@bongos/core 1.19.911 → 1.19.912

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.911",
-  "core_contract": "1.19.911",
-  "source_commit": "cabe904a411a1173750424491d289d428be9f56d",
+  "core_version": "1.19.912",
+  "core_contract": "1.19.912",
+  "source_commit": "d9093cd602f014a948cee8ac7ea27f36d4be922b",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T15:49:27.325Z",
+  "built_at": "2026-09-20T16:20:10.208Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 503,
+    "docs_redacted": 504,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2287,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2816,
-  "tree_sha256": "c6780dcf9d3b31846621cbc9ad6fb681cd2ed710c21c2c308e99e612d4330d3f",
+  "file_count": 2817,
+  "tree_sha256": "e4f492bda78fcddcc35a433c3f5c7ca4b3e193298e923da342a7326e182fb695",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2062,12 +2062,17 @@
     {
       "path": "docs/adr/0314-module-protection-is-per-path-not-per-module.md",
       "mode": "0000644",
-      "sha256": "541a0ae0223982fe53fcf96e3c4a9509e94101d04db0a87395f39cc1bcd881e8"
+      "sha256": "accaba461051e427c251e9c4ec4ff74304447fd6cd68f940311f4b978ff234c2"
+    },
+    {
+      "path": "docs/adr/0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md",
+      "mode": "0000644",
+      "sha256": "bc9dde45a33790e4fbce47682a5734a1adaf4fdd7f9347bb0128c6cca6fcf4e5"
     },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "4bd65e814cacf8b886b542bf7741dff8f61e9aad3e101db1af2bd28e0eb1a49e"
+      "sha256": "a6bf1805ee02ca941a1910d722cfc61e4f0e519aa79c9d102aadfb8bf7d95a5a"
     },
     {
       "path": "docs/api-reference.md",
@@ -2637,7 +2642,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "801631cd9a51ad17337416dd08612a0a7963ba950f41b4660e8524284acdb5de"
+      "sha256": "1dfb3933a3ce48499941b71978e9f462fe97c49e7d472b71022b654850093e3b"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2857,7 +2862,7 @@
     {
       "path": "docs/recipes/self-host.md",
       "mode": "0000644",
-      "sha256": "853761ea1330806204c35bcdda680af64fac1f096be1a1296d9d59ed9d54fabd"
+      "sha256": "2a8a4075086fbcc2815c7b809f38dd887726e53561755e65a7990a687772cf7c"
     },
     {
       "path": "docs/recipes/server-bring-up.md",
@@ -7792,12 +7797,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d1e016c5b7678739cb8ea7f91f8d7260c60288775ce8c2817ae0d241573b793d"
+      "sha256": "d424dadd5439bf9883d9e0e44a938ed30a2e5c63f4dd1ed336e6130dbef959e6"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "81148ca44a809ff5b54610f520e24171361dcf3bef297e7c0c8ae2e9b46a4bc6"
+      "sha256": "ffdc1c047d136b67d5443336e8c8874b9cf7c13868a908a486470ffdcc780f3c"
     },
     {
       "path": "public-docs/index.html",
@@ -8752,7 +8757,7 @@
     {
       "path": "scripts/gds/provision-net.js",
       "mode": "0000644",
-      "sha256": "f1ca176ff8cdb8de65940af1e30316db600cb5df529abbc997697abf1cbc2c2d"
+      "sha256": "734ae6982953f2474d424bf16789adfb709b5657ce62014df5c29a791506a988"
     },
     {
       "path": "scripts/gds/provision-process.js",
@@ -8782,7 +8787,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "71d4edd0e5653207a535e6a0febca39a19ba281ffce7f248049b826dc5ab3b84"
+      "sha256": "8722cf581fac65b5839f2b44987c9b09b721452d8f20d2079f2029b386841396"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9607,7 +9612,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "7f393fc515fe751d5296ce0a574e0d3e40695c0346933a0d8b9c30ed6ae39a1b"
+      "sha256": "b82d3257c27689e53b3d491251cc46d474c8f4da944e2e8f73242525df878484"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -9797,7 +9802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6d6e0bee05301dd054fa2f445d0a8a2ba456e016c0e3ad22cbe63aa9f9b455ae"
+      "sha256": "b0f164fe792662f67fe4184880ea2197ae4b22bec2696fdcb1693778caf44999"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12297,7 +12302,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "b2609440d099b93b61c63c3cdaa4cf6e65c6dc107b8aa4d06d9cb81c9ec5e2c9"
+      "sha256": "fae747eaeea8e9d657de097a72e5f8d244bd2ece6c7e890ff4c9756787721bc5"
     },
     {
       "path": "tests/module_api.mjs",
@@ -12782,7 +12787,7 @@
     {
       "path": "tests/provision_caddy_wiring.mjs",
       "mode": "0000644",
-      "sha256": "a4d448622c05e963602cbc0488215ba168c909bd12cd0db20eaa6fcb7de7a91e"
+      "sha256": "2eb850e431c5355d2645eec48554c686ad5b57222ee863489a29b78d945b7a26"
     },
     {
       "path": "tests/provision_disconnect.mjs",
@@ -12967,7 +12972,7 @@
     {
       "path": "tests/quarantine_canonical.mjs",
       "mode": "0000644",
-      "sha256": "d8a2376c5ff96d77378626c9b4d1c32660e8412afb2531cf93085564890ffdef"
+      "sha256": "672096eb5917d45b1c77e1d07c4b7a6613a0714eb4b38327057fcea11a41b7ad"
     },
     {
       "path": "tests/rank_floor_wiring.mjs",

package/docs/adr/0314-module-protection-is-per-path-not-per-module.md

@@ -1,6 +1,6 @@
 # ADR 0314 — A module owns a protected path without the whole module becoming protected
 
-- **Status:** accepted (design only — the implementation is a follow-up, see *Not built here*)
+- **Status:** accepted — **implemented** by [task 1004109](https://cloudbongos.com/builders#/task/1004109) (2026-09-20)
 - **Date:** 2026-09-20
 - **Task:** [task 1004070](https://cloudbongos.com/builders#/task/1004070), goal 1000095 — BONGOS-V2
 - **From:** idea 1000689; owner decision 2026-09-19 — *option 1, narrow what counts as protected*
@@ -105,7 +105,12 @@ Three reasons this is the honest shape rather than the convenient one:
 Per the task: an ADR first, implementation as a follow-up. This decision builds no
 new derivation mechanism. Filed separately:
 
-- The implementation of the per-path goal-scope wall.
+- ~~The implementation of the per-path goal-scope wall.~~ **Landed** in
+  [task 1004109](https://cloudbongos.com/builders#/task/1004109): `isProtected` now
+  filters a module's protecting globs to those that are not CLI entrypoints (a
+  structural path test — directories under `scripts/` are territory and still
+  protect), narrowing the derived set from twelve to the nine predicted below.
+  Nothing was unprotected to achieve it and the path wall did not move.
 - **`builder-settings`, deliberately out of scope.** Its overlap is
   `src/bongos/routes/me.js` caught by the blanket `src/bongos/routes/` prefix, so
   narrowing it means either finishing the strangler move of `me.js` into

package/docs/adr/0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md

@@ -0,0 +1,96 @@
+# ADR 0315 — A plane with no proxy is refused, not given a no-op ingress
+
+**Status:** accepted · **Date:** 2026-09-20 · **Task:** [task 1004017](https://cloudbongos.com/builders#/task/1004017) (goal 1000106 — BONGOS-V2)
+
+**Related:** [ADR 0303](0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md) (detect-and-refuse on the base Caddyfile — the check this one sits in front of) · [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) (the supervision seam that explicitly deferred Caddy reload to this task) · [ADR 0285](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md) (the capacity preflight this one is ordered behind) · [ADR 0111](0111-instance-hosting-provisioning-module.md) (the standup runbook both checks live inside)
+
+## Context
+
+Provisioning step 6 writes a per-instance `<slug>.caddy` snippet and runs
+`systemctl reload caddy`. The self-host image installs `postgresql-client bash tini curl
+ca-certificates git`, runs `USER node`, and ships no proxy of any kind — so on a compose
+self-host that step cannot work, and a child instance provisioned there has no front door.
+
+ADR 0306 named this explicitly as the piece its seam does not cover: *"`systemctl reload
+caddy` is shared-proxy config, governed by ADR 0303, and the container has no Caddy at
+all — that is task 1004017, not this seam."*
+
+**Two failure shapes, and only one of them was visible.** ADR 0303's preflight is gated on
+`inst.domain`, so:
+
+- A **domained** child already half-refused — `caddy adapt` fails with no binary, which
+  ADR 0303's own `catch` turns into a gap string. But the message told the operator to add
+  a directive to `/etc/caddy/Caddyfile`: a file the container does not have and that
+  provisioning will never create (ADR 0303 §1 forbids writing it).
+- A **domainless** child skipped the preflight entirely, walked to step 6, and died on
+  `boxWriteFile('/etc/caddy/sites/<slug>.caddy', …, {sudo: true})`. That throw is uncaught,
+  so it bypasses the `{ok:false}` pending-retry path and hard-errors the instance on attempt
+  one. The runner recorded a crash where the honest answer was a refusal.
+
+## Decision
+
+**A plane with no reverse proxy is refused before anything is attempted, and the refusal
+names what the plane lacks.**
+
+`ingressPlaneGap(exec)` in `scripts/gds/provision-net.js` probes the plane with
+`caddy version` — one cheap, unprivileged, read-only command, the same posture as
+`checkCaddyWiring`'s `caddy adapt`. It returns `null` when a proxy answers, or a string
+naming the missing proxy. Both standup legs (`provisionInstance` step 6's owner, and
+`domainAttachInstance`) call it and return `{ok:false, error: 'Ingress preflight failed: …'}`.
+
+**It is deliberately NOT domain-gated.** That is the whole point: the domainless child is
+the one ADR 0303 could not see.
+
+**A missing binary is the only failure that proves there is no proxy.** Under remote exec
+`boxExec` is `ssh <host> bash -s`, so a briefly-unreachable co-hosting box throws here too —
+and answering that with "this plane has no reverse proxy, provision from a host that runs
+Caddy" would be a confident wrong diagnosis, burning the intent's retry budget on a network
+blip. Exit 127 (and the `command not found` / `is not recognized` wordings) is read as proof;
+anything else returns *"could not confirm a reverse proxy on this plane"* with the real cause
+leading. ssh reports its own failures as 255 and otherwise propagates the remote command's
+status, so 127 still means "no caddy" across the hop.
+
+**The three refusals are ordered capacity → ingress → wiring**, cheapest and most
+fundamental first, and all three return before anything on the box changes:
+
+1. `capacityPreflight` measures locally (ADR 0285 promises a full box is measured first and
+   refuses before anything else runs);
+2. ingress asks whether this plane has a proxy **at all**;
+3. ADR 0303 then asks whether that proxy is wired for **this domain**.
+
+Asking 0303 first is what produced the "edit a Caddyfile you do not have" answer, so this
+ADR moves 0303's preflight behind the capacity measurement to make room. Both still refuse
+before any mutation, so neither guarantee is weakened — only the precedence between two
+refusals changes.
+
+**No ingress seam, and no no-op backend.** The obvious symmetry with ADR 0306 would be a
+`resolveIngress()` registry with a `none` implementation whose `writeSite`/`reload` are
+no-ops. That is rejected: a no-op backend lets the standup **succeed** while leaving the
+child unreachable, which is neither "reachable at a documented address" nor "refuses with a
+clear error" — it is the silently-broken instance this task exists to prevent. ADR 0306's
+seam exists because two real planes both need supervising; here the second plane cannot
+serve a child at all, and the honest encoding of that is a refusal, not an implementation.
+
+## Consequences
+
+- **A compose self-host still cannot provision a child instance — it now says so.** This
+  closes the failure mode, not the capability. Giving the container a real front door
+  (a published port, a bundled proxy, an explicit localhost-only shape) remains unbuilt, and
+  a future ADR that adds one replaces this refusal rather than extending it.
+
+- **One extra `caddy version` per applied standup.** Read-only, unprivileged, and it runs
+  after the capacity measurement, so a full box still refuses without it. A dry run never
+  probes, and a dedicated droplet is skipped — Caddy comes from cloud-init there.
+
+- **ADR 0303's territory is untouched.** "Caddy is here but mis-wired" is still its question
+  and still its message; this ADR only answers the prior one. Every command string ADR 0303
+  pins in `tests/provision_caddy_wiring.mjs`, `tests/provision.mjs` and
+  `tests/provision_teardown_address.mjs` is unchanged.
+
+- **Teardown is not covered.** `provision-teardown.js` removes the snippet and reloads with
+  `allowFail: true`, so it already degrades rather than crashing. Left alone deliberately: a
+  refusal on the teardown path would strand a row instead of cleaning it.
+
+- **The probe is a capability question, not a configuration knob.** There is no
+  `PROVISION_INGRESS` env var. A plane either answers `caddy version` or it does not, and an
+  operator who wants provisioning to proceed needs a proxy, not a flag that says to pretend.

package/docs/adr/README.md

@@ -406,3 +406,4 @@ This keeps the decision history honest and traceable.
 | 0312 | [**Provenance is a SECOND ideas-owned edge table, written by the seams that already know** ([task 1004080](https://cloudbongos.com/builders#/task/1004080), goal 1000095 — BONGOS-V2). The spike [ADR 0311](0311-an-idea-is-a-permanent-origin-tag.md) deferred: how the descent edges are physically recorded. A descent (`idea → task → rewrite → split → removal`) is four levels deep and crosses a version boundary, and the task hierarchy refuses both — `attachParent` enforces `SELF_PARENT`, `VERSION_MISMATCH`, `PARENT_HAS_PARENT` and `TARGET_HAS_CHILDREN`, all load-bearing for ship rollup and claim safety. The spike was told to CONFIRM `ideas_task_lineage` rather than assume it, and confirmed one half while refuting the other: the table is right as the **idea→task anchor** (bipartite, no depth cap, no version predicate) but CANNOT carry the task→task edge, because a derivation is a property of the task PAIR and [ADR 0236](0236-many-ideas-one-task-the-lineage-key-is-the-pair.md) made co-source ideas both legal and common — a `derived_from_task_id` column would write the same derivation once per co-source idea and let two rows disagree about where a task came from, the same under-keying that silently lost attribution on prod once already. A merge also gives a task SEVERAL parents, so the relation is a **DAG, not a tree**. Decision: a new `ideas_task_descent` (`task_id`, `parent_task_id`, CHECK'd `relation`, PK on the pair, indexed both ways), with NO depth cap and NO version predicate, and **cycles refused at write time** because the payout walks this graph and a cycle is a non-terminating walk rather than a cosmetic error. On who writes it — the question the task actually set, since an edge depending on memory will have holes — **three seams already know and none is telling anyone**: `cascade.js` encodes the originating task id inside `source_ref` as a STRING nothing can join on, `tasks.merged_into_task_id` already records the fold, and `parent_task_id` already records the split. Only `rewrite` and cross-version `merge` stay manual, which is honest — they are editorial acts with no automatic signal, and their absence degrades the picture rather than corrupting it. What it fixes: `sourceIdeaForTask` and `awardIdeaTaskShipCredit` are both one-hop `LIMIT 1` point reads, so a DERIVED task resolves to `no_source_idea` and the origin is not paid at all. Does not decide: the decay rate beyond its default, what counts as removed ([ADR 0313](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md)), or how any of it is drawn.](0312-provenance-is-a-second-ideas-owned-edge-table.md) | ideas / lifecycle |
 | 0313 | [**A removal is derived from the SERVER's own merge diff and confirmed by a person** ([task 1004081](https://cloudbongos.com/builders#/task/1004081), goal 1000095 — BONGOS-V2). The other half [ADR 0311](0311-an-idea-is-a-permanent-origin-tag.md) deferred: what counts as removed, so that brightness can fall at all. Nothing records it today — `shipped` is terminal (`rot.js` says so outright) and `merged_into_task_id` is CHECK'd to `abandoned` rows, describing only work cut BEFORE it landed. Owner decision 13 set the shape (system proposes, person confirms); this settles the detail, and corrects two premises the task was written on. **`cascade.js` is no longer empty** — it carries a production rule and [ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md) fixed the contract (append an entry, never touch the runner), so there is a precedent to copy including its anti-recursion guard. **`netNegativeBonusAmount` cannot be the trigger** despite being the named nearest signal: it is an aggregate with NO TARGET (it says deletion happened, never what or whose), it is CLIENT-SUPPLIED via `signals.diff_stats`, and `grader-score.js` already documents the forgery it defends against — and brightness sits beside a payout, so a forgeable target-less counter cannot carry it. **Nothing durable records what any ship touched**: `committed_files` and `diff_stats` are client-supplied at grade time and never persisted, `touches[]` is advisory ([ADR 0049](0049-split-parallel-safety-contract.md)), so a removal cannot be reconstructed from history — only derived as a ship lands. Decision: derive it from the SERVER's own merge diff ([ADR 0055](0055-server-mediated-branch-publish.md) — the server holds the repo and does the merge, so it computes the diff rather than being told one), and attribute the deleted hunks through **`claims.published_head_sha`** (`migrations/171`), NOT by parsing `(task NNNN)` out of commit text — only 7 of `main`'s last 15 commits carry a task id, and a convention that holds most of the time cannot underwrite a payout. An UNATTRIBUTABLE deletion files nothing: a wrong proposal costs attention and dims a real star. A rename, a move and a rewrite-in-place are NOT removals, and a cold body is not a remnant — removal applies only below a task that actually shipped. The proposal is an appended `CASCADES` entry filing a QUESTION; confirmation is Metic+/`task.promote` on the existing awaiting-nod surface; an unanswered one rots on the normal clock. Only a CONFIRMED proposal dims a star. The derivation must be NON-BLOCKING — landing work matters more than dimming a star on time. Brightness can only fall forward from here, so historical sizes need a marker or the number lies.](0313-a-removal-is-proposed-by-the-ship-and-confirmed-by-a-person.md) | ideas / lifecycle |
 | 0314 | [**A module owns a protected path without the whole module becoming protected** ([task 1004070](https://cloudbongos.com/builders#/task/1004070), goal 1000095 — BONGOS-V2). Three modules derive `protected` — and so are Archon-only to scope a goal to — because of ONE file that is not their domain: `onboarding` on `scripts/gds/setup.js`, `autonomy` on `scripts/gds/conductor-dispatch.js`, `copy-desk` on `scripts/gds/copy-inventory.js`. The owner chose *narrow what counts as protected*; the task set the fork and required the choice be justified before any glob moved. **Deleting the glob is out**: `MODULE_GLOBS` is also the territory deciding who may AUTHOR a task on a path, and the shared floor is only `tests/`, so an unowned path is authorable by no goal at all. That left reassigning each CLI to an already-protected module — **measured, not reasoned about**, by applying the edit to the source and re-requiring in a fresh process (`MODULE_SCOPE_MAP` is frozen and built from a COPY of `MODULE_GLOBS` at load, so an in-process mutation proves nothing and passes green). The measurement kills it: `copy-desk` and `autonomy` lose the ability to author on their own generator and their own conductor, and — the row that decides it — `devsecops` as the new owner **cannot author the generator together with the two artifacts it writes**, because `docs/copy-registry.json` and `docs/copy-inventory.md` stay `copy-desk`'s. So *change a UI string, regenerate the registry* becomes authorable by no single goal, and that is the ship-check freshness gate every UI task hits. Decision: **protection becomes per-path at the goal-scope wall, as it already is at the other three** — `matchProtected` decides task-authoring, the grader and gate decide ship, the post-push audit decides the dishonest case; only goal-creation asked about the MODULE, and that inconsistency is the whole defect. The derivation stays computed from `PROTECTED_GLOBS` and no flag is hand-set ([ADR 0086](0086-goal-scoped-work-hierarchy.md) §7 / SEC #863), and the Metic floor on those paths does not move. **Corrects the task's own numbers**: 12 of 26 modules derive protected, not 11, and `agents` (protected by `modules/agents/`, itself a protected glob) is absent from its list of seven — which is why the one thing this ADR SHIPS is a test pinning the full protected key set **by name**, a count assertion passing on the wrong twelve being exactly how that drifted. Implementation is deferred to task 1004109, per the task's own instruction to stop after the ADR. Also filed: `builder-settings` (task 1004110), whose overlap rides the blanket `src/bongos/routes/` prefix and so needs either the `me.js` strangler move or its own security ADR; and **nine protected paths owned by no module at all** (task 1004111) — the freshness generators, the merge-driver pair and `cli-lib.js` among them — found while checking whether deletion was viable, a pre-existing hole rather than one this opens. Does not decide: the floor a protected path carries, whether `scripts/gds/` deserves a shared-floor entry the way `tests/` has one, or how the nine unowned paths get a home.](0314-module-protection-is-per-path-not-per-module.md) | modules / permissions |
+| 0315 | [**A plane with no proxy is refused, not given a no-op ingress** ([task 1004017](https://cloudbongos.com/builders#/task/1004017), goal 1000106 — BONGOS-V2). The piece [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) explicitly deferred: the self-host image ships no proxy, so provisioning step 6's `<slug>.caddy` snippet write and `systemctl reload caddy` cannot work there and a child instance gets no front door. **Two failure shapes, only one visible**: a DOMAINED child already half-refused, because `caddy adapt` fails with no binary and [ADR 0303](0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md)'s own catch turns that into a gap — but the message told the operator to add a directive to `/etc/caddy/Caddyfile`, a file the container does not have and that ADR 0303 §1 forbids provisioning from creating; a DOMAINLESS child skipped that preflight entirely (it is gated on `inst.domain`), reached step 6 and died on the `sudo` write, an uncaught throw that bypasses the `{ok:false}` pending-retry path and hard-errors the instance on attempt one — a crash recorded where a refusal was the honest answer. Decision: `ingressPlaneGap(exec)` probes the plane with `caddy version` — one cheap unprivileged read, the same posture as `checkCaddyWiring` — and both standup legs refuse with `Ingress preflight failed: …`, deliberately NOT domain-gated, because the domainless child is the one 0303 could not see. **Only a missing binary proves there is no proxy**: under remote exec `boxExec` is `ssh <host> bash -s`, so an unreachable co-hosting box throws here too, and diagnosing a network blip as 'this plane has no proxy, provision elsewhere' would be a confident wrong answer that burns the intent's retry budget — exit 127 is read as proof, anything else answers 'could not confirm a reverse proxy on this plane' with the real cause leading. The three refusals are ordered **capacity → ingress → wiring**, cheapest and most fundamental first and all before any mutation, which moves 0303's preflight behind the ADR 0285 capacity measurement; both still refuse before anything changes, so only the precedence between two refusals moves. **No ingress seam and no no-op backend**, despite the obvious symmetry with 0306: a `none` implementation whose `writeSite`/`reload` are no-ops lets the standup SUCCEED while leaving the child unreachable — neither half of the task's done-when, and exactly the silently-broken instance it exists to prevent. Does not decide: what a child's front door IS on a container plane (a published port, a bundled proxy, an explicit localhost-only shape) — a future ADR that adds one replaces this refusal rather than extending it. Teardown is left alone on purpose: it already reloads `allowFail`, and refusing there would strand a row instead of cleaning it.](0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md) | provisioning / ingress |

package/docs/module-api-changelog.md

@@ -2296,5 +2296,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.909 with no explicit bump. run 35519966415. (task 1002620)
   1.19.911 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.910 with no explicit bump. run 35520751450. (task 1002620)
+  1.19.912 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.911 with no explicit bump. run 35522352719. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/self-host.md

@@ -39,7 +39,7 @@ Author `config/branding.json` from the neutral starter — see [the branding con
 
 **Or scaffold it with `bongos init`** ([task #1204](https://example.com/builders#/task/1204)): a short interview (or `bongos init --from spec.json` for a hands-free / CI run) that writes both config files, **seeds your first version + its done-when goal**, and **files the human-only kickoff steps** (register a GitHub OAuth app, first owner sign-in, repo binding, admission) as real tracked tasks — so a fresh instance has a claimable queue on day one instead of an empty hall. It never invents your branding (it points you at the fill prompt for that). Preview the whole plan with `bongos init --dry-run`.
 
-**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image now carries the tools the scaffold needs — git, and a core it can package out of its own `.git`-less checkout (task 1003995) — and supervision is no longer systemd-only: the runner picks a process manager, falling back to supervisord where systemd is not running (task 1003997, [ADR 0306](../adr/0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)). Three standup legs still assume a systemd box, so on a compose self-host a new project waits indefinitely: the container has no reverse proxy for a child instance's front door (task 1004017), cannot create the per-instance unix account that isolates one instance from another (task 1004018), and installs its backup dir as a hardcoded founder user (task 1002719). Note supervisord has no timer concept either, so a container-hosted instance gets no automatic DB backup — the standup log prints the `crontab` line to add instead. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
+**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image now carries the tools the scaffold needs — git, and a core it can package out of its own `.git`-less checkout (task 1003995) — and supervision is no longer systemd-only: the runner picks a process manager, falling back to supervisord where systemd is not running (task 1003997, [ADR 0306](../adr/0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)). Three standup legs still assume a systemd box, so on a compose self-host a new project cannot stand up: the container has no reverse proxy for a child instance's front door, cannot create the per-instance unix account that isolates one instance from another (task 1004018), and installs its backup dir as a hardcoded founder user (task 1002719). **The ingress leg now refuses instead of failing opaquely** (task 1004017, [ADR 0315](../adr/0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md)): provisioning probes the plane with `caddy version` and returns `Ingress preflight failed: …` naming the missing proxy, before it writes a Caddy snippet or reloads anything. Previously a domained child was told to edit an `/etc/caddy/Caddyfile` the container does not have, and a domainless one crashed on the snippet write. Giving the container a real front door is still unbuilt — the refusal closes the failure mode, not the capability. Note supervisord has no timer concept either, so a container-hosted instance gets no automatic DB backup — the standup log prints the `crontab` line to add instead. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
 
 ## Configuration surface
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.911",
+  "version": "1.19.912",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.911",
+      "version": "1.19.912",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.911",
+  "version": "1.19.912",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-net.js

@@ -270,6 +270,45 @@ function checkCaddyWiring(exec, opts = {}) {
   }
   return caddyWiringGap(res && res.stdout, { ...opts, caddyfile });
 }
+// Can this plane give a child instance a front door AT ALL? (task 1004017)
+//
+// ADR 0303 asks whether a box's Caddy is wired right. This is the question BEFORE it: the
+// self-host image installs no caddy binary and runs unprivileged, so step 6's snippet write
+// and `systemctl reload caddy` cannot work there. The 0303 preflight is gated on inst.domain,
+// so a DOMAINLESS child skipped it entirely and died on the write — a hard error on attempt
+// one, not the pending-retry a refusal earns. Probed, not configured: a plane either answers
+// `caddy version` or it does not. Same cheap-read posture as checkCaddyWiring — no privilege,
+// no config, no running server.
+// A MISSING BINARY is the only failure that proves there is no proxy. Under remote exec
+// boxExec is `ssh <host> bash -s`, which throws on a transport blip too — and diagnosing a
+// briefly-unreachable co-hosting box as "this platform has no proxy, provision elsewhere"
+// would be a confident wrong answer, the thing this check exists to stop. ssh reports its
+// OWN failures as 255 and otherwise propagates the remote command's status, so 127 still
+// means "no caddy" across the hop. cmd.exe says 9009 and words it differently.
+const NO_CADDY_BINARY = /command not found|not recognized as an internal|No such file or directory/i;
+function ingressPlaneGap(exec, { caddyfile = CONFIG.caddyfile } = {}) {
+  try { exec('caddy version'); return null; } catch (e) {
+    const why = String((e && (e.stderr || e.message)) || e).trim().slice(0, 200);
+    const status = e && e.status;
+    if (status !== 127 && status !== 9009 && !NO_CADDY_BINARY.test(why)) {
+      return `could not confirm a reverse proxy on this plane: 'caddy version' failed (${why}). Provisioning writes a Caddy site snippet for every child instance, so it refuses rather than assume — re-run once the box answers.`;
+    }
+    return `this plane has no reverse proxy, so a child instance would have no front door: 'caddy version' failed (${why}). Provision from a host that runs Caddy — a plane with no proxy cannot serve a child, and ${caddyfile} is not something provisioning will create.`;
+  }
+}
+// The preflight around ingressPlaneGap: the narration its sibling preflights already carry,
+// including the dry-run line without which the plan prints step 6's Caddy write as though it
+// will work. Returns the refusal, or null to proceed. `dedicated` skips it (Caddy comes from
+// cloud-init). Lives here rather than inline at the two call sites to keep provision.js under
+// its 1,500-line ratchet.
+function ingressPreflight({ exec, apply, log, shape, probe = ingressPlaneGap, before = 'writing any Caddy config' }) {
+  if (shape === 'dedicated') return null;
+  if (!apply) { log(`  [preflight] would probe the plane for a reverse proxy before ${before}`); return null; }
+  const missing = probe(exec);
+  if (missing) return `Ingress preflight failed: ${missing}`;
+  log('  [preflight] the plane serves a reverse proxy ✓');
+  return null;
+}
 function healthzCmd(inst) {
   return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/healthz`;
 }
@@ -322,6 +361,8 @@ module.exports = {
   healthzCmd,
   identityCmd,
   identityVerdict,
+  ingressPlaneGap,
+  ingressPreflight,
   shouldFederate,
   zoneForDomain,
 };

package/scripts/gds/provision.js

@@ -52,7 +52,7 @@ const crypto = require('node:crypto');
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
-const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
+const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, ingressPlaneGap, ingressPreflight, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { resolveProcessManager } = require('./provision-process.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
 const { installedCoreVersion, runnerBanner } = require('./runner-drift.js');
@@ -268,6 +268,14 @@ async function provisionInstance(inst, deps) {
       log(`  [preflight] would verify the Cloudflare token can reach zone ${zoneForDomain(inst.domain)} before the address step`);
     }
   }
+  const room = await capacityPreflight(inst, deps);   // box capacity (ADR 0285, task 1003927): an honest refusal BEFORE the status flip — never a silent oversubscribe
+  if (room.ok === false) return room;
+  // Ingress preflight (task 1004017, ADR 0315). Ordered capacity → ingress → wiring, all three
+  // before any mutation: ingress asks whether this plane has a proxy AT ALL, 0303 below whether
+  // that proxy is wired for THIS domain. Deliberately NOT domain-gated — a domainless child
+  // skipped 0303 entirely, reached step 6 and died on the snippet write.
+  const ingressGap = ingressPreflight({ exec: boxExec, apply, log, shape: inst.hosting_shape, probe: deps.ingressPlaneGap });
+  if (ingressGap) return { ok: false, error: ingressGap };
   // Caddy preflight (task 1002860, ADR 0303): a box whose base Caddyfile has no tls-check ask
   // can never certify this domain, so refuse before touching it. Injectable like the DNS check.
   const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;
@@ -275,8 +283,6 @@ async function provisionInstance(inst, deps) {
     const gap = caddyCheck(boxExec, { domain: inst.domain });
     if (gap) return { ok: false, error: `Caddy preflight failed: ${gap}` };
   }
-  const room = await capacityPreflight(inst, deps);   // box capacity (ADR 0285, task 1003927): an honest refusal BEFORE the status flip — never a silent oversubscribe
-  if (room.ok === false) return room;
   if (apply) await provisioning.setInstanceStatus(db, inst.id, 'provisioning');
   const patch = {};
 
@@ -750,6 +756,8 @@ async function domainAttachInstance(inst, deps) {
     }
     log(`  [preflight] DNS token can reach zone ${scope.zone} ✓`);
   }
+  const ingressGap = ingressPreflight({ exec: boxExec, apply, log, shape: inst.hosting_shape, probe: deps.ingressPlaneGap, before: 're-writing the Caddy snippet' });
+  if (ingressGap) return { ok: false, error: ingressGap };   // Ingress preflight (task 1004017, ADR 0315)
   const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;   // Caddy preflight (task 1002860, ADR 0303)
   if (apply) {
     const gap = caddyCheck(boxExec, { domain: inst.domain });

package/src/bongos/module-scope-map.js

@@ -456,12 +456,50 @@ const SHARED_GLOBS = Object.freeze(
   SHARED_GLOBS_RAW.filter((g) => !touchesOverlap([g], PROTECTED_GLOBS)),
 );
 
-// A glob set is protected iff it overlaps the imported PROTECTED_GLOBS — the one
-// source of truth (permission-path-check.js). Prefix-aware both directions
-// (path-match.touchesOverlap), so e.g. a module owning 'src/bongos/routes/inbox.js'
-// is protected because PROTECTED_GLOBS carries the 'src/bongos/routes/' subtree.
+// A CLI ENTRYPOINT — a single executable script under scripts/, e.g.
+// 'scripts/gds/setup.js'. Structural, not a list: it is a path test, so no roster
+// is hand-maintained here and nothing has to be kept in step with PROTECTED_GLOBS.
+// Directories ('scripts/deploy/', 'scripts/gds/hooks/') are territory, not
+// commands, and are deliberately NOT matched.
+function isCommandPath(glob) {
+  return /^scripts\/.*\.js$/.test(glob);
+}
+
+// Which of a module's globs make it protected? A glob qualifies iff it overlaps
+// the imported PROTECTED_GLOBS — the one source of truth (permission-path-check.js),
+// prefix-aware both directions (path-match.touchesOverlap), so e.g. a module owning
+// 'src/bongos/routes/inbox.js' qualifies because PROTECTED_GLOBS carries the
+// 'src/bongos/routes/' subtree.
+function protectingGlobs(globs) {
+  return (globs || []).filter((g) => touchesOverlap([g], PROTECTED_GLOBS));
+}
+
+// A module is protected iff it owns protected TERRITORY — ADR 0314.
+//
+// WHY THIS IS NOT JUST touchesOverlap(globs, PROTECTED_GLOBS) ANY MORE.
+//   That asked "does this module touch the trust core", and three modules answered
+//   yes because of exactly one CLI they own that happens to sit on a protected
+//   path: onboarding (scripts/gds/setup.js), autonomy (conductor-dispatch.js),
+//   copy-desk (copy-inventory.js). Owning the command is not owning the authority
+//   — modules/government/ IS government, but setup.js merely lives near
+//   onboarding — so the whole module became Archon-only to scope a goal to on the
+//   strength of one file that is not its domain. ADR 0314 narrows the QUESTION to
+//   the one the other three walls already ask: is the territory being scoped
+//   itself protected?
+//
+// So a protected CLI entrypoint no longer protects its owning module; protected
+// territory (a directory, or a non-command file like server.js or CLAUDE.md)
+// still does. The derivation stays COMPUTED from PROTECTED_GLOBS — no hand-set
+// flag, no override list (ADR 0086 §7 / SEC #863). It can only ever SHRINK the
+// protected set relative to the old rule, never grow it, because it filters a
+// subset: no module can become protected that was not protected before.
+//
+// THE WALL THAT MATTERS DOES NOT MOVE. This decides who may CREATE a goal whose
+// territory includes a protected path. It does not decide who may WRITE one: a
+// sub-Metic builder touching scripts/gds/setup.js is still refused by
+// checkPermissionPaths (goal-scope-check.js wall 2), exactly as before.
 function isProtected(globs) {
-  return touchesOverlap(globs || [], PROTECTED_GLOBS);
+  return protectingGlobs(globs).some((g) => !isCommandPath(g));
 }
 
 // The frozen exported roster: key → { globs:[...], protected:bool } (derived).

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.911'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.912'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module-scope-map.mjs

@@ -12,6 +12,9 @@ const { PROTECTED_GLOBS } = require(path.join(ROOT, 'src', 'bongos', 'permission
 // the REAL consumer of the roster — asserted against directly so a wall assertion
 // here can never diverge from what the live goal-task-create gate computes.
 const gsc = require(path.join(ROOT, 'src', 'bongos', 'goal-scope-check.js'));
+// the OLD protection rule, recomputed in-test so the shrink-only property below
+// is proved against real globs rather than a copied literal (ADR 0314).
+const { touchesOverlap } = require(path.join(ROOT, 'src', 'bongos', 'path-match.js'));
 
 test('roster covers the decided ~16 modules + kernel, each with non-empty globs', () => {
   const keys = scope.moduleKeys();
@@ -66,11 +69,21 @@ test('`protected` is DERIVED from the imported PROTECTED_GLOBS, never hand-set',
 //
 // So the set is spelled out. A module ARRIVING here is a deliberate line in a
 // diff; a module LEAVING is the one that must never happen quietly.
+// NARROWED TWELVE -> NINE BY ADR 0314 (task 1004109). `onboarding`, `autonomy`
+// and `copy-desk` left the set. Each derived protected on the strength of exactly
+// one CLI it owns that sits on a protected path — setup.js, conductor-dispatch.js,
+// copy-inventory.js — and owning the command is not owning the authority. Nothing
+// was unprotected to achieve it: the globs still belong to those modules, the
+// paths are still in PROTECTED_GLOBS, and a sub-Metic builder touching any of the
+// three is still refused by the path wall (asserted below). What changed is who
+// may CREATE a goal whose territory happens to include them.
+//
+// `builder-settings` STAYS, deliberately: its overlap is src/bongos/routes/me.js
+// caught by the blanket src/bongos/routes/ prefix, not a command, so narrowing it
+// needs the me.js strangler move or a blanket-glob change — out of scope here.
 const PROTECTED_MODULES = [
   'agents',
-  'autonomy',
   'builder-settings',
-  'copy-desk',
   'dev-box',
   'devsecops',
   'government',
@@ -78,7 +91,6 @@ const PROTECTED_MODULES = [
   'kernel',
   'lifecycle',
   'methodology',
-  'onboarding',
 ];
 
 test('the protected module set is exactly this, by name', () => {
@@ -133,6 +145,78 @@ test('isProtected actually consults PROTECTED_GLOBS (overlap, prefix-aware both
   assert.equal(scope.isProtected([]), false, 'empty scope is not protected');
 });
 
+// ADR 0314 — A PROTECTED CLI ENTRYPOINT NO LONGER PROTECTS ITS OWNING MODULE.
+//
+// These three are the whole reason the ADR exists: each derived protected on the
+// strength of exactly one command it owns that happens to sit on a protected
+// path. Owning the command is not owning the authority. They are asserted by
+// name rather than by count because a count passes on the wrong three.
+const COMMAND_ONLY_MODULES = [
+  ['onboarding', 'scripts/gds/setup.js'],
+  ['autonomy', 'scripts/gds/conductor-dispatch.js'],
+  ['copy-desk', 'scripts/gds/copy-inventory.js'],
+];
+
+test('a module protected ONLY by a CLI entrypoint it owns now derives non-protected', () => {
+  for (const [mod, cli] of COMMAND_ONLY_MODULES) {
+    const e = scope.scopeForModule(mod);
+    assert.ok(e, `fixture assumption: ${mod} is a roster key`);
+    assert.ok(e.globs.includes(cli), `fixture assumption: ${mod} still OWNS ${cli}`);
+    assert.ok(PROTECTED_GLOBS.includes(cli), `fixture assumption: ${cli} is still a protected surface`);
+    // The glob was not deleted and the path was not unprotected — only the
+    // question changed. That distinction is the ADR, so assert all three.
+    assert.equal(e.protected, false, `${mod} must no longer derive protected (ADR 0314)`);
+  }
+});
+
+test('...and creating a goal scoped to one is therefore no longer Archon-only', () => {
+  // The consequence the ADR was filed for: onboarding was Archon-mediated-join
+  // for a Metic because of setup.js. This is the assertion that would catch a
+  // revert of the behaviour while the name-pin above still passed.
+  for (const [mod] of COMMAND_ONLY_MODULES) {
+    assert.equal(scope.scopeIncludesProtected([mod]), false, `a goal scoped to ${mod} must not require Archon`);
+  }
+});
+
+test('protected TERRITORY still protects — a directory, and a non-command file', () => {
+  // The other side of the rule. If this ever goes false the ADR has been
+  // over-applied and the trust core is scopeable by anyone.
+  assert.equal(scope.isProtected(['migrations/']), true, 'a protected directory is territory');
+  assert.equal(scope.isProtected(['modules/government/']), true, 'a module namespace is territory');
+  assert.equal(scope.isProtected(['server.js']), true, 'a protected non-command file is territory');
+  assert.equal(scope.isProtected(['CLAUDE.md']), true, 'a protected doc is territory');
+  // A DIRECTORY under scripts/ is territory, not a command — the boundary the
+  // path test has to get right, since both start with 'scripts/'.
+  assert.ok(PROTECTED_GLOBS.includes('scripts/deploy/'), 'fixture assumption: scripts/deploy/ is protected');
+  assert.equal(scope.isProtected(['scripts/deploy/']), true, 'a protected directory under scripts/ is territory');
+  assert.ok(PROTECTED_GLOBS.includes('scripts/gds/hooks/'), 'fixture assumption: scripts/gds/hooks/ is protected');
+  assert.equal(scope.isProtected(['scripts/gds/hooks/']), true, 'scripts/gds/hooks/ is a directory, not a command');
+});
+
+test('a lone protected CLI computes non-protected, but a CLI PLUS territory does not', () => {
+  assert.equal(scope.isProtected(['scripts/gds/setup.js']), false, 'a lone protected CLI does not protect');
+  assert.equal(
+    scope.isProtected(['scripts/gds/setup.js', 'migrations/']), true,
+    'one command must not mask owned territory — the mixed case is still protected',
+  );
+});
+
+test('ADR 0314 can only SHRINK the protected set, never grow it', () => {
+  // The safety property that makes this a narrowing and not a re-derivation: the
+  // new rule filters a SUBSET of the globs the old rule accepted, so no module
+  // can arrive in the protected set that was not already in it. Computed here
+  // from the OLD rule rather than from a literal, so it keeps holding as the
+  // roster changes.
+  const oldRule = (globs) => touchesOverlap(globs || [], PROTECTED_GLOBS);
+  for (const k of scope.moduleKeys()) {
+    const globs = scope.scopeForModule(k).globs;
+    if (scope.isProtected(globs)) {
+      assert.equal(oldRule(globs), true, `${k} is newly protected — the rule grew the set, which it must never do`);
+    }
+  }
+});
+
+
 test('globsForModules flattens a scope set; unknown keys contribute nothing', () => {
   const g = scope.globsForModules(['ideas']);
   assert.ok(g.includes('modules/ideas/'), 'ideas owns its module directory (carved BV1.R78)');

package/tests/provision_caddy_wiring.mjs

@@ -9,7 +9,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const P = require('../scripts/gds/provision.js');
-const { caddyWiringGap, checkCaddyWiring } = require('../scripts/gds/provision-net.js');
+const { caddyWiringGap, checkCaddyWiring, ingressPlaneGap } = require('../scripts/gds/provision-net.js');
 
 const DOMAIN = 'mercury.example.com';
 // What `caddy adapt` prints: 2.7 writes the ask as a string, 2.8+ as a permission module.
@@ -63,11 +63,13 @@ const WEB_ENV = 'PORT=3010\nBONGOS_PUBLIC_ORIGIN=https://old.example.com\n';
 
 // `served` = the hosts Caddy's resolved config carries once a snippet is written — the
 // fake flips to them after the first .caddy write, like the real import would.
-function harness({ onDemand = ASK_27, importsSnippets = true, reloadFails = false } = {}) {
+function harness({ onDemand = ASK_27, importsSnippets = true, reloadFails = false, noProxy = false } = {}) {
   const cmds = [], writes = [], statuses = [];
   let snippetWritten = null;
   const exec = (cmd, opts = {}) => {
     cmds.push({ cmd, opts });
+    // A plane with no proxy at all: the self-host image installs no caddy binary.
+    if (noProxy && /^caddy /.test(cmd)) { const e = new Error('Command failed'); e.stderr = Buffer.from('bash: caddy: command not found'); throw e; }
     if (cmd.startsWith('caddy adapt')) return { ok: true, stdout: adapted({ onDemand, hosts: importsSnippets && snippetWritten ? [snippetWritten] : [] }) };
     if (/cat\b.*web\.env/.test(cmd)) return { ok: true, stdout: WEB_ENV };
     if (/reload caddy/.test(cmd) && reloadFails) throw new Error('Job for caddy.service failed');
@@ -146,3 +148,75 @@ test('domain-attach: refused before the env patch without the ask; fails loudly
   assert.equal((await P.domainAttachInstance(activeStandalone, wired.deps)).ok, true);
   assert.notEqual(wired.cmds.find((c) => /reload caddy/.test(c.cmd)).opts.allowFail, true);
 });
+
+// -- the plane has no reverse proxy AT ALL (task 1004017) -------------------
+// ADR 0303 asks whether a box's Caddy is wired right. This is the prior question:
+// the self-host image ships no proxy, so a child instance provisioned inside it gets
+// a snippet write and a `systemctl reload caddy` that cannot work.
+
+test('ingressPlaneGap: a plane that answers `caddy version` is wired; one that cannot is named as lacking a proxy', () => {
+  const cmds = [];
+  assert.equal(ingressPlaneGap((c) => { cmds.push(c); return { ok: true, stdout: 'v2.8.4' }; }), null);
+  assert.deepEqual(cmds, ['caddy version'], 'one cheap, unprivileged probe — no config read, no running server');
+  const boom = () => { const e = new Error('Command failed'); e.stderr = Buffer.from('bash: caddy: command not found'); throw e; };
+  const gap = ingressPlaneGap(boom);
+  assert.match(gap, /no reverse proxy/, 'names what the plane lacks');
+  assert.match(gap, /command not found/, 'carries the real reason');
+});
+
+test('ingressPlaneGap: only a MISSING BINARY proves there is no proxy — a transport failure says it could not confirm', () => {
+  // boxExec is `ssh <host> bash -s` for a co-tenant, so an unreachable box throws here too.
+  // Diagnosing that as "this platform has no proxy, provision elsewhere" would be a confident
+  // wrong answer, and the intent would burn its retry budget on it.
+  const unreachable = () => { const e = new Error('Command failed'); e.status = 255; e.stderr = Buffer.from('ssh: connect to host box.example.com port 22: Connection timed out'); throw e; };
+  const unsure = ingressPlaneGap(unreachable);
+  assert.match(unsure, /could not confirm a reverse proxy/);
+  assert.match(unsure, /Connection timed out/, 'the real cause leads, not a parenthetical');
+  assert.doesNotMatch(unsure, /has no reverse proxy/, 'never asserts a diagnosis it cannot support');
+  // Exit 127 still means "no caddy" across the ssh hop — ssh reports its OWN failures as 255
+  // and otherwise propagates the remote command's status.
+  const remoteMissing = () => { const e = new Error('Command failed'); e.status = 127; e.stderr = Buffer.from(''); throw e; };
+  assert.match(ingressPlaneGap(remoteMissing), /has no reverse proxy/);
+  const cmdExe = () => { const e = new Error("'caddy' is not recognized as an internal or external command"); throw e; };
+  assert.match(ingressPlaneGap(cmdExe), /has no reverse proxy/, 'cmd.exe words it differently');
+});
+
+test('provision: a DOMAINLESS child on a plane with no reverse proxy is refused before a single write', async () => {
+  // The hole ADR 0303 leaves open: its preflight is gated on inst.domain, so a domainless
+  // child walked all the way to step 6 and died on the snippet write instead of being refused.
+  const h = harness({ noProxy: true });
+  const r = await P.provisionInstance({ ...coTenant, domain: null }, h.deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /no reverse proxy/);
+  assert.equal(h.writes.length, 0, 'nothing written — not the snippet, not web.env');
+  assert.ok(!h.ran(/reload caddy/), 'the reload that cannot work is never attempted');
+  assert.deepEqual(h.statuses, [], 'the instance never flips to provisioning');
+});
+
+test('provision: a domained child on a proxyless plane names the missing proxy, not a Caddyfile to edit', async () => {
+  const h = harness({ noProxy: true });
+  const r = await P.provisionInstance(coTenant, h.deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /no reverse proxy/);
+  assert.doesNotMatch(r.error, /add 'import|add 'on_demand_tls/, 'a plane that will never have Caddy is not told to edit a Caddyfile it does not have');
+  assert.equal(h.writes.length, 0);
+});
+
+test('domain-attach: a plane with no reverse proxy is refused before the env patch', async () => {
+  const h = harness({ noProxy: true });
+  const r = await P.domainAttachInstance(activeStandalone, h.deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /no reverse proxy/);
+  assert.equal(h.writes.length, 0, 'web.env untouched');
+  assert.ok(!h.ran(/reload caddy/));
+});
+
+test('a dry run never probes the plane, and a wired box still reloads Caddy loudly', async () => {
+  const dry = harness({ noProxy: true });
+  dry.deps.apply = false;
+  await P.provisionInstance(coTenant, dry.deps);
+  assert.ok(!dry.ran(/caddy version/), 'a dry run changes nothing and asks nothing of the box');
+  const wired = harness();
+  assert.equal((await P.provisionInstance(coTenant, wired.deps)).ok, true, 'ADR 0303 behaviour on a real box is unchanged');
+  assert.ok(wired.ran(/reload caddy/));
+});

package/tests/quarantine_canonical.mjs

@@ -22,11 +22,39 @@ const q = require('../modules/security/artifact-scan/quarantine.js');
 const SHORT = os.tmpdir();
 const LONG = fs.realpathSync.native(SHORT);
 
-test('canonical expands an 8.3 short name — plain realpathSync does not', () => {
+// eightDotThreeReason — why the 8.3 case cannot be evaluated on THIS box, or null (task 1004051).
+//
+// The assertion below it is a statement about one specific divergence: a Windows 8.3 short name,
+// which plain fs.realpathSync does NOT expand. Asking "do the two spellings differ?" is a
+// different question, and macOS is where the two come apart — there os.tmpdir() is /var/folders/…
+// against a real /private/var/folders/…, a SYMLINK divergence that plain realpathSync resolves
+// perfectly well, so the notEqual fails and the suite goes red over a fact that was never claimed
+// about that platform. So ask for the 8.3 signature itself (a `~N` component) rather than
+// inferring it from inequality.
+//
+// It must not read as a PASS either — the task 1003993 contract. This returns a REASON for
+// node:test's own skip, never a bare early `return`, which prints as ✔ over a case that never
+// ran. Same shape as shallowCloneReason() in tests/helpers.mjs (task 1004049); kept local
+// because the 8.3 question belongs to this file alone.
+function eightDotThreeReason() {
+  if (SHORT === LONG) {
+    return `${process.platform}: os.tmpdir() is already its canonical spelling, so there is no `
+      + 'second spelling to expand here';
+  }
+  if (!/~\d/.test(SHORT)) {
+    return `${process.platform}: os.tmpdir() (${SHORT}) diverges from its real path (${LONG}) for `
+      + 'a reason that is not an 8.3 short name — plain realpathSync resolves that kind, so the '
+      + '8.3 fact cannot be evaluated here';
+  }
+  return null;
+}
+const NO_8_3 = eightDotThreeReason();
+
+test('canonical reports where os.tmpdir() really points, whatever its spelling', () => {
   assert.equal(q.canonical(SHORT), LONG);
-  // The premise, stated so this test explains itself on a machine where it does not apply:
-  // if the two spellings are identical here, the rest is trivially true rather than wrong.
-  if (SHORT === LONG) return;
+});
+
+test('plain realpathSync does NOT expand an 8.3 short name', { skip: NO_8_3 ?? false }, () => {
   assert.notEqual(fs.realpathSync(SHORT), LONG, 'this is the fact the obvious fix gets wrong');
 });