@bongos/core 1.19.943 → 1.19.945

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.943",
-  "core_contract": "1.19.943",
-  "source_commit": "d2864572d1b1f1112a574071d4fe288920a71216",
+  "core_version": "1.19.945",
+  "core_contract": "1.19.945",
+  "source_commit": "069e65e6a01a57f09cf32de375376fb396a30dc4",
   "source_ref": "HEAD",
-  "built_at": "2026-09-21T22:14:04.050Z",
+  "built_at": "2026-09-21T23:41:12.424Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 511,
+    "docs_redacted": 512,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2340,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2877,
-  "tree_sha256": "475596e7ac9620819058973e021b0c26d5122429253e9206320f31130a67c709",
+  "file_count": 2878,
+  "tree_sha256": "658ce325bf77e617c3b8b44277b6b53c3a76935b9de049db21f05062abb53779",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1027,7 +1027,7 @@
     {
       "path": "docs/adr/0111-instance-hosting-provisioning-module.md",
       "mode": "0000644",
-      "sha256": "a0da85222fe36f16d16b1f52a7d1e50b5aa794942cee6dfa5a69ab53300e6f6e"
+      "sha256": "d216d4cfb0f269afa00af7963b3fe16d97596a6407b26859c7fd3126c7fc518c"
     },
     {
       "path": "docs/adr/0112-private-goals-invitations-join-requests.md",
@@ -1192,7 +1192,7 @@
     {
       "path": "docs/adr/0145-free-hosted-project-tier-isolation-and-domain-separation.md",
       "mode": "0000644",
-      "sha256": "02a9ba781c3db1c78b7aff23a3d7feb9fcca80bd49c291891af635d88288126f"
+      "sha256": "74f14a90b88d585a4b50247a7dd54a01accc229e7f64a875c9491612e3d0dd3c"
     },
     {
       "path": "docs/adr/0146-configurable-reward-mode-cost-plus-only.md",
@@ -1917,7 +1917,7 @@
     {
       "path": "docs/adr/0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md",
       "mode": "0000644",
-      "sha256": "7ccc21098aaaf80df6d07d7fa31199b9283a26e522d55ee7a9e472987721d097"
+      "sha256": "4e1631b94e83af33a8ea9ebf51657e0a5fcb0b9da30a41d443e7caa8f6b3c35b"
     },
     {
       "path": "docs/adr/0286-a-gated-project-s-manifest-tells-a-stranger-how-to-sign-in-and-nothing-else.md",
@@ -2104,10 +2104,15 @@
       "mode": "0000644",
       "sha256": "6a4ad58720701e760068d5ce1761733790beef0a142aa31a08782d029cc7a390"
     },
+    {
+      "path": "docs/adr/0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md",
+      "mode": "0000644",
+      "sha256": "8fa6ef943e3fc0855d15f83baefaabf810994b80da2ecdbbcc28d752ed0498f3"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "7c66ecbd1940f3cdd830f0fb4acf65c41178807a431bb8fab382e4b8a0dbc8ae"
+      "sha256": "eef598f074ff3e22a4748b9092eb83d04235205c34e66db6bbe76547f050843d"
     },
     {
       "path": "docs/api-reference.md",
@@ -2677,7 +2682,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "441e7d11f2b340623b122c51c788d0ff1d0610ff1c4296db3344c8702c8fb541"
+      "sha256": "b19c89c223392cbb28efd08e1b296125a846e7d9f18260b71793378992d42178"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8002,12 +8007,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2ff2f30a70ad8facea46291fa01e89889194edb8fa02e904bda7b8343754bbfd"
+      "sha256": "bd902078abd41ebb698133bdce5862123fa89d7740794a50721c04f9621cc9fc"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "35b084d56b257e0df6c6a738d94c305a6aa8419471c7b9fe32f41afef640f5fd"
+      "sha256": "9c1945ef497e4f0068ababa55bcd863ef336446951f4cab9eecbb36788dddf05"
     },
     {
       "path": "public-docs/index.html",
@@ -8097,7 +8102,7 @@
     {
       "path": "scripts/gds/agents-sync.js",
       "mode": "0000644",
-      "sha256": "7a639c73f8d2f4f523899ab737641174ca7b5ed5409427238d7fc397cdba65ed"
+      "sha256": "29f3d1521c04165a891a8055f005cb51ca019c51c556063e55167675051a43af"
     },
     {
       "path": "scripts/gds/api-alias-caller-scan.js",
@@ -9617,7 +9622,7 @@
     {
       "path": "scripts/migrate.sh",
       "mode": "0000644",
-      "sha256": "3a35826ec753908fb9aec9c5a4b5c37e71e38ba0d00c1d1f30387087be509d97"
+      "sha256": "1ba289b008ef4118cfd464ab5eb24ad4b694981942680220f115913691645e08"
     },
     {
       "path": "scripts/migrate_cost_ledger.sh",
@@ -10012,7 +10017,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "cd5bcc86c8d6ecb21b11c6dd9df73de2b63e0759edf781eeee2e6d36f6452aad"
+      "sha256": "704e7c44feb33354f257ee42164701791d33c548c2daf07ed35bdd1d77bc7f9f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10187,7 +10192,7 @@
     {
       "path": "tests/agents_sync.mjs",
       "mode": "0000644",
-      "sha256": "1184d82ba51d3dd3f2bf952292b71defd4b6ea51fba5e3800429cfed1450fe31"
+      "sha256": "daa2d58b9a248222a54305c3fa41d30e73c8ea8cd65db8a14e31d30dfe0ca555"
     },
     {
       "path": "tests/agents_validate.mjs",

package/docs/adr/0111-instance-hosting-provisioning-module.md

@@ -1,6 +1,7 @@
 # ADR 0111 — Instance hosting + domains as a Cloud Bongos module: the `provisioning` module boundary + the self-host / managed split
 
-- **Status:** Accepted (boundary + split decided with the owner; build is task-pending — see §Consequences for the seeded tasks)
+- **Status:** Accepted, **superseded in part by [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md)** (2026-09-21) — the module boundary and the enqueue-only trust boundary STAND; the DigitalOcean droplet and `co-tenant` shapes it provisions do not. Customer projects move to a managed platform; DigitalOcean hosts hubs only.
+- **Status (original):** Accepted (boundary + split decided with the owner; build is task-pending — see §Consequences for the seeded tasks)
 - **Date:** 2026-07-03
 - **Track:** internal (a portable Cloud Bongos platform capability)
 - **Task:** [#1485](https://example.com/builders#/task/1485) (BONGOS-V1, goal 26 — *Cloud Bongos productization and self-host*) — "spec the module boundary + the self-host vs managed split **before** tasking."

package/docs/adr/0145-free-hosted-project-tier-isolation-and-domain-separation.md

@@ -1,5 +1,6 @@
 # 0145 — A free "own-repo" hosted project tier needs domain separation + per-project isolation (not a bare cloudbongos.com subdomain)
 
+- **Status:** **Superseded in part by [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md)** (2026-09-21). Three of this ADR's decisions are replaced: the free tier becomes a **capped trial**, not all-free; customer projects leave the shared box for a managed platform, so **container isolation on our own box is no longer the plan**; and **Finding 1 is closed by removing its precondition** — with no customer code on a `cloudbongos.com` subdomain there is no tenant to receive the hub session cookie, so the sign-in hardening in the build sequence below is no longer a blocking prerequisite (it remains worth doing on its own merits). The two security FINDINGS below stand as analysis and are the reason the new direction is safe.
 - **Status:** Accepted — owner decided 2026-07-15: **keep `cloudbongos.com`** (no separate domain), **container** isolation, **all-free** for now. Choosing the literal same domain makes hardening core sign-in a required prerequisite (see "Decisions" + "Required build sequence"). Build unblocked ([task 1002251](https://cloudbongos.com/builders#/task/1002251)); blocker 1000080 resolved.
 - **Date:** 2026-07-15
 - **Deciders:** Lars (owner/Archon) chose the direction after a security review; Claude ran the review + designed.

package/docs/adr/0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md

@@ -1,6 +1,6 @@
 # ADR 0285 — A shared box holds about twelve projects per GB, and memory is the wall
 
-- **Status:** accepted
+- **Status:** accepted; **no longer load-bearing as of [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md)** (2026-09-21). The measurements below are correct and still describe the box — it simply stops holding customer projects, so the ceiling no longer gates project creation and the queued resize ([task 1003923](https://cloudbongos.com/builders#/task/1003923)) is held rather than spent.
 - **Date:** 2026-09-15
 - **Task:** [1003877](https://cloudbongos.com/builders#/task/1003877) (goal 1000106), a spike. Informs [1003923](https://cloudbongos.com/builders#/task/1003923) (the resize) and [1001949](https://cloudbongos.com/builders#/task/1001949) (managed billing).
 

package/docs/adr/0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md

@@ -0,0 +1,96 @@
+# ADR 0323 — Hosting is three shapes, and we are not the landlord
+
+- **Status:** accepted
+- **Date:** 2026-09-21
+- **Task:** [task 1004140](https://cloudbongos.com/builders#/task/1004140) (goal 1000106 — working area 1, Project creation)
+- **Deciders:** Lars (Archon) — every numbered decision below is the owner's; Claude ran the audit and the platform comparison.
+- **Gates:** [task 1004141](https://cloudbongos.com/builders#/task/1004141) (the rename) · [task 1004142](https://cloudbongos.com/builders#/task/1004142) (the migration) · [task 1004062](https://cloudbongos.com/builders#/task/1004062) (the env manifest)
+- **Supersedes in part:** [ADR 0111](0111-instance-hosting-provisioning-module.md) · [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md) · [ADR 0285](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md)
+- **Related:** [ADR 0002](0002-digitalocean-over-hetzner.md) (why DigitalOcean) · [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) (the pull this ADR makes load-bearing for `byo-host`) · [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) (the seam whose second implementation this makes unnecessary)
+
+## Context
+
+Five active projects run as `hosting_shape='standalone'` on one `s-1vcpu-2gb` DigitalOcean droplet, beside the control plane itself. Each is a Node process and a Postgres database, about 80 MB warm; the box holds fifteen ([ADR 0285](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md)) at roughly $0.80 per project per month. It is the cheapest arrangement available, and standing it up cost us `scripts/gds/provision*.js` — about 4,600 lines that write systemd units, create unix accounts, render Caddy snippets, run `createdb`, install per-instance backup timers, and count memory against a ceiling.
+
+That is the cost nobody priced: we are a landlord. Every one of those legs is infrastructure we maintain so that someone else's code can run on our machine.
+
+Three further facts made the arrangement worse than its price suggested:
+
+- **Customer code sits on our hub's registrable domain.** [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md) Finding 1 established that the hub's session cookie, scoped `.cloudbongos.com`, is sent by the browser to every `*.cloudbongos.com` host — including a tenant's. It required the sign-in hardening to land *before* any tenant went on a subdomain. Two tenants are on subdomains today, one of them not the platform owner's, and the hardening has not shipped.
+- **`dedicated` was written and never used.** A per-project droplet is 15–20× the shared cost, and no project has ever run on one.
+- **The self-host container path kept finding new floors.** [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) made supervision a seam and named three remaining blockers; two shipped, and each existed only because we were building a container host of our own.
+
+The owner's direction, settled over 2026-09-20/21, reframed the question. The platform should not host other people's applications at all: it should build on what others maintain, and let the owner keep the deployment platform they already use.
+
+## Decision
+
+### 1. Three owner-facing shapes
+
+| Shape | Meaning |
+|---|---|
+| `byo-host` | The owner runs the instance: their machine, their VPS, their own platform account. **New.** |
+| `cloud-host` | We stand it up for them on a managed platform. Rename of `standalone`. |
+| `dedicated-cloud-host` | The same path on a larger plan. Rename of `dedicated`. |
+
+`control-plane` is unchanged and stays unrequestable — it is the hub, not a product option.
+
+**`co-tenant` is retired, not renamed.** It means *a process on our box, from our checkout* — the most platform-owned shape there is, and the exact opposite of bring-your-own-host. Reusing the name would make every existing comment and ADR reference lie. One row carries it and it is `torn_down`.
+
+`dedicated-cloud-host` is a **plan size, not a second code path**. The DigitalOcean droplet and cloud-init implementation that sat behind `dedicated` becomes dead code.
+
+### 2. DigitalOcean hosts hubs only
+
+No customer project is deployed to it. The control plane stays where it is; the projects leave.
+
+This closes [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md) Finding 1 by removing its precondition rather than by hardening the cookie: with no customer code on a `cloudbongos.com` subdomain, there is no tenant to receive the hub session. The cookie hardening remains worth doing on its own merits and is no longer load-bearing.
+
+### 3. Render is the default platform for a `cloud-host`
+
+Render's Postgres carries point-in-time recovery and automated backups on every paid tier. Roughly $14 per project per month (web service plus database).
+
+Rejected: **Fly.io**, whose managed Postgres starts around $38/mo — the compute is cheaper and the database is not. **Railway**, whose Postgres templates are explicitly unmanaged: you tune and back them up, which is precisely the responsibility this decision exists to shed.
+
+### 4. Cloudflare is the front door, not the compute
+
+DNS, TLS, and — when `byo-host` needs to reach a machine behind a router — Tunnels, for which a working client already exists at `scripts/gds/cf-tunnel.js`.
+
+**Not the hall's runtime.** Cloudflare Workers is a V8-isolate runtime, not Node; Express and `pg` would have to be rewritten. Cloudflare Containers is built for bursty workloads that sleep between requests, and the hall runs background sweeps and a live event stream that do not survive sleeping. Its Postgres would be external in either case.
+
+### 5. Bongos does not integrate with the customer's deployment platform
+
+Their application already deploys itself: Vercel and Netlify watch the repository. Bongos writes code and pushes it. There is no adapter layer, and an adapter layer would solve a problem that does not exist.
+
+This is what makes "bring your preferred platform" nearly free to support. The platform we do not talk to is the platform we do not have to add.
+
+### 6. The deployment platform is the system of record for secrets; Bongos stores names, never values
+
+A project declares its environment variables to Bongos as a **manifest** — name, purpose, environment, required or optional — so a builder writing code knows what the surface is. The values live where the running application reads them, in a store that already encrypts, audits and rotates them.
+
+Bongos holds no application secret, no platform API token, and runs no "is it set?" probe. Adding any of those makes the platform the custodian of other companies' credentials, which is the responsibility this ADR is spending its whole budget to avoid. See [task 1004062](https://cloudbongos.com/builders#/task/1004062).
+
+For `byo-host` there is no platform to ask, and the manifest is simply marked unverifiable. That keeps *Bongos holds no values* true everywhere, with no exception to reason about later.
+
+### 7. The free tier is a capped trial
+
+At ~$14 per project, an indefinite subsidised free tier is not viable. This replaces [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md)'s "all-free for now". Implementing the cap is its own task; it cannot be metered before the migration.
+
+## Consequences
+
+- **This wave is mostly a deletion.** Systemd units, per-instance unix accounts, Caddy snippets, `createdb`, backup timers and the capacity ceiling are things Render provides. Not all of `provision*.js` goes — the repository scaffold, the GitHub App manifest handshake and the core-upgrade path serve the hub and the `byo-host` scaffold too. The migration task removes what is genuinely orphaned, after the projects have moved, and not before.
+
+- **Per-project cost rises about 17×, from $0.80 to ~$14.** That is the price of not being a landlord, and it is why decision 7 exists. It also makes metering ([task 1001949](https://cloudbongos.com/builders#/task/1001949)) and the spend rollup ([task 1001621](https://cloudbongos.com/builders#/task/1001621)) real work rather than deferred work.
+
+- **[ADR 0285](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md) stays true and stops being load-bearing.** Its measurements were correct and its ceiling still describes the box; the box just stops holding projects. The queued resize to 2 vCPU / 4 GB is therefore **not** to be spent ([task 1003923](https://cloudbongos.com/builders#/task/1003923), held).
+
+- **[ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)'s seam is not extended.** It correctly said it was "two implementations wide, not N". Render supervises its own processes, so the seam neither grows a third backend nor needs one.
+
+- **The hub becomes the single point of failure it always was, now visibly.** With projects elsewhere, everything that can be lost with the droplet is the control plane's own database — which makes offsite backups ([task 1002214](https://cloudbongos.com/builders#/task/1002214)) the highest-consequence open item in the goal.
+
+- **`byo-host` starts cheap and stays honest.** It reuses the pull that already exists ([ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md)): the owner supplies an origin and the hub reads the instance's own public manifest. Nothing is pushed to it, so it is excluded from the settings-apply and restart paths for the same reason `dedicated` was.
+
+## Alternatives considered
+
+- **Move to AWS or GCP.** Rejected. Their pricing is earned by consuming their managed services; a bare Linux instance from either is 2–3× DigitalOcean for the same memory, plus a console, an IAM model and a billing surface to learn. It adds maintenance where the goal is to remove it.
+- **Keep the shared box and fix the cookie instead.** Cheaper, and it closes the security finding. Rejected because it leaves the 4,600-line landlord runner in place and answers none of the other three questions.
+- **Build a deployment-platform adapter layer (Vercel/Netlify/Render).** Rejected as speculative pluggability, the thing [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) explicitly warned against. Their applications already deploy themselves.
+- **Bongos as the secrets store, pushing values to each platform via its API.** Rejected: it makes us the custodian of other companies' credentials for convenience that the manifest already delivers.

package/docs/adr/README.md

@@ -414,3 +414,4 @@ This keeps the decision history honest and traceable.
 | 0318 | [**Listing a file for task affinity is not claiming to own it** ([task 1004110](https://cloudbongos.com/builders#/task/1004110), goal 1000095 — BONGOS-V2). The case [ADR 0314](0314-module-protection-is-per-path-not-per-module.md) named and left open, closed by neither of the two routes it predicted. `builder-settings` derived `protected` — Archon-only to scope a goal to — on exactly one glob, `src/bongos/routes/me.js`, caught by the blanket `src/bongos/routes/` prefix. **That glob was never an ownership claim:** `MODULE_GLOBS` listed it for task AFFINITY and said in the same comment that the `GET /me` aggregator stays a thin core facade, and `isProtected()` cannot tell the two apart. **Both predicted routes were measured and rejected.** Narrowing the blanket prefix: all eighteen files under `src/bongos/routes/` are protected by that prefix AND NOTHING ELSE, so narrowing unwalls `auth.js`, `builders.js`, `backup.js` and `core-update.js` together — now pinned as a tripwire test rather than left as a caution. Moving `me.js` into `modules/builder-settings/`: the aggregator resolves TEN module ports (`lifecycle`, `reward`, `onboarding`, `government`, `specialities`, `grade`, `box`, `art` ×2, `discord`) and `builder-settings` is one of them, so hosting it inside one module means resolving nine foreign ports from the inside — the `core -> module` edge [ADR 0083](0083-modular-architecture-strangler-build-plan.md) rule 1 forbids. Decision: **ownership follows what the file is** — `me.js` moves to `kernel`, which already owns `src/bongos/routes/security.js`. This is 0314 one step on: owning the command is not owning the authority, and **being listed next to a module is not owning it either**. **Rejected: a general affinity tier** in `MODULE_GLOBS` mirroring `isCommandPath` — the audit does not support it. Three other modules (`kernel`, `devsecops`, `methodology`) are also protected only by paths outside their own directory, but in each the foreign path genuinely IS the domain; `builder-settings` was the only module protected by a path its own source called core, so a new tier would be a new place for a hole to hide, built for a population of one. `protectedModules()` goes 9 -> 8. **The wall that matters does not move:** a sub-Metic builder touching `/me` is still refused by `checkPermissionPaths`, asserted directly rather than assumed. The sixteen still-unowned route files remain [task 1004116](https://cloudbongos.com/builders#/task/1004116), whose option (a) this de-risks.](0318-listing-a-file-for-task-affinity-is-not-owning-it.md) | permissions / module scope |
 | 0321 | [**Brightness is a payout-weighted share, and a removal's targets are rows** ([task 1004099](https://cloudbongos.com/builders#/task/1004099), goal 1000095 — BONGOS-V2). Size is an idea's total ideator payout and never falls; brightness is how much of that work is still alive, and the pair is what lets a thought whose version was torn out draw LARGE AND DARK rather than merging with one that never mattered. Two things had to be settled. **The removal facts were stored in the wrong direction**: [ADR 0319](0319-a-removal-verdict-is-a-row-beside-the-question.md) gave a confirmed removal a row carrying the verdict and `ship_task_id` — the task whose merge DELETED the files — and deliberately left out the tasks whose work was removed, saying brightness would design its own storage when it needed one. Those are different rows under different ideas, so reading one as the other dims the wrong star while looking like a working query. `<redacted>` stores `(proposal_task_id, removed_task_id, paths)` at PROPOSAL time, from the SAME derivation objects the proposal body renders as prose — one derivation, two renderings, so they cannot disagree and `removal-proposals.js` keeps its refusal to parse a body back. Proposal time and not verdict time because the attribution comes from capped, rate-limited GitHub commit-history reads that only exist while the cascade runs. NOT a runner fan-out ([ADR 0242](0242-a-cascade-is-a-declaration-table-on-the-event-that-already-exists.md)): the rule still files one task; this records a side fact about it. `ON CONFLICT DO NOTHING`, never `DO UPDATE`, since a degraded second walk finds FEWER paths and must not erase a good first read — and the writer runs on the cascade's SKIPPED row too, so a re-ship repairs what a derivation outage missed. **The share is weighted by PAYOUT, not by task count**, or deleting a one-line fix dims a star as hard as deleting the feature; weighting by what each hop earned also makes 'large and dead' exact, and makes the two channels a share of ONE number rather than two unrelated measurements. Basis is paid + estimated to match size, which required `priceDescentForIdea`/`ideaSizes` to return a per-task `byTask` summing EXACTLY to `credits` — including ledger payments for tasks the descent no longer reaches, which `idea-size.js` keeps in `credits` so size cannot fall and which would otherwise make the parts sum to less than the whole. Three edges, each silent: an idea that earned nothing is `share: 1, hasWork: false`, because zero over zero is not zero and a protostar is not a remnant (the BV2.R19 distinction); an unreadable removal port gives `share: null, attributable: false`, because 'could not look' is not 'nothing was removed'; and a CONFIRMED removal naming no target dims nothing at all — brightness cannot know which idea — so `countUnattributedConfirmed()` exists to say the gap out loud instead of quietly brightening the sky. Brightness lives in `economy` beside size and reaches lifecycle through the new `lifecycle.removals` port, resolved OPTIONALLY and NOT declared in `consumes` (declaring it would turn 'lifecycle off' into 'instance will not start' — the `ideas.descent` precedent). **No credit is clawed back and nothing here writes**: ADR 0313 stands, `shipped` is terminal, only the picture changes. Rejected: parsing the proposal body (ADR 0319 already refused it — a human-facing line shape fails silently when reworded); re-deriving at verdict time; treating `ship_task_id` as the removed task; counting tasks rather than payouts; clamping the share at the top, which would hide the anomaly it claims to prevent.](0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md) | ideas / economy |
 | 0322 | [**The five states are derived once, and a remnant needs evidence** ([task 1004103](https://cloudbongos.com/builders#/task/1004103), goal 1000095 — BONGOS-V2). The ideator surface draws a thought as one of five objects — star, protostar, satellite, remnant, cold body — and three surfaces are about to draw them (the room, the descent, the sky). Every fact already existed: `idea_inbox.status` (`core_195`), [ADR 0321](0321-brightness-is-a-weighted-share-and-the-targets-are-a-row.md)’s `hasWork` / `share` / `attributable`, and `tasks.goal_id` + `tasks.status`. What was missing was ONE place that reads them: a state inferred in three renderers is three states, and the sky can say a thought went out while the room beside it still calls it alive, with nothing erroring. **Decision:** one pure resolver (`modules/ideas/idea-state.js`), brightness exposed on the `reward` port (ideas may not reach `credit_log` any other way — [ADR 0083](0083-modular-architecture-strangler-build-plan.md) rule 1 — and already declares `reward` in `consumes`), and the ORDER of the tests IS the decision. **MERGED wins over everything:** a folded thought keeps its own money (`trail-size.js` is emphatic) but is no longer its own point in the sky, so letting work win draws one idea twice, beside the thought that absorbed it. **WORK beats a DISCARD:** a cold body “never ignited, so it has no size at all” is a stated PROPERTY, and testing work first makes it true by construction — triage really can discard a duplicate whose twin already routed and paid, and `updateIdea` never touches the ledger. **A REMNANT needs EVIDENCE, never the absence of an answer:** `share: 0` is a confirmed removal, `share: null` is an unreadable one, and ADR 0321 pays for that distinction upstream — so an idea with work and no readable facts is a STAR carrying `attributable: false`, because reading a falsy share as death turns one unmounted module into a sky of hollow rings. **A PROTOSTAR is the absence of WORK, not of a status:** ignition is being PAID for something, so a promoted-but-unshipped idea is still unignited, which is exactly what the nod queue exists for. **Position is a second axis** (`well` / `open-space` / `awaitingNod`) because the design says the object alone cannot carry it, and the nod is asked of EVERY task, not only the one that named the well. **`suggested_goal_id` is deliberately NOT a well** — `projection.js` records it as strictly advisory, the routing hint on a filing that did not convert, so reading it would put a thought in a nod queue with no task to promote; the binding `tasks.goal_id` now rides on both of the trail’s task joins at no extra round trip. The page reads the ledger ONCE: the state attach hands economy back the `byTask` breakdown size just computed, all of them or none (a partial map reads a missing entry as “no work” and draws a paid star as a protostar). An absent `reward` port does not empty the sky — states still resolve, flagged unattributable. Nothing writes; ADR 0313 stands. Rejected: resolving in each renderer; deriving from `share` alone (it merges a protostar with a remnant, the exact BV2.R19 distinction); treating an unreadable share as zero; status-first ordering; reading the hint as a home; a sixth object for “unknown brightness” (the vocabulary is the owner’s and is five — the uncertainty is a flag on the answer, not a new thing in the sky).](0322-a-remnant-needs-evidence-and-merged-wins.md) | ideas / economy |
+| 0323 | [**Hosting is three shapes, and we are not the landlord** ([task 1004140](https://cloudbongos.com/builders#/task/1004140), goal 1000106 — BONGOS-V2). Five projects ran as one Node process each on the control-plane droplet, about $0.80/month apiece — the cheapest arrangement available, bought with ~4,600 lines of `provision*.js` that write systemd units, create unix accounts, render Caddy snippets, `createdb`, install backup timers and count memory against a ceiling. That is the cost nobody priced: **we are a landlord.** The owner reframed the question — build on what others maintain, and let an owner keep the deployment platform they already use. **Seven decisions.** The shapes become `byo-host` (the owner runs it), `cloud-host` (we stand it up for them) and `dedicated-cloud-host` (the same path, larger plan); `co-tenant` is **retired, not renamed**, because it means *a process on our box from our checkout* — the opposite of bring-your-own-host, so reusing the name would make every existing comment lie. **DigitalOcean hosts hubs only**, which closes [ADR 0145](0145-free-hosted-project-tier-isolation-and-domain-separation.md) Finding 1 by removing its precondition rather than hardening the cookie: with no customer code on a `cloudbongos.com` subdomain there is no tenant to receive the hub session. **Render is the default** — its Postgres carries PITR and automated backups on every paid tier; Fly's managed Postgres starts ~$38/mo and Railway's is explicitly unmanaged, which is the exact responsibility being shed. **Cloudflare is the front door, not the compute**: Workers is a V8-isolate runtime that would require rewriting Express and `pg`, and Containers is built for bursty workloads that sleep, which a hall with background sweeps and a live event stream does not survive. **No deployment-platform adapter is built at all** — their application already deploys itself from the repository, so the platform we do not talk to is the platform we do not have to add. **Secrets: the platform is the system of record and Bongos stores names, never values** — a manifest of name, purpose and environment, no application secret, no platform API token, no "is it set?" probe, because each of those makes us custodian of other companies' credentials for convenience the manifest already delivers; `byo-host` marks the manifest unverifiable rather than opening an exception. **The free tier becomes a capped trial**, since ~$14/project cannot be subsidised indefinitely. Per-project cost rises ~17×, which is the price of not being a landlord and the reason metering stops being deferred work. Mostly a DELETION: [ADR 0306](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)'s supervision seam is not extended (Render supervises its own processes), [ADR 0285](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md) stays true and stops being load-bearing with its queued resize held rather than spent, and the hub's offsite backup becomes the highest-consequence open item. Rejected: AWS/GCP (2–3× the cost for a bare instance, plus an IAM and billing surface to learn — maintenance added where the goal is to remove it); keeping the shared box and fixing only the cookie (cheaper, closes the finding, leaves the landlord runner and answers nothing else); a Vercel/Netlify/Render adapter layer (speculative pluggability); Bongos as the secrets vault pushing values through platform APIs.](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) | hosting / provisioning / cost |

package/docs/module-api-changelog.md

@@ -2360,5 +2360,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.941 with no explicit bump. run 35659043986. (task 1002620)
   1.19.943 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.942 with no explicit bump. run 35661533404. (task 1002620)
+  1.19.944 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.943 with no explicit bump. run 35665131778. (task 1002620)
+  1.19.945 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.944 with no explicit bump. run 35668642462. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.943",
+  "version": "1.19.945",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.943",
+      "version": "1.19.945",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.943",
+  "version": "1.19.945",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/agents-sync.js

@@ -317,6 +317,14 @@ function planSync(files, { existingByName = new Map(), authorRankFor = () => nul
 
 // ---- disk + git ------------------------------------------------------------
 
+// The repo a definitions dir belongs to, by the `<root>/.claude/agents` layout.
+// Not REPO_ROOT: a split-root instance runs this script from the core package
+// while its definitions live in the instance repo (task 1004139), so paths and
+// git history must be read against the definitions' repo, not the core's.
+function definitionsRoot(dir) {
+  return path.resolve(dir, '..', '..');
+}
+
 // An ABSENT directory is a legitimate state, not an error: `.claude/agents/`
 // does not exist in the core tree at all today, and an instance that ships no
 // agents must deploy cleanly. Zero files, exit 0, nothing written.
@@ -328,10 +336,11 @@ function readAgentFiles(dir = DEFAULT_DIR) {
     if (err.code === 'ENOENT') return [];
     throw err;
   }
+  const root = definitionsRoot(dir);
   return names.sort().map((f) => {
     const full = path.join(dir, f);
     return {
-      file: path.relative(REPO_ROOT, full).split(path.sep).join('/'),
+      file: path.relative(root, full).split(path.sep).join('/'),
       candidate: parseAgentFile(fs.readFileSync(full, 'utf8'), { name: f.replace(/\.md$/, '') }),
     };
   });
@@ -350,9 +359,9 @@ function readAgentFiles(dir = DEFAULT_DIR) {
 //
 // It is kept because provenance is genuinely useful where nothing is riding on
 // it. The wall is that it is never consulted where it could grant anything.
-function lastCommitterLogin(file, { runGit = defaultRunGit } = {}) {
+function lastCommitterLogin(file, { runGit = defaultRunGit, cwd = REPO_ROOT } = {}) {
   let out;
-  try { out = runGit(['log', '-1', '--format=%ae%n%an', '--', file]); }
+  try { out = runGit(['log', '-1', '--format=%ae%n%an', '--', file], cwd); }
   catch { return null; }
   const [email = '', authorName = ''] = String(out || '').split(/\r?\n/);
   const noreply = /^(?:\d+\+)?([A-Za-z0-9-]+)@users\.noreply\.github\.com$/.exec(email.trim());
@@ -360,8 +369,8 @@ function lastCommitterLogin(file, { runGit = defaultRunGit } = {}) {
   return authorName.trim() || null;
 }
 
-function defaultRunGit(args) {
-  return execFileSync('git', args, { cwd: REPO_ROOT, encoding: 'utf8' });
+function defaultRunGit(args, cwd = REPO_ROOT) {
+  return execFileSync('git', args, { cwd, encoding: 'utf8' });
 }
 
 module.exports = {
@@ -386,11 +395,12 @@ async function main() {
   const asJson = argv.includes('--json');
   const dirIdx = argv.indexOf('--dir');
   const dir = dirIdx >= 0 ? argv[dirIdx + 1] : DEFAULT_DIR;
+  const root = definitionsRoot(dir);
 
   const files = readAgentFiles(dir);
   if (files.length === 0) {
     if (asJson) console.log(JSON.stringify({ ok: true, scanned: 0, plan: [] }));
-    else console.log(`agents-sync: no definitions under ${path.relative(REPO_ROOT, dir) || dir} — nothing to reconcile.`);
+    else console.log(`agents-sync: no definitions under ${path.relative(root, dir) || dir} — nothing to reconcile.`);
     return 0;
   }
 
@@ -413,7 +423,7 @@ async function main() {
   // ONE git subprocess per file, memoised — `authorRankFor` is called again from
   // planSync, and re-shelling out there doubled the blocking spawns for an answer
   // that cannot have changed mid-run.
-  const loginByFile = new Map(files.map((f) => [f.file, lastCommitterLogin(f.file)]));
+  const loginByFile = new Map(files.map((f) => [f.file, lastCommitterLogin(f.file, { cwd: root })]));
   // One query for every distinct committer, not one per file.
   const logins = [...new Set([...loginByFile.values()].filter(Boolean))];
   const rankByLogin = new Map();

package/scripts/migrate.sh

@@ -411,14 +411,16 @@ fi
 # Gated on the module set the module loop just migrated (DB overrides included,
 # task 1004138). A fresh isModuleEnabled() read never loaded the overrides, so an
 # `agents` switched on in the hall got its tables but never its registry. Pinned to
-# $DB like that read, so the reconcile writes into the schema this run applied. The
-# file check keeps an instance without the script as silent as the old cwd-relative
-# require left it: a split-root instance (core in node_modules) still does not
-# reconcile, because which .claude/agents it should read is an open design question.
-if [[ " $NODE_ENABLED_MODULES " == *" agents "* ]] && [ -f scripts/gds/agents-sync.js ]; then
+# $DB like that read, so the reconcile writes into the schema this run applied.
+#
+# The script is the core's, the definitions are the instance's own (task 1004139, an
+# owner decision): a split-root instance (core in node_modules) reconciles ITS
+# .claude/agents, never the core package's shipped set and no merge of the two.
+# Single-root, CORE_ROOT == INSTANCE_ROOT and this is the same call as before.
+if [[ " $NODE_ENABLED_MODULES " == *" agents "* ]]; then
   echo
   echo "post-deploy: reconciling .claude/agents/ into the agent registry"
-  if ! DATABASE_URL='' PGDATABASE="$DB" node scripts/gds/agents-sync.js; then
+  if ! DATABASE_URL='' PGDATABASE="$DB" node "$CORE_ROOT/scripts/gds/agents-sync.js" --dir "$INSTANCE_ROOT/.claude/agents"; then
     echo "post-deploy: agents-sync failed — the registry is stale by one deploy, not broken" >&2
   fi
 fi

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.943'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.945'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/agents_sync.mjs

@@ -24,6 +24,7 @@
 // Run:  node tests/agents_sync.mjs
 
 import { strict as assert } from 'node:assert';
+import { execFileSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -279,6 +280,32 @@ t('a real directory is read, .md only, sorted', () => {
   assert.deepEqual(files.map((f) => f.candidate.name), ['alpha', 'historian'], 'sorted, so a run is reproducible');
 });
 
+console.log('\na split-root instance reconciles its OWN definitions (task 1004139):');
+
+t('definitions outside the core read against their own repo, not the core', () => {
+  // The core runs from node_modules while .claude/agents lives in the instance repo.
+  // Read against the core, source_path came out as ../../../.claude/agents/x.md and the
+  // git author lookup ran in the wrong repo.
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-sync-instance-'));
+  const dir = path.join(root, '.claude', 'agents');
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(path.join(dir, 'scout.md'), FILE.replace('name: historian', 'name: scout'));
+  const git = (...args) => execFileSync('git', args, { cwd: root, stdio: 'ignore' });
+  try {
+    git('init', '-q');
+    git('add', '.');
+    git('-c', 'user.email=12345+octocat@users.noreply.github.com', '-c', 'user.name=Someone',
+      '-c', 'commit.gpgsign=false', 'commit', '-q', '--no-verify', '-m', 'add scout');
+
+    const [f] = sync.readAgentFiles(dir);
+    assert.equal(f.file, '.claude/agents/scout.md', 'source_path is relative to the instance root');
+    assert.equal(sync.lastCommitterLogin(f.file, { cwd: root }), 'octocat', 'history is read from the instance repo');
+    assert.equal(sync.lastCommitterLogin(f.file), null, 'the core repo has no history for an instance file');
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
 console.log('\nplanSync — the whole reconcile, still pure:');
 
 t('one plan entry per file, each carrying its own author rank', () => {
@@ -407,6 +434,11 @@ t('migrate.sh invokes agents-sync, module-gated and fail-open', () => {
   // a fresh isModuleEnabled() read never saw a hall toggle.
   assert.match(sh, /\$NODE_ENABLED_MODULES " == \*" agents "\*/, "gated on the module — it is default:false");
   assert.doesNotMatch(sh, /isModuleEnabled\('agents'\)/, 'no override-blind re-read of the module flag');
+  // Split-root (task 1004139): the core's script, the instance's own definitions, pinned to
+  // $DB — and no instance-relative file check, which silenced every split-root instance.
+  assert.match(sh, /DATABASE_URL='' PGDATABASE="\$DB" node "\$CORE_ROOT\/scripts\/gds\/agents-sync\.js" --dir "\$INSTANCE_ROOT\/\.claude\/agents"/,
+    'reconcile the instance .claude/agents with the core script, against $DB');
+  assert.doesNotMatch(sh, /-f scripts\/gds\/agents-sync\.js/, 'no instance-relative existence check');
   // Fail-OPEN: a stale registry is a nuisance, an aborted deploy is an outage,
   // and the script is already fail-closed about what it imports.
   assert.match(sh, /agents-sync failed — the registry is stale by one deploy/,