linked
+// worktree — is the whole question. fs injectable for tests; read-only → dry-run safe.
+function coreCheckoutHasGit({ repoRoot = REPO_ROOT, fsImpl = fs } = {}) {
+  return fsImpl.existsSync(path.join(repoRoot, '.git'));
+}
+
+// Resolve a vendorable @bongos/core tarball — the four-rung ladder, freshest-correct
 // first, shared by the fresh scaffold and the re-provision pin refresh (task 1003050):
 //   1. a `file:`-pinned control plane reuses its own pinned tarball (task 1002275 —
 //      rebuilding via package-core.js aborts with an EMPTY core set when this runner
@@ -408,31 +418,37 @@ function installedCorePackDir({ instanceRoot, fsImpl = fs } = {}) {
 //      it has INSTALLED — the child pins the SAME, CURRENT core the hub runs, ending
 //      the frozen-old-tarball births (task 1002706, gap 13) without requiring the
 //      child's owner to hold a token for the still-private registry package;
-//   3. a genuine core source checkout rebuilds fresh via package-core.js.
+//   3. a genuine core source checkout rebuilds fresh via package-core.js;
+//   4. a core checkout with NO git history — the self-host image — packs its working
+//      tree via package-core.js --from-worktree (task 1003995). LAST because it is the
+//      only rung with no commit to anchor the artifact to: whenever history is there,
+//      rung 3's reproducible build is the better answer for the identical file set.
 // Returns { tgz, packDest } — packDest (set only on rung 2) is a temp dir the CALLER
 // must `rm -rf` once the tarball has been vendored.
-function resolveVendorableCoreTarball({ instanceRoot, exec, log, coreV, tag = '[core]' }) {
-  let tgz = installedCoreTarball({ instanceRoot });
-  let packDest = null;
-  if (tgz) {
-    log(`  ${tag} reusing the pinned core tarball this control plane runs (${path.basename(tgz)}) — no source rebuild (task 1002275)`);
+function resolveVendorableCoreTarball({ instanceRoot, repoRoot = REPO_ROOT, exec, log, coreV, tag = '[core]' }) {
+  const pinned = installedCoreTarball({ instanceRoot });
+  if (pinned) {
+    log(`  ${tag} reusing the pinned core tarball this control plane runs (${path.basename(pinned)}) — no source rebuild (task 1002275)`);
+    return { tgz: pinned, packDest: null };
+  }
+  const packSrc = installedCorePackDir({ instanceRoot });
+  if (packSrc) {
+    // Keyed by VERSION, not slug: no request-derived value enters this command, and
+    // two concurrent scaffolds of the same core pack identical bytes — collision-safe.
+    const packDest = path.join(os.tmpdir(), `bongos-core-pack-${packSrc.version}`);
+    log(`  ${tag} packing the registry-installed core this control plane runs (v${packSrc.version}) — no source rebuild (task 1002706)`);
+    exec(`mkdir -p ${packDest}`);
+    exec(`npm pack ${packSrc.dir} --pack-destination ${packDest}`);
+    return { tgz: path.join(packDest, packSrc.tarballName), packDest };
+  }
+  if (coreCheckoutHasGit({ repoRoot })) {
+    log(`  ${tag} building a fresh vendored tarball from source (package-core.js)`);
+    exec(`node scripts/gds/package-core.js`);                      // cwd = REPO_ROOT → dist/bongos-core-<v>.tgz
   } else {
-    const packSrc = installedCorePackDir({ instanceRoot });
-    if (packSrc) {
-      // Keyed by VERSION, not slug: no request-derived value enters this command, and
-      // two concurrent scaffolds of the same core pack identical bytes — collision-safe.
-      packDest = path.join(os.tmpdir(), `bongos-core-pack-${packSrc.version}`);
-      log(`  ${tag} packing the registry-installed core this control plane runs (v${packSrc.version}) — no source rebuild (task 1002706)`);
-      exec(`mkdir -p ${packDest}`);
-      exec(`npm pack ${packSrc.dir} --pack-destination ${packDest}`);
-      tgz = path.join(packDest, packSrc.tarballName);
-    } else {
-      log(`  ${tag} building a fresh vendored tarball from source (package-core.js)`);
-      exec(`node scripts/gds/package-core.js`);                    // cwd = REPO_ROOT → dist/bongos-core-<v>.tgz
-      tgz = path.join(REPO_ROOT, 'dist', `bongos-core-${coreV}.tgz`);
-    }
+    log(`  ${tag} this checkout IS the core and carries no git history — packing the working tree (package-core.js --from-worktree, task 1003995)`);
+    exec(`node scripts/gds/package-core.js --from-worktree`);
   }
-  return { tgz, packDest };
+  return { tgz: path.join(repoRoot, 'dist', `bongos-core-${coreV}.tgz`), packDest: null };
 }
 
 // The onboard mode a provisioning row carries (migration provisioning_004, task 1002562).
@@ -633,7 +649,7 @@ async function scaffoldStandaloneRepo(inst, deps) {
     const spec = instanceInitSpec(inst, { ownerLogin });
     const specPath = path.join(os.tmpdir(), `bongos-init-${inst.slug}.json`);
     writeFile(specPath, JSON.stringify(spec, null, 2));
-    // Vendored tarball — resolveVendorableCoreTarball's three-rung ladder (shared
+    // Vendored tarball — resolveVendorableCoreTarball's four-rung ladder (shared
     // with the re-provision pin refresh, task 1003050).
     const { tgz, packDest } = resolveVendorableCoreTarball({
       instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[scaffold] core install:',
@@ -1007,6 +1023,7 @@ module.exports = {
   ownerLoginOf,
   asPostgres,
   buildCorePinRefreshCommit,
+  coreCheckoutHasGit,
   dbCreateCmd,
   dbName,
   dbRoleCmd,

package/scripts/gds/provision.js

@@ -50,7 +50,7 @@ const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
-const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
+const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
@@ -1457,6 +1457,8 @@ module.exports = {
   parseTargetRef, instanceRepoRemote, instanceInitSpec, installedCoreTarball, installedCorePackDir, scaffoldStandaloneRepo, coreVersionSafe,
   // re-provision core-pin refresh (gap-list W3, task 1003050)
   resolveVendorableCoreTarball, planCorePinRefresh, safeVersionLabel, buildCorePinRefreshCommit, refreshStandaloneCorePin,
+  // the git-less core checkout — the self-host image's rung (task 1003995)
+  coreCheckoutHasGit,
   // adopt vs greenfield onboarding (ADR 0121, task 1002562)
   onboardMode, alreadyScaffolded,
   // private-repo deploy key (ADR 0176, task 1002735)