@bongos/core 1.19.916 → 1.19.917

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.916",
-  "core_contract": "1.19.916",
-  "source_commit": "47aafa7b40067f457043c59439b6f75ce58010b7",
+  "core_version": "1.19.917",
+  "core_contract": "1.19.917",
+  "source_commit": "5e828ad0df8cbaa5a638c0365e6a9f993756b6f9",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T17:23:41.647Z",
+  "built_at": "2026-09-20T17:33:13.906Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 505,
+    "docs_redacted": 506,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2294,
+    "functional_verbatim": 2298,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2825,
-  "tree_sha256": "9fb2e229c3f92268ce44fe9fe75818d005889103f22ac2bf06d12ecfe2e86d84",
+  "file_count": 2830,
+  "tree_sha256": "5d48e907f305164b84433d1bad09d324336c2fb2924f148081143ff761c39f58",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2074,10 +2074,15 @@
       "mode": "0000644",
       "sha256": "d0597a50d8f9a23c8d6c81a595fe6af73640cf574ae32f64730078ac7e19c7a5"
     },
+    {
+      "path": "docs/adr/0317-a-plane-that-cannot-give-an-instance-its-own-account-is-refused.md",
+      "mode": "0000644",
+      "sha256": "4dd5bbb9c14e4ba19568646ceea2d29b66c46b99555d6c236a25b7b40097756c"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "005b960dede2131ea0e2f3b81afcb119d7b65ddb6ed81bb246896eff64a69320"
+      "sha256": "05a90e437ed0c53a9bcc4f310f9cb056c4f8aa333ab8953f2f56a20d4381f7f9"
     },
     {
       "path": "docs/api-reference.md",
@@ -2647,7 +2652,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ef9352b603ffafd1863959527fd70807e22baeee2daf3234155f0215e8b7c42c"
+      "sha256": "7459f942b736ed35b74c50c3f95279e64f3c80dc7e06d686aef147bf6c3bb62c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2867,7 +2872,7 @@
     {
       "path": "docs/recipes/self-host.md",
       "mode": "0000644",
-      "sha256": "2a8a4075086fbcc2815c7b809f38dd887726e53561755e65a7990a687772cf7c"
+      "sha256": "a5c98b8ee01461669a5f4ee5fa361e85e11915eb8326e060c4cf20841c35c07e"
     },
     {
       "path": "docs/recipes/server-bring-up.md",
@@ -3754,6 +3759,11 @@
       "mode": "0000644",
       "sha256": "75bb644b32a70b52ac544edb901abff91aad07701848a470cc52103dc7e74234"
     },
+    {
+      "path": "migrations/core_252_claims_published_head_sha_idx.sql",
+      "mode": "0000644",
+      "sha256": "4c7a47e03192ee2ed1e885d14a06854af40acb6472f52af40bcb36ad3e3ddb17"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -5492,7 +5502,7 @@
     {
       "path": "modules/lifecycle/cascade.js",
       "mode": "0000644",
-      "sha256": "b168a58926ee0506d3fba4f448c797b8611bc8ae0dfeca322086f22769e7ae35"
+      "sha256": "52e63c329e4546f0a8ce2ca75157b9974b23eeaabf155f7ea02ead4d8f9bb8a8"
     },
     {
       "path": "modules/lifecycle/check-rollup.js",
@@ -5587,7 +5597,7 @@
     {
       "path": "modules/lifecycle/db-ship.js",
       "mode": "0000644",
-      "sha256": "14c269ad1bf569976421c71e0814d47338bd11f9382e9949e2e01f6f6f15f6c7"
+      "sha256": "d280c54d35721d0a24090ab9cc3ac35d311d253d59d4ea57fb542e1232f5c744"
     },
     {
       "path": "modules/lifecycle/db-tasks.js",
@@ -5602,7 +5612,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "30c8884948a8dee8213c55279c12f06e104c7d95ab3d7fad9dc67506ed1ac1ab"
+      "sha256": "2dea49342bf4a9be1279e662240075e57c31855804c8407a212ea9c33934f95e"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -5759,6 +5769,11 @@
       "mode": "0000644",
       "sha256": "6176e109575f02c681240b809b85b272c438c7284a7fdd290cd87b46abdb9e7c"
     },
+    {
+      "path": "modules/lifecycle/removal-derivation.js",
+      "mode": "0000644",
+      "sha256": "ef63843d5d00230a90063c454a5ad7a9dc170ce26cedc99377807ae1ced3f7c0"
+    },
     {
       "path": "modules/lifecycle/rot.js",
       "mode": "0000644",
@@ -5827,7 +5842,7 @@
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
       "mode": "0000644",
-      "sha256": "e09bbf8000ada41c6eac7ab64dcfe476650a246a0b561a8b693992885136b3bd"
+      "sha256": "f4b080286870b6cd52cd59c5cb7c5a5127c3b0a90df50b7d87495d684767203b"
     },
     {
       "path": "modules/lifecycle/routes/mingle.js",
@@ -5927,7 +5942,7 @@
     {
       "path": "modules/lifecycle/tests/cascade.mjs",
       "mode": "0000644",
-      "sha256": "9439accf7648ef22000c75f3e315695c806969eb5a908275d7db33e5491499f8"
+      "sha256": "fc8c5cf14265515faf8dc63b17b80de1acbb7558a08d26808960244aec6e4377"
     },
     {
       "path": "modules/lifecycle/version-autoclose.js",
@@ -7832,12 +7847,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6da05875d670e2a4abe086ff6b24c3dd762dbb82943a155050be68774fde0516"
+      "sha256": "fd2d387fbc65cce2c412625937abd7fd2c7760083fd0768aa8ae45c2e8bd4992"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "68a643c532ef428f18f6232a001fad93cceeb3f8af6ef1f4f5b853e21cd52163"
+      "sha256": "bfee39b9a538046973186020153d4058238ccd25e55c8874316fd5ebab0c42c2"
     },
     {
       "path": "public-docs/index.html",
@@ -8807,7 +8822,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "d0ddb9cbd67fdef45d72d29994e772239044bcfb45ccaf81e3e54783c588d970"
+      "sha256": "dd912cf4446f572257b0a9cc7380a331b8ae7e3d834ccff828fddc13ae5bcb19"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
@@ -8822,7 +8837,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "8722cf581fac65b5839f2b44987c9b09b721452d8f20d2079f2029b386841396"
+      "sha256": "784400e0a2912fb4c9bd14107dca7d50cc4a10d77b4a849cd73fe853a6cf3966"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9837,7 +9852,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "df4b0f103f4790210ad2f94b8431893d4ff4e43faa88004ddb952b25cf1735b8"
+      "sha256": "d0494683c02dfc17a402568d4ed72ccc574b73b4813d06de8eda9ccfcafe09d9"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12824,6 +12839,11 @@
       "mode": "0000644",
       "sha256": "642ba54a20f08df1514f94114d39cdb70427f93542f4c060c83251ad1f46c80a"
     },
+    {
+      "path": "tests/provision_account_identity.mjs",
+      "mode": "0000644",
+      "sha256": "d56cf2553c0b5efa6a17df3d578b7b5766ff62504af6c226688f73ac417df3c6"
+    },
     {
       "path": "tests/provision_caddy_wiring.mjs",
       "mode": "0000644",
@@ -13099,6 +13119,11 @@
       "mode": "0000644",
       "sha256": "a7a0a61260a4ee78f5452b76ee6d8ef732104cf9c32a3c05bfa25517bf883aeb"
     },
+    {
+      "path": "tests/removal_proposal.mjs",
+      "mode": "0000644",
+      "sha256": "b447287dca1ffe65a926715e0a5f07c0a05e3503066febf85b7f6d317b805c8f"
+    },
     {
       "path": "tests/rename_history_restraint.mjs",
       "mode": "0000644",

package/docs/adr/0317-a-plane-that-cannot-give-an-instance-its-own-account-is-refused.md

@@ -0,0 +1,148 @@
+# ADR 0317 — A plane that cannot give an instance its own account is refused, not given a shared uid
+
+**Status:** accepted · **Date:** 2026-09-20 · **Task:** [task 1004018](https://cloudbongos.com/builders#/task/1004018) (goal 1000106 — BONGOS-V2)
+
+**Related:** [ADR 0281](0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md) (the per-instance account this one guards) · [ADR 0315](0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md) (the sibling refusal, and the ordering this one extends) · [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) (the supervision seam that deferred this question here) · [ADR 0128](0128-provisioning-runner-privilege-and-db-auth-model.md) (the `PROVISION_SUDO` escalation the probe tests)
+
+## Context
+
+ADR 0281 made an instance's identity its own unix account: provisioning step 1c runs
+`ensureInstanceUserCmd` → `useradd --system`, and the unit's `User=`/`Group=` is what
+stops one co-tenant instance reading a sibling's `/proc/<pid>/environ` — where every
+instance's `EnvironmentFile` carries its GitHub App private key and its OAuth client
+secret. That was audit finding B3, and closing it is the whole point of the account.
+
+`useradd` needs uid 0. The self-host image is `node:22-bookworm-slim`, runs `USER node`,
+and installs `postgresql-client bash tini curl ca-certificates git` — **no sudo**. On that
+plane the account cannot be created at all, and ADR 0306 named this as the piece its seam
+does not cover: *"`useradd` cannot run under `USER node` — that is task 1004018."*
+
+**Two failure shapes, neither of them honest.**
+
+- **Today it crashes, late.** `boxExec(ensureInstanceUserCmd(...))` is not `allowFail`, so
+  step 1c throws — *after* the capacity, ingress and wiring preflights have passed, after
+  the status flip to `provisioning`, and after the standalone shape has already pulled its
+  repo and run `npm ci`. The runner records a crash where the honest answer is a refusal,
+  and it records it with the box half-changed.
+- **Tomorrow it goes quiet.** ADR 0315 refuses a proxyless plane, so a compose self-host
+  currently stops at the ingress question and never reaches step 1c. That is coincidence,
+  not protection: 0315 says in its own consequences that *"a future ADR that adds [a front
+  door] replaces this refusal rather than extending it."* The moment someone gives the
+  container a published port, the identity gap is live again — and `provision-process.js`'s
+  supervisord program block writes `user=<instanceUser>` for an account that was never
+  created, which supervisord reports as a program that will not start rather than as a
+  security regression.
+
+The task asked for a posture, and it is worth naming the one that was rejected: *accept
+that a self-host container is single-tenant and document that instances there are not
+isolated.* It buys a working container standup by re-opening B3, and an operator has no
+way to see which posture their box is running.
+
+## Decision
+
+**A plane where the runner cannot become root is refused before anything is attempted, and
+the refusal names what a shared uid would cost.**
+
+`accountPlaneGap(exec, { privileged })` in `scripts/gds/provision-repo.js` — beside the
+account it guards — probes with `${sudo}sh -c 'test "$(id -u)" = 0'`. It returns `null`
+when the runner reaches root, or a string naming the missing privilege.
+`accountPreflight({ exec, apply, log, shape, privileged })` wraps it with the narration
+its sibling preflights carry, and `provisionInstance` returns `{ok:false, error: 'Account
+preflight failed: …'}`.
+
+**The probe runs the same escalation the mutation will,** so a pass is evidence rather than
+inference: `privileged` (i.e. `PROVISION_SUDO=1`) renders `sudo sh -c …`, exactly the
+prefix `ensureInstanceUserCmd` will use a few steps later.
+
+**`sh -c`, not a bare `test`, and that is load-bearing.** Under sudo the *outer*,
+unprivileged shell would expand `$(id -u)` before sudo ever ran, and the probe would
+cheerfully answer about the wrong user — passing on precisely the plane this refuses. The
+command substitution has to happen inside the escalation. For the same reason there is no
+pipeline: a pipeline's exit status is its last stage's, which would erase the distinction
+below.
+
+**A shell that ran and answered is the only failure that proves the plane cannot.** Under
+remote exec `boxExec` is `ssh <host> bash -s`, so a briefly-unreachable co-hosting box
+throws here too — and answering that with "this plane cannot create accounts, provision
+elsewhere" would be a confident wrong diagnosis burning the intent's retry budget on a
+network blip. Exit 1 (`test` said no) and 127 (`sudo` is not installed) are read as proof;
+ssh reports its own failures as 255, so both still mean what they say across the hop.
+Anything else returns *"could not confirm the runner can create a per-instance unix
+account on this plane"* with the real cause leading. This is ADR 0315's rule, applied to a
+different question.
+
+**The refusal is ordered third, after capacity and ingress and before ADR 0303's wiring
+check.** Those first three are questions about the *plane* — has it room, has it a proxy,
+can it hand out an identity — and 0303's is the one question about *this instance's*
+domain. ADR 0315's capacity → ingress → wiring order is extended, not rearranged: all four
+still return before anything on the box changes.
+
+**No container-shaped identity model, and no "single-tenant" acceptance.** The symmetry
+with ADR 0306 would be a seam with a container implementation. There is nothing to put in
+it: a per-instance account inside the container needs the image to run privileged, a
+container-per-instance needs a docker socket and an orchestrator that does not exist here,
+and unprivileged user namespaces are not reliably available. The honest encoding of "this
+plane cannot give a child its own identity" is a refusal — the same reasoning ADR 0315
+used to reject a no-op ingress backend.
+
+## Consequences
+
+- **A compose self-host still cannot provision a child instance — and now it says so for
+  its own reason, not by accident.** This refusal does not depend on ADR 0315's firing
+  first, so giving the container a front door later cannot silently re-open B3. Whoever
+  builds that front door has to answer this question too, and the error text is where they
+  will find it.
+
+- **The failure moved from step 1c to the preflight.** A plane without root used to hard-
+  error after the status flip and, for a standalone, after a repo pull and an `npm ci`.
+  It now returns `{ok:false}` before any mutation, which is the pending-retry path an
+  environment problem earns rather than the crash it was getting.
+
+- **One extra `sh -c` per applied standup.** Read-only, no mutation, and it runs after the
+  capacity measurement, so a full box still refuses without it. A dry run never probes, and
+  a dedicated droplet is skipped — cloud-init runs as root there, and ADR 0281's account
+  steps are baked into its user-data unchanged.
+
+- **The live box is untouched.** The control-plane runner unit sets `PROVISION_SUDO=1`, so
+  the probe renders `sudo sh -c …`, passes, and every command after it is byte-identical.
+  The regression is pinned by a test that provisions a root-reaching plane and asserts
+  `useradd --system` still runs, after the probe.
+
+- **Root, but no `useradd`, is deliberately not covered.** An Alpine-style plane with
+  `adduser` instead would pass the probe and fail at step 1c as it does today. The gap this
+  ADR closes is privilege, which is the one the planes we actually run exhibit; inventing a
+  second probe for a plane nobody has would be speculation, and it would fail loudly rather
+  than quietly in any case.
+
+- **Teardown is not covered,** for ADR 0315's reason: a refusal on the teardown path would
+  strand a row instead of cleaning it.
+
+- **This is a capability question, not a configuration knob.** There is no
+  `PROVISION_ALLOW_SHARED_UID`. A runner either reaches root on this plane or it does not,
+  and an operator who wants provisioning to proceed needs privilege, not a flag that says
+  to pretend.
+
+## Alternatives considered
+
+- **Accept it: document a self-host container as single-tenant with instances sharing one
+  uid.** Rejected. It is a silent downgrade of the exact vector ADR 0281 closed, visible
+  nowhere on the running box, and "single-tenant" is not what a container hosting several
+  child projects is. A posture an operator cannot observe is not a posture.
+
+- **An identity seam with a container implementation** (mirroring ADR 0306). Rejected: no
+  implementation exists to put behind it. A seam whose second backend is "do nothing" is
+  the no-op backend ADR 0315 already rejected, wearing a seam's clothes.
+
+- **Probe `useradd --help`, or `command -v useradd`.** Rejected on the mechanism: both
+  succeed as an unprivileged user on the very image this refuses. They test the binary; the
+  missing thing is the privilege to run it.
+
+- **`${sudo}id -u` and compare the output to `0`.** Rejected: it decides on captured stdout
+  rather than on exit status, which every sibling preflight and every provisioning test
+  fake treats as the contract — the fakes answer commands with an empty `stdout`, so the
+  probe would have failed on hermetic planes that are fine, and the fix would have been to
+  teach a dozen harnesses about one probe.
+
+- **Run the probe inside `ensureInstanceUserCmd` and let step 1c refuse itself.** Rejected:
+  it keeps the refusal after the status flip and after the standalone repo sync, which is
+  most of what makes the current failure a bad one.

package/docs/adr/README.md

@@ -408,3 +408,4 @@ This keeps the decision history honest and traceable.
 | 0314 | [**A module owns a protected path without the whole module becoming protected** ([task 1004070](https://cloudbongos.com/builders#/task/1004070), goal 1000095 — BONGOS-V2). Three modules derive `protected` — and so are Archon-only to scope a goal to — because of ONE file that is not their domain: `onboarding` on `scripts/gds/setup.js`, `autonomy` on `scripts/gds/conductor-dispatch.js`, `copy-desk` on `scripts/gds/copy-inventory.js`. The owner chose *narrow what counts as protected*; the task set the fork and required the choice be justified before any glob moved. **Deleting the glob is out**: `MODULE_GLOBS` is also the territory deciding who may AUTHOR a task on a path, and the shared floor is only `tests/`, so an unowned path is authorable by no goal at all. That left reassigning each CLI to an already-protected module — **measured, not reasoned about**, by applying the edit to the source and re-requiring in a fresh process (`MODULE_SCOPE_MAP` is frozen and built from a COPY of `MODULE_GLOBS` at load, so an in-process mutation proves nothing and passes green). The measurement kills it: `copy-desk` and `autonomy` lose the ability to author on their own generator and their own conductor, and — the row that decides it — `devsecops` as the new owner **cannot author the generator together with the two artifacts it writes**, because `docs/copy-registry.json` and `docs/copy-inventory.md` stay `copy-desk`'s. So *change a UI string, regenerate the registry* becomes authorable by no single goal, and that is the ship-check freshness gate every UI task hits. Decision: **protection becomes per-path at the goal-scope wall, as it already is at the other three** — `matchProtected` decides task-authoring, the grader and gate decide ship, the post-push audit decides the dishonest case; only goal-creation asked about the MODULE, and that inconsistency is the whole defect. The derivation stays computed from `PROTECTED_GLOBS` and no flag is hand-set ([ADR 0086](0086-goal-scoped-work-hierarchy.md) §7 / SEC #863), and the Metic floor on those paths does not move. **Corrects the task's own numbers**: 12 of 26 modules derive protected, not 11, and `agents` (protected by `modules/agents/`, itself a protected glob) is absent from its list of seven — which is why the one thing this ADR SHIPS is a test pinning the full protected key set **by name**, a count assertion passing on the wrong twelve being exactly how that drifted. Implementation is deferred to task 1004109, per the task's own instruction to stop after the ADR. Also filed: `builder-settings` (task 1004110), whose overlap rides the blanket `src/bongos/routes/` prefix and so needs either the `me.js` strangler move or its own security ADR; and **nine protected paths owned by no module at all** (task 1004111) — the freshness generators, the merge-driver pair and `cli-lib.js` among them — found while checking whether deletion was viable, a pre-existing hole rather than one this opens. Does not decide: the floor a protected path carries, whether `scripts/gds/` deserves a shared-floor entry the way `tests/` has one, or how the nine unowned paths get a home.](0314-module-protection-is-per-path-not-per-module.md) | modules / permissions |
 | 0316 | [**The ignite floor is a scheduling dial, not the trusted tier** ([task 1004084](https://cloudbongos.com/builders#/task/1004084), goal 1000095 — BONGOS-V2). BV2 decision 3 makes the ignite floor — who may turn a quick idea straight into claimable work — a per-instance setting, and decision 16 adds the descent decay rate beside it, the two to share one home. Both the spec and the seeded task described the mechanism the same way: the floor IS the `METIC_PLUS` constant in `modules/ideas/routing.js`, so this is "a setting, not a refactor". Tracing the code before building refuted that: `METIC_PLUS` is spelled once but READ for four semantically different gates — the two `decideLanding` bug branches (land at `ready` or at `backlog`), `mayProposeCriterion` (who may file a `kind='criterion-proposal'`, a planning-scope write), and the protected-scope wall in `authorizeRoutedLanding` (who may route work into the permission / ship-grade / deploy / migration core). Only the first two are the ignite floor, so making the CONSTANT configurable would mean an instance setting its floor to `xenos` — exactly the "project of one wants every thought claimable" case the owner asked for — ALSO gaining the right to file criterion-proposals and to breach the protected core. The codebase already said so in three places nobody had read into the spec: the constant's own header ("It grants nothing — the server-side rank floor and the goal's scope wall are separate, load-bearing gates"), the protected-scope branch ("the two are layers, not alternatives"), and `tests/filing_abuse_matrix.mjs`, which models the widening as an ATTACK and pins the literal. Decision: a separate dial. `modules/ideas/config.js` + `config/ideas.neutral.json` carry both knobs on the `modules/government/config.js` precedence (env -> instance root `config/ideas.json` -> core root neutral; the ADR 0268 dual-root split matters, since one root reads the host pack out of `node_modules` where `npm ci` erases it). `igniteFloor` defaults to `metic`, resolving to exactly the `METIC_PLUS` set, and is threaded into `decideLanding` as a ready-made `trustedRanks` **Set** by the callers — `routing.js` is TOLD the floor and never reads config, staying pure and DB-free — while `METIC_PLUS` stays a FIXED constant for the other two gates, neither of which takes a floor argument (pinned structurally). `descentDecayRate` defaults to 0.5 and ships with no production caller, because R11 is its intended reader and depends on the unbuilt R08 — the same deliberate slice boundary `modules/government/config.js` documents for itself, and what decision 16 asked for. Everything fails to VANILLA rather than dead: a malformed pack, an unknown rank or an out-of-band rate falls back, and an unrecognised floor yields the DEFAULT set, never an empty one (failing closed would stop every ignition on a typo). Rejected: configuring `METIC_PLUS` as written (a security widening in a config file's clothes); splitting it into four named constants (the other three want the same fixed tier, and naming them invites configuring them); having `routing.js` read the config itself (makes the landing matrix impure and untestable at a different floor). Spec decision 3's "spelled in one place" describes the intent, not the mechanism; the spec was not edited and the task description was amended in flight.](0316-the-ignite-floor-is-not-the-trusted-tier.md) | ideas / permissions |
 | 0315 | [**A plane with no proxy is refused, not given a no-op ingress** ([task 1004017](https://cloudbongos.com/builders#/task/1004017), goal 1000106 — BONGOS-V2). The piece [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) explicitly deferred: the self-host image ships no proxy, so provisioning step 6's `<slug>.caddy` snippet write and `systemctl reload caddy` cannot work there and a child instance gets no front door. **Two failure shapes, only one visible**: a DOMAINED child already half-refused, because `caddy adapt` fails with no binary and [ADR 0303](0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md)'s own catch turns that into a gap — but the message told the operator to add a directive to `/etc/caddy/Caddyfile`, a file the container does not have and that ADR 0303 §1 forbids provisioning from creating; a DOMAINLESS child skipped that preflight entirely (it is gated on `inst.domain`), reached step 6 and died on the `sudo` write, an uncaught throw that bypasses the `{ok:false}` pending-retry path and hard-errors the instance on attempt one — a crash recorded where a refusal was the honest answer. Decision: `ingressPlaneGap(exec)` probes the plane with `caddy version` — one cheap unprivileged read, the same posture as `checkCaddyWiring` — and both standup legs refuse with `Ingress preflight failed: …`, deliberately NOT domain-gated, because the domainless child is the one 0303 could not see. **Only a missing binary proves there is no proxy**: under remote exec `boxExec` is `ssh <host> bash -s`, so an unreachable co-hosting box throws here too, and diagnosing a network blip as 'this plane has no proxy, provision elsewhere' would be a confident wrong answer that burns the intent's retry budget — exit 127 is read as proof, anything else answers 'could not confirm a reverse proxy on this plane' with the real cause leading. The three refusals are ordered **capacity → ingress → wiring**, cheapest and most fundamental first and all before any mutation, which moves 0303's preflight behind the ADR 0285 capacity measurement; both still refuse before anything changes, so only the precedence between two refusals moves. **No ingress seam and no no-op backend**, despite the obvious symmetry with 0306: a `none` implementation whose `writeSite`/`reload` are no-ops lets the standup SUCCEED while leaving the child unreachable — neither half of the task's done-when, and exactly the silently-broken instance it exists to prevent. Does not decide: what a child's front door IS on a container plane (a published port, a bundled proxy, an explicit localhost-only shape) — a future ADR that adds one replaces this refusal rather than extending it. Teardown is left alone on purpose: it already reloads `allowFail`, and refusing there would strand a row instead of cleaning it.](0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md) | provisioning / ingress |
+| 0317 | [**A plane that cannot give an instance its own account is refused, not given a shared uid** ([task 1004018](https://cloudbongos.com/builders#/task/1004018), goal 1000106 — BONGOS-V2). The last of the three container gaps [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) deferred, and the sibling of [ADR 0315](0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md). [ADR 0281](0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md) makes an instance's identity its own unix account, and the unit's `User=`/`Group=` is what stops one co-tenant reading a sibling's `/proc/<pid>/environ` — where every instance's `EnvironmentFile` carries its GitHub App private key and OAuth client secret (audit B3). `useradd` needs uid 0; the self-host image is `node:22-bookworm-slim` running `USER node` with **no sudo**, so there the account cannot be created at all. **Two failure shapes, neither honest**: today step 1c's `boxExec(ensureInstanceUserCmd(...))` is not `allowFail`, so it throws AFTER every preflight passed, AFTER the status flip to `provisioning`, and — for a standalone — after a repo pull and an `npm ci`, recording a crash with the box half-changed; and tomorrow it goes quiet, because a compose self-host only stops short of step 1c by ADR 0315's coincidence, and 0315 says in its own consequences that a future front door **replaces** that refusal. Decision: `accountPlaneGap(exec, { privileged })` in `provision-repo.js` probes with `${sudo}sh -c 'test "$(id -u)" = 0'` and `provisionInstance` refuses with `Account preflight failed: …` before any mutation. **The probe runs the SAME escalation the mutation will** (`PROVISION_SUDO=1` renders the same `sudo ` prefix `ensureInstanceUserCmd` uses), so a pass is evidence rather than inference. **`sh -c`, not a bare `test`, is load-bearing**: under sudo the outer unprivileged shell would expand `$(id -u)` first and answer about the wrong user, passing on exactly the plane this refuses — and for the same reason there is no pipeline, whose exit status is its last stage's. **Only a shell that ran and answered proves it**: `boxExec` is `ssh <host> bash -s` under remote exec, so exit 1 (`test` said no) and 127 (no sudo binary) are read as proof while ssh's own 255 answers "could not confirm" with the real cause leading — ADR 0315's rule applied to a different question. Ordered **third**, after capacity and ingress and before 0303's wiring check: the first three ask about the PLANE, 0303 asks about this instance's DOMAIN, and 0315's order is extended rather than rearranged. **Rejected: accepting it** — documenting a self-host container as single-tenant with a shared uid is a silent downgrade of the vector 0281 closed, observable nowhere on the running box, and "single-tenant" is not what a container hosting several child projects is; **an identity seam with a container implementation**, because nothing exists to put behind it and a seam whose second backend does nothing is 0315's no-op wearing a seam's clothes; **probing `useradd --help` / `command -v useradd`**, which succeed unprivileged on the very image this refuses; **`${sudo}id -u` compared against `0`**, which decides on captured stdout where every sibling preflight and every test fake treats exit status as the contract; and **refusing inside step 1c**, which keeps the refusal after the status flip. Not covered, deliberately: root-but-no-`useradd` (an Alpine-style plane fails loudly at step 1c as today), and teardown (0315's reason — a refusal there strands a row instead of cleaning it). No `PROVISION_ALLOW_SHARED_UID`: a runner either reaches root on this plane or it does not.](0317-a-plane-that-cannot-give-an-instance-its-own-account-is-refused.md) | provisioning / identity |

package/docs/module-api-changelog.md

@@ -2306,5 +2306,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.914 with no explicit bump. run 35524223153. (task 1002620)
   1.19.916 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.915 with no explicit bump. run 35525694524. (task 1002620)
+  1.19.917 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.916 with no explicit bump. run 35526196428. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/self-host.md

@@ -39,7 +39,7 @@ Author `config/branding.json` from the neutral starter — see [the branding con
 
 **Or scaffold it with `bongos init`** ([task #1204](https://example.com/builders#/task/1204)): a short interview (or `bongos init --from spec.json` for a hands-free / CI run) that writes both config files, **seeds your first version + its done-when goal**, and **files the human-only kickoff steps** (register a GitHub OAuth app, first owner sign-in, repo binding, admission) as real tracked tasks — so a fresh instance has a claimable queue on day one instead of an empty hall. It never invents your branding (it points you at the fill prompt for that). Preview the whole plan with `bongos init --dry-run`.
 
-**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image now carries the tools the scaffold needs — git, and a core it can package out of its own `.git`-less checkout (task 1003995) — and supervision is no longer systemd-only: the runner picks a process manager, falling back to supervisord where systemd is not running (task 1003997, [ADR 0306](../adr/0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)). Three standup legs still assume a systemd box, so on a compose self-host a new project cannot stand up: the container has no reverse proxy for a child instance's front door, cannot create the per-instance unix account that isolates one instance from another (task 1004018), and installs its backup dir as a hardcoded founder user (task 1002719). **The ingress leg now refuses instead of failing opaquely** (task 1004017, [ADR 0315](../adr/0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md)): provisioning probes the plane with `caddy version` and returns `Ingress preflight failed: …` naming the missing proxy, before it writes a Caddy snippet or reloads anything. Previously a domained child was told to edit an `/etc/caddy/Caddyfile` the container does not have, and a domainless one crashed on the snippet write. Giving the container a real front door is still unbuilt — the refusal closes the failure mode, not the capability. Note supervisord has no timer concept either, so a container-hosted instance gets no automatic DB backup — the standup log prints the `crontab` line to add instead. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
+**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image now carries the tools the scaffold needs — git, and a core it can package out of its own `.git`-less checkout (task 1003995) — and supervision is no longer systemd-only: the runner picks a process manager, falling back to supervisord where systemd is not running (task 1003997, [ADR 0306](../adr/0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)). Three standup legs still assume a systemd box, so on a compose self-host a new project cannot stand up: the container has no reverse proxy for a child instance's front door, cannot create the per-instance unix account that isolates one instance from another, and installs its backup dir as a hardcoded founder user (task 1002719). **Two of the three now refuse instead of failing opaquely, each for its own reason** — so fixing one cannot silently re-open the other. **The ingress leg now refuses instead of failing opaquely** (task 1004017, [ADR 0315](../adr/0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md)): provisioning probes the plane with `caddy version` and returns `Ingress preflight failed: …` naming the missing proxy, before it writes a Caddy snippet or reloads anything. Previously a domained child was told to edit an `/etc/caddy/Caddyfile` the container does not have, and a domainless one crashed on the snippet write. Giving the container a real front door is still unbuilt — the refusal closes the failure mode, not the capability. **The identity leg refuses too** (task 1004018, [ADR 0317](../adr/0317-a-plane-that-cannot-give-an-instance-its-own-account-is-refused.md)): provisioning probes whether the runner can reach root on this plane and returns `Account preflight failed: …` before any mutation, because `useradd` cannot run under `USER node` and every child there would otherwise share one uid — the sibling-secret vector [ADR 0281](../adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md) exists to close. It is a capability question, not a knob: there is no setting that accepts a shared uid. Note supervisord has no timer concept either, so a container-hosted instance gets no automatic DB backup — the standup log prints the `crontab` line to add instead. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
 
 ## Configuration surface
 

package/migrations/core_252_claims_published_head_sha_idx.sql

@@ -0,0 +1,33 @@
+-- core_252 — index claims.published_head_sha for REVERSE lookup (task 1004090 / BV2.R15)
+--
+-- migrations/171 added the column and every reader since has gone FORWARD:
+-- getClaimPublishedSha(taskId) reads one row by task_id, which the existing
+-- task_id index serves. BV2.R15 introduced the first reader that goes BACKWARD —
+-- shippedTasksByPublishedSha(shas) asks "which shipped tasks published these
+-- commits", i.e. `WHERE published_head_sha = ANY($1::text[])` — and nothing
+-- indexed that direction, so it planned a full scan of `claims` on every ship
+-- that deleted a previously shipped file.
+--
+-- That is on the ship path, which is exactly where a seq scan must not be: the
+-- table grows one row per claim forever, and the cost would arrive quietly as
+-- ships gradually slowing rather than as anything failing.
+--
+-- PARTIAL, on NOT NULL. The column is nullable and most historical rows are null
+-- (rows predating 171, and publishes that rode another branch), so a partial
+-- index is both smaller and a better match for the query — `= ANY(...)` never
+-- matches NULL, so the excluded rows could not have been returned anyway.
+--
+-- Additive and idempotent: adds an index, touches no data, no column and no
+-- constraint. Safe to run forward against a live database, and safe for an older
+-- release to run against — an unused index changes no behaviour.
+--
+-- NOT a lifecycle_* module migration: `claims` is a CORE table, and a module
+-- migration may only touch its own namespaced tables (fitness.js
+-- checkModuleMigrationsAdditive, ADR 0083 Decision #5).
+
+CREATE INDEX IF NOT EXISTS claims_published_head_sha_idx
+  ON claims (published_head_sha)
+  WHERE published_head_sha IS NOT NULL;
+
+COMMENT ON INDEX claims_published_head_sha_idx IS
+  'Reverse lookup sha -> claim for BV2.R15 removal attribution (db-ship.shippedTasksByPublishedSha). Partial: = ANY() never matches NULL.';

package/modules/lifecycle/cascade.js

@@ -17,7 +17,7 @@
 // shipped task looks like THIS, file THAT task, for THAT discipline. There is no
 // condition language, no stored rules, no per-project configuration and no UI —
 // every one of those is a thing to add when a second and third cascade exist and
-// have shown what they have in common. Today `CASCADES` ships EMPTY: the
+// have shown what they have in common. `CASCADES` no longer ships empty: the
 // mechanism, its idempotency and its non-blocking property are proved by the
 // tests' own declarations, and R04 (task 1003115) writes the first production
 // entry. A mechanism whose first real rule is written by the task that needs it
@@ -169,6 +169,50 @@ function artistReviewBody(task) {
   ].join('\n');
 }
 
+// The removal proposal's body (task 1004090 / BV2.R15, ADR 0313).
+//
+// IT ASKS, IT DOES NOT TELL. Every line here is written so a reader confirms or
+// dismisses on the evidence rather than rubber-stamping a verdict — because the
+// owner chose propose-then-confirm precisely for the cases this derivation cannot
+// tell apart from a real removal. The three it CAN tell apart (a rename, a move,
+// a rewrite in place) are already excluded upstream in removal-derivation.js.
+//
+// The affected tasks and paths are named as PROSE, deliberately. A cascade files
+// one task per rule per ship keyed on (rule, ship), with no field for a target,
+// and R05's runner may not be widened to fan out (ADR 0242). Owner decision
+// 2026-09-20: the body carries them and R20 designs its own storage when it needs
+// one. So this text IS the record until then — keep it readable and keep it exact.
+function removalProposalBody(task, ctx) {
+  const found = ((ctx || {}).removals) || [];
+  const lines = [];
+  lines.push(`Shipping task ${task.id} deleted files that earlier SHIPPED work put there.`);
+  lines.push('');
+  lines.push('**This is a question, not a verdict.** Nothing has been marked removed, no');
+  lines.push('status changed and no credit moved — and none of that happens unless a person');
+  lines.push('confirms below. `shipped` is terminal and stays terminal.');
+  lines.push('');
+  lines.push('**Removed work attributed to:**');
+  for (const r of found) {
+    lines.push(`  - task ${r.taskId}${r.title ? ` — ${r.title}` : ''}`);
+    for (const path of r.paths) lines.push(`      ${path}`);
+  }
+  lines.push('');
+  if ((ctx || {}).removalTruncated) {
+    lines.push(`Note: this ship deleted ${(ctx || {}).removalDeletedCount} paths, more than the`);
+    lines.push('attribution cap, so the list above is PARTIAL. A ship that large is usually a');
+    lines.push('move or a sweep — weigh that before confirming.');
+    lines.push('');
+  }
+  lines.push('**Confirm** if that work is genuinely gone: the ideas whose descent it belongs');
+  lines.push('to will dim accordingly. **Dismiss** if this was a refactor, a move the rename');
+  lines.push('detection missed, or a deletion of something already superseded — dismissing is');
+  lines.push('what stops the sky being dimmed for a reason that is not real.');
+  lines.push('');
+  lines.push('Attribution runs through `claims.published_head_sha`, so a deletion whose origin');
+  lines.push('predates that record is silently absent rather than guessed at.');
+  return lines.join('\n');
+}
+
 // Production rules. The artist review is the first (R04); add another by
 // appending an entry, never by touching the runner (ADR 0242).
 const CASCADES = Object.freeze([
@@ -189,6 +233,25 @@ const CASCADES = Object.freeze([
     title: (t) => `Artist review: the copy and visuals that shipped in task ${t.id}`,
     body: artistReviewBody,
   }),
+  Object.freeze({
+    key: 'removal-proposed-on-ship',
+    // ENGINEER, not artist: confirming asks whether deleted code is genuinely
+    // gone or was moved, which is a question about the diff.
+    discipline: 'engineer',
+    kind: 'unclassified',
+    // The anti-recursion guard FIRST, the same order and for the same reason as
+    // the rule above — a cascade-generated task must never cascade.
+    //
+    // The candidates are resolved ONCE into ctx by runCascadesForShip, never
+    // here: a `when` is pure and synchronous by contract, and this derivation is
+    // a network read. An absent ctx therefore means "nothing was derived" and
+    // files nothing — the opposite default to the artist gate above, and
+    // deliberately so: silence about a removal must never be read as a removal.
+    when: (t, ctx) => t.source !== CASCADE_SOURCE
+      && Array.isArray((ctx || {}).removals) && (ctx || {}).removals.length > 0,
+    title: (t) => `Was this removed? Task ${t.id} deleted earlier shipped work`,
+    body: removalProposalBody,
+  }),
 ]);
 
 // THE TRIGGERS. A cascade reacts to a state transition; there are two, and this
@@ -319,7 +382,7 @@ function cascadesFor(task, rules = CASCADES, ctx = {}, trigger = TRIGGERS.ship)
     }
     if (!hit) continue;
     try {
-      matched.push({ rule, spec: cascadeTaskSpec(rule, task, trigger) });
+      matched.push({ rule, spec: cascadeTaskSpec(rule, task, trigger, ctx) });
     } catch (e) {
       errors.push(`cascade "${rule.key}": title/body threw (${e && e.message})`);
     }
@@ -329,8 +392,11 @@ function cascadesFor(task, rules = CASCADES, ctx = {}, trigger = TRIGGERS.ship)
 
 // The createTask payload for one matched rule. The attribution preamble is
 // prepended here rather than left to each rule, so no rule can forget it.
-function cascadeTaskSpec(rule, task, trigger = TRIGGERS.ship) {
-  const body = String(rule.body(task) || '').trim();
+// `ctx` reaches body() as a second argument, mirroring when(). The artist rule
+// ignores it; the removal rule needs it, because what a ship deleted is derived
+// per run and is not a property of the task row.
+function cascadeTaskSpec(rule, task, trigger = TRIGGERS.ship, ctx = {}) {
+  const body = String(rule.body(task, ctx) || '').trim();
   const preamble =
     `Filed automatically when ${trigger.happened(task)} — the "${rule.key}" cascade `
     + `(modules/lifecycle/cascade.js). Nobody typed this; it is a REQUEST, filed at backlog, `
@@ -466,6 +532,27 @@ async function runCascadesForShip(shipped, deps = {}) {
       try { ctx.artistGate = deps.artistGateMode(); }
       catch (e) { report.errors.push(`cascade: artistGateMode() threw (${e && e.message}) — policy unread`); }
     }
+    // WHAT THIS SHIP DELETED (task 1004090 / BV2.R15, ADR 0313). Resolved here
+    // rather than in the rule for the reason the rule's own comment gives: a
+    // `when` is pure and synchronous, and this is a network read.
+    //
+    // Same posture as the policy read above — a resolver that throws is REPORTED
+    // and leaves the keys unset, so a derivation outage files no proposal and
+    // costs the ship nothing. `removalCandidates` already swallows its own
+    // failures (removal-derivation.js returns a report rather than rejecting);
+    // this try/catch is the belt to that braces, because a non-blocking promise
+    // is only non-blocking until someone edits it.
+    if (typeof deps.removalCandidates === 'function') {
+      try {
+        const derived = await deps.removalCandidates(task);
+        ctx.removals = (derived && derived.removals) || [];
+        ctx.removalTruncated = Boolean(derived && derived.truncated);
+        ctx.removalDeletedCount = (derived && derived.deletedCount) || 0;
+        for (const e of (derived && derived.errors) || []) report.errors.push(e);
+      } catch (e) {
+        report.errors.push(`cascade: removalCandidates() threw (${e && e.message}) — no removal derived`);
+      }
+    }
 
     const { matched, errors } = cascadesFor(task, deps.rules || CASCADES, ctx);
     report.errors.push(...errors);
@@ -480,6 +567,7 @@ async function runCascadesForShip(shipped, deps = {}) {
 
 module.exports = {
   CASCADES,
+  removalProposalBody,
   IDEA_CASCADES,
   TRIGGERS,
   fullIdeaScopingBody,

package/modules/lifecycle/db-ship.js

@@ -761,6 +761,48 @@ async function getClaimPublishedSha(taskId) {
   return rows[0]?.published_head_sha ?? null;
 }
 
+// shippedTasksByPublishedSha — the reverse of getClaimPublishedSha: given commit
+// shas, which SHIPPED tasks published them (BV2.R15, ADR 0313).
+//
+// This is how removal attribution answers "whose work was deleted". ADR 0313
+// rejected the obvious alternative — parsing `(task NNNN)` out of commit messages —
+// because only 7 of the last 15 commits on main carry a task id: merge commits and
+// release carriers do not, and a convention that holds most of the time is not a
+// basis for something that moves credits. `published_head_sha` is written by the
+// SERVER at publish time and cannot be forgotten by an author.
+//
+// Only `shipped` rows come back, deliberately. Work that never landed cannot have
+// been removed, and a proposal naming an abandoned task would be noise a person
+// has to read and dismiss.
+//
+// INDEXED by core_252 (claims_published_head_sha_idx, partial on NOT NULL). This
+// is the first reader to go BACKWARD along that column — every prior one reads
+// forward by task_id — so before that index it planned a full scan of the
+// claims table on the ship path, on a table that grows one row per claim
+// forever.
+//
+// Returns a Map of sha -> { taskId, title }. Shas with no claim are simply absent:
+// `published_head_sha` is nullable (rows predating migrations/171, or a publish
+// that rode another branch), and ADR 0313 is explicit that an unattributable
+// deletion files NOTHING. Silence is the correct output — a wrong removal proposal
+// costs a person attention and dims a real star.
+async function shippedTasksByPublishedSha(shas) {
+  const list = [...new Set((Array.isArray(shas) ? shas : [])
+    .filter((s) => typeof s === 'string' && /^[0-9a-f]{7,40}$/i.test(s)))];
+  if (!list.length) return new Map();
+  const { rows } = await pool.query(
+    `SELECT c.published_head_sha AS sha, t.id AS task_id, t.title
+       FROM claims c
+       JOIN tasks t ON t.id = c.task_id
+      WHERE c.published_head_sha = ANY($1::text[])
+        AND t.status = 'shipped'`,
+    [list]
+  );
+  const out = new Map();
+  for (const r of rows) out.set(r.sha, { taskId: String(r.task_id), title: r.title });
+  return out;
+}
+
 // V3.R14 (#238) — onboarding observability roster.
 //
 // One row per builder, joined with the live "what are they doing right
@@ -1408,6 +1450,7 @@ module.exports = {
   getActiveClaimsForBuilderWithStale,
   getBuildersRoster,
   getClaimPublishedSha,
+  shippedTasksByPublishedSha,
   listConfirmedTasksForReconcile,
   needsRebaseTasksForBuilder,
   gatingRebaseTasksForBuilder,