@bongos/core 1.19.972 → 1.19.973

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.972",
-  "core_contract": "1.19.972",
-  "source_commit": "9fce7e3ef8b701095baab0a73a5d77bacad4e248",
+  "core_version": "1.19.973",
+  "core_contract": "1.19.973",
+  "source_commit": "8bcf4277c73e7ff41a8f1af4410a2784be3df109",
   "source_ref": "HEAD",
-  "built_at": "2026-09-23T01:29:44.787Z",
+  "built_at": "2026-09-23T03:12:31.192Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 515,
+    "docs_redacted": 516,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2377,
+    "functional_verbatim": 2378,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2918,
-  "tree_sha256": "948ab322187e69c6c5bdfd4f4e12497878a45400efad815f540cbd79b8d50a19",
+  "file_count": 2920,
+  "tree_sha256": "40673ab635365235ddebe8e5c8660ca9a834bff7591bf34c9a42008b8b5f0b0a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1027,7 +1027,7 @@
     {
       "path": "docs/adr/0111-instance-hosting-provisioning-module.md",
       "mode": "0000644",
-      "sha256": "d216d4cfb0f269afa00af7963b3fe16d97596a6407b26859c7fd3126c7fc518c"
+      "sha256": "9d756ca919e0851c57ae20d5151bea438920706fe8716af626438e9ba208a01f"
     },
     {
       "path": "docs/adr/0112-private-goals-invitations-join-requests.md",
@@ -2107,7 +2107,7 @@
     {
       "path": "docs/adr/0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md",
       "mode": "0000644",
-      "sha256": "8fa6ef943e3fc0855d15f83baefaabf810994b80da2ecdbbcc28d752ed0498f3"
+      "sha256": "fb85b571c6d7838df24f0775e53ed676300e2715ae8c8cdd03eb2129062ce9e3"
     },
     {
       "path": "docs/adr/0324-the-public-npm-cli-channel-is-retired.md",
@@ -2117,17 +2117,22 @@
     {
       "path": "docs/adr/0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md",
       "mode": "0000644",
-      "sha256": "6ae902e7626feb915300f4b21b6d20ae3369116a86bf624bd614ac9616c3ac11"
+      "sha256": "a3e70f66c143eebc01bf5108eac294925b01996f64a6aadaf11f135163daa8c3"
     },
     {
       "path": "docs/adr/0326-an-upgrade-may-add-a-deny-rule-to-a-file-the-instance-owns.md",
       "mode": "0000644",
       "sha256": "7484e3b187c1aa84b23ef359baf8e86eabcf61164c9f75076af1e53ef04020f1"
     },
+    {
+      "path": "docs/adr/0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md",
+      "mode": "0000644",
+      "sha256": "2c80244a082fb8c907bc83690724dbfb775adc35da124977668d8e56425d99b2"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "116fb18808cd324f04600f3c7fd15bb849b0c5c81871db1995f2dcee9bb7e77b"
+      "sha256": "114e0093960f4c02a66e79fc10c3ff779889452889886b7e07c0fe732c751915"
     },
     {
       "path": "docs/api-reference.md",
@@ -2142,12 +2147,12 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "845aca9c32af0d4982eba5aefae1126cb77807eb8f5452f338a79895a9a56eb8"
+      "sha256": "c81ef654e2952bba818d2c3aa8b3ceba9601a3984558babbdb3db91258832284"
     },
     {
       "path": "docs/branding-contract.md",
       "mode": "0000644",
-      "sha256": "69be768131540bf8830bcf51b3d09991175859ddc1145059d0f4e5591f03b9b1"
+      "sha256": "ac14c9d29de36fdcc10553c603d9768e4dccd315a0815f6201439ee80e7177f2"
     },
     {
       "path": "docs/branding-fill-prompt.md",
@@ -2157,17 +2162,17 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "bbc4878ab6e3a0cedf5fad1b197d427b44d89ea2d32fd8dce9babfe73da09ee1"
+      "sha256": "1ffa2b188ed243db1b881298fda5391ece0383c8c02367109bad08698d1a9935"
     },
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "256b788dfe46690ad1ea7ddc9b3b74d7c2fcd9ccdee01bc137c019e8ea27bef5"
+      "sha256": "3174b60315d83707f5f9ab53f6dae77fc7c0a50fdb2da3d7ff866e0ebdfb414b"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "b303a8877949a33be44587d5cb8f5f04af4978cd3282e1237ba46a8775bf0107"
+      "sha256": "828a4e9925c463d88698b98da4510e7fda508234b88b96fc8af7a9f5652b901a"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2242,7 +2247,7 @@
     {
       "path": "docs/design/projects-hub-direction-v2.md",
       "mode": "0000644",
-      "sha256": "fcf62d08a9a8fd1f362686cbc2e0caefdb18b917c9b22997c9133e52a7928afe"
+      "sha256": "21234463264e42940104122e2128d2ea7bd70f12b3dd5c58b79f60121e5925d5"
     },
     {
       "path": "docs/design/projects-hub-direction.md",
@@ -2682,27 +2687,27 @@
     {
       "path": "docs/design/vanilla-hall-ui-redesign-scope.md",
       "mode": "0000644",
-      "sha256": "94f0874388d36d1b2bc1b6aa79f3793ea9b842d9de88ce84622f969108a03a4c"
+      "sha256": "1c8d6c3d7ed30281edafe76965c0e4ddd3e4c273d32c2b2f091eea961a7eb8d3"
     },
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "ca43a028309885e4375a3fa216fc2636d33262d3038bf9e65a15f6e8b68f354d"
+      "sha256": "4422d0aacc8d5da421837809008fe8c3bbbc7082e497f032bacc7a0babf74cf8"
     },
     {
       "path": "docs/handoff-template.md",
       "mode": "0000644",
-      "sha256": "a60d85b8523b5944d4db8105b60166395ab9c1f931fb92f0f95a825b657fe277"
+      "sha256": "8792668e8f0c09ec14951e4a7d11902a5890198723442f7c21932adcc1b941be"
     },
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e18c78ed476eaa5040d43d446f95d7d580cbb59e2804d49171843338149a493d"
+      "sha256": "901f1a8dfe7a0aea5b6ac94a6b931fe7a7241a79948b02570ae8a872777dd382"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "c1e41acf516ebd056ba4d1f1ab8f731d4e80bbce13cf334524c04611940fc1fb"
+      "sha256": "e7e260c0dbd767070a9d40513eec4d6de47a6c3b363ee43d888fdb366a57be80"
     },
     {
       "path": "docs/onboarding/browser-terminal-guide.md",
@@ -2757,7 +2762,7 @@
     {
       "path": "docs/onboarding/drachmae-and-karma.md",
       "mode": "0000644",
-      "sha256": "015f8b4299d0682ceaa7c0fd8fba6ffdfb2063d1c56e49e992f53ab5bb584c12"
+      "sha256": "8ae9e810de94cee194d7756f8cf7aa945bae8d36ad9e40ccb68e84f13de0cfcc"
     },
     {
       "path": "docs/onboarding/primer.md",
@@ -2777,12 +2782,12 @@
     {
       "path": "docs/packs/engineer.md",
       "mode": "0000644",
-      "sha256": "87ecb718bbac689f52e3bc640f900e738f7b79015f2ca2157c56a86d748f322c"
+      "sha256": "b7cb50de31efaa49ce41a475a916abc652454a2eacca5aaaaf8ee8cba46067c6"
     },
     {
       "path": "docs/packs/ideator.md",
       "mode": "0000644",
-      "sha256": "93cef9d530a668d750d6cba4789fda25b15d176c35366240cb72187e272fa141"
+      "sha256": "bcb98ba4302f46c2001eb7081684300150966a7b05cc43691199fa1573292f90"
     },
     {
       "path": "docs/project-context.template.md",
@@ -2792,12 +2797,12 @@
     {
       "path": "docs/recipes/README.md",
       "mode": "0000644",
-      "sha256": "08332b6f45ad3f4c5784022824f934deb8a9818716184062e97bafc610b8c2f7"
+      "sha256": "507b8581452bd98ae1a7332f612792daf9524634a3a8f2464552dbe00efb98bd"
     },
     {
       "path": "docs/recipes/audit-replay.md",
       "mode": "0000644",
-      "sha256": "df362cf57fd748cca551a0c1a7048a678d5e833490dc5d2ab5d6ce1d33595f33"
+      "sha256": "a64df81552aeae1f6a58466d112a5ff9cc0c19c81d98fc5b0a24b5768146cb97"
     },
     {
       "path": "docs/recipes/autobongos-windows-host.md",
@@ -2832,7 +2837,7 @@
     {
       "path": "docs/recipes/gds-db-backup.md",
       "mode": "0000644",
-      "sha256": "d3e628bc627cb29874e977bf2e93c6557dc72a210506c22515a983f4f513d627"
+      "sha256": "50a69f0112049bb2061c52ddf98723b56ba40908baf356cc18f9ec55f7d1ec4b"
     },
     {
       "path": "docs/recipes/instance-deploy.md",
@@ -2857,7 +2862,7 @@
     {
       "path": "docs/recipes/managed-settings-remote-control.md",
       "mode": "0000644",
-      "sha256": "d1bc074f2a8de8d6d32f32d832e425637dc1dc6a03ae57ec417cd5a003264237"
+      "sha256": "c4fd5c7bae9889d56344298827694c84f0d5608f5f883e01fc846d02de8ea28c"
     },
     {
       "path": "docs/recipes/memory-backup.md",
@@ -2867,7 +2872,7 @@
     {
       "path": "docs/recipes/memory-sync-conflicts.md",
       "mode": "0000644",
-      "sha256": "320e8fc42e8695493764257bf0475028b063b5709b2ef10978ba3e9ad27c758f"
+      "sha256": "4afa777a2b03efab6747d17f8a1d467e6be68b7abb9f001a9ad41c2da11b67dc"
     },
     {
       "path": "docs/recipes/multi-builder-merge.md",
@@ -2877,12 +2882,12 @@
     {
       "path": "docs/recipes/ops-gotchas.md",
       "mode": "0000644",
-      "sha256": "7c314496531873dae2d637017575a22bd731e59849d196a13e7a8999ae5fc764"
+      "sha256": "b94f63ecf7d8a061265c2ba33997a1032940f6ddf11de7083ad877d6bcb17ff4"
     },
     {
       "path": "docs/recipes/overnight-builder.md",
       "mode": "0000644",
-      "sha256": "7aeb6baa163a79e7ac8903886198896cbe3a9a52bdea5b60450a693632b1f74b"
+      "sha256": "2424d2fdc4438bebdd9e90e163386316635e5144847f3fcb8177796dbd5adb5c"
     },
     {
       "path": "docs/recipes/packaging-the-core.md",
@@ -2892,7 +2897,7 @@
     {
       "path": "docs/recipes/parallel-goal-waves.md",
       "mode": "0000644",
-      "sha256": "4879badb2ab0678098d3f5cfa1002a6b4b50e8a691a5d4afc17b533803fbe262"
+      "sha256": "d549a07d80b133e8bec623dab7bd1204e191a0a0096c933dbcf80e9b0d50ea72"
     },
     {
       "path": "docs/recipes/private-npm-distribution.md",
@@ -2907,12 +2912,12 @@
     {
       "path": "docs/recipes/reranking-a-goals-board.md",
       "mode": "0000644",
-      "sha256": "ecd8986c5e4831db53a803dae625e5f1b898b711911e8e6f1c4f1b79a98cbfe8"
+      "sha256": "40232652e9d474dd37052457f832b2b3f0f5b99d6b1abb025c1b73231217f284"
     },
     {
       "path": "docs/recipes/search-index-ingestion.md",
       "mode": "0000644",
-      "sha256": "71ea9295e4f66375ce29f00b6fc3e6e12bc34fc5c1709e8b813d1c4071198963"
+      "sha256": "a2f3bf8406ec48be025b5c59fd66292f489dcf8645cde309a3aee7dc6522616f"
     },
     {
       "path": "docs/recipes/self-host.md",
@@ -2927,12 +2932,12 @@
     {
       "path": "docs/recipes/ship-and-regrade.md",
       "mode": "0000644",
-      "sha256": "f4adbd2090b5ae49c69a76fe181a0f19bdfe186a09d666063ca290b724ae60ea"
+      "sha256": "3308eb707071987ba85c7d2f0b21e209ab1fe3954640d56fb3afda4bd428654d"
     },
     {
       "path": "docs/recipes/staging-environment.md",
       "mode": "0000644",
-      "sha256": "6a8c677c81185f2f4d8474303d331f7226e1f10cd6a4be1d7914fa4a2c3e2d6e"
+      "sha256": "97cd5890168ad31eae842ff4f9c2f3f084b32fe06b390facebec776823e7aa45"
     },
     {
       "path": "docs/recipes/standalone-live-docs.md",
@@ -2952,7 +2957,7 @@
     {
       "path": "docs/recipes/windows-builders.md",
       "mode": "0000644",
-      "sha256": "2608bea40745e61407454eb73ff3dc19d2c088a986741fb243001a1a0848ee00"
+      "sha256": "1155aa374c885816f59c87d9da1932275450a11f131c5e9545d15ae02daf663e"
     },
     {
       "path": "docs/research/cursor-competitive-analysis.md",
@@ -4827,12 +4832,12 @@
     {
       "path": "modules/hall-ui/public/deploy.html",
       "mode": "0000644",
-      "sha256": "7754c64bee96f0d833f443ad2a666de6bd106703faa8a6fe7e0dab3820684b89"
+      "sha256": "b7ef61f7c61406f8a178c0dfbffe03b2b40119f8e2f5425fef50a4e0086282c4"
     },
     {
       "path": "modules/hall-ui/public/deploy.js",
       "mode": "0000644",
-      "sha256": "e3a4fa62e761dddfb54a1f13680eb64ff87c4d37e83fa41a846ebfe1f41d44c8"
+      "sha256": "a38b55232d052171493a7887e37886e8bfe5ec76c39d7d52c6285729c0514fc1"
     },
     {
       "path": "modules/hall-ui/public/diagram-viewer.css",
@@ -5202,7 +5207,7 @@
     {
       "path": "modules/hall-ui/public/project-settings.css",
       "mode": "0000644",
-      "sha256": "142e1d75d854b7764b5e3160a69dd99d35f3f7ae5174544ed17fc8c6eea97c31"
+      "sha256": "67039998300271792308b65c2a418e3473a550c8891a074496069a3c56d2d98f"
     },
     {
       "path": "modules/hall-ui/public/project-settings.html",
@@ -6577,7 +6582,7 @@
     {
       "path": "modules/provisioning/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "96c6b73411a489e5c41fd567123fa8ef35f7a757db0e1df0c0cafd720674b05f"
+      "sha256": "d87095c75428e1996be5fb51c4dd65b4d99f78706cedd94a14fc05e5b2c602fd"
     },
     {
       "path": "modules/provisioning/credential-preflight.js",
@@ -7282,12 +7287,12 @@
     {
       "path": "modules/public-landing/public/contact.html",
       "mode": "0000644",
-      "sha256": "22e81df702236494bff7f283cd25ecbca92df2ea485d995fbd66c0e924faff41"
+      "sha256": "c630db2604c7aad51b6ff4f5651c3eab999af27b0f96ca5d7df59dd8945c4879"
     },
     {
       "path": "modules/public-landing/public/index.html",
       "mode": "0000644",
-      "sha256": "5d34918fcf47f5fecb866083427ec41e9cf9ceef485796dc7152f45ce4d6c7b1"
+      "sha256": "2ede2b2d6a11ee21f23993ba81b5e82f74e41a923d6c02516fab3741842b949f"
     },
     {
       "path": "modules/public-landing/public/index.probes.json",
@@ -7302,7 +7307,7 @@
     {
       "path": "modules/public-landing/public/privacy.html",
       "mode": "0000644",
-      "sha256": "5af37c9fd5be9c15ac195528764f87c2ade2b63a72a24fadfa87b83183769d28"
+      "sha256": "ed096a49d0844a258f166bec5deae5f4a58542c6611d9cbdfe437ba17ff14f42"
     },
     {
       "path": "modules/public-landing/public/projects-empty.states.json",
@@ -7317,7 +7322,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "180097d115d67efd4d5c08119529eb4e9cbafe6e8cae26d5e59c26f910a1434d"
+      "sha256": "a9c38198d1491112e83ae135ac59f1318e6beb076d551677e9a239ce0ed6a335"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -7332,7 +7337,7 @@
     {
       "path": "modules/public-landing/public/terms.html",
       "mode": "0000644",
-      "sha256": "7f94fcaabb2492951486ce22b876363c09fbe1dec6a2eb43127a3d0ce2041409"
+      "sha256": "b39a1dc189c251abe3cc60dfb2d5fb997f1b51e577d8250460cb48522f857d80"
     },
     {
       "path": "modules/public-landing/public/world/assets/clouds/cloud-island-large.png",
@@ -8117,12 +8122,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c08af41c51336f01814141c562006928a15dce58c8c8530222455609c3e3db21"
+      "sha256": "d11c17bd857df10fee11791ce0185febbd12f4ef00a3dfb3b4e458e5774dbfd8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e183e45cad3be4bb295d3693f3ef9fa5249c2a7b1f3898a0e5b58f8d27f013a4"
+      "sha256": "af8108050fe47609107780692cb3baae77f379e91b4033450f5e57402c18f5fb"
     },
     {
       "path": "public-docs/index.html",
@@ -8217,7 +8222,7 @@
     {
       "path": "scripts/gds/api-alias-caller-scan.js",
       "mode": "0000644",
-      "sha256": "bdb23756d2dcf4f9a3f22a8c64151f70aee5c62b82601672f5e8fb6adbc367ed"
+      "sha256": "bc4fc8d9590f642eb4f0b1175cdb1faf0c3245eecc3c0d01956f4c64dff79b37"
     },
     {
       "path": "scripts/gds/api.js",
@@ -8489,6 +8494,11 @@
       "mode": "0000644",
       "sha256": "8ac4c8909b75aa5e2022a967ba9ac0cbcdac60da9d75757603827b86964c825b"
     },
+    {
+      "path": "scripts/gds/cloudbongos-token-isolation.conf",
+      "mode": "0000644",
+      "sha256": "a7ed3ca963b4c96c2a495621174a7f9bea279cf971d263e873742b502940e7e9"
+    },
     {
       "path": "scripts/gds/codemod-rename-src-gds.js",
       "mode": "0000644",
@@ -9072,7 +9082,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "f22c31d00a50a312d7228922cbe70fedc503e704cc7f2cb33a8686a4954c1c1e"
+      "sha256": "3e9467d52cf9b704fc3cfa9f103e86c22b4128bdc021dee104e192f5f13a5ccf"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -9227,7 +9237,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "b536a889714c7f1ddc027b3f29602351d6942e1e52157469a5f82400490ee1d4"
+      "sha256": "34b696c853afcea12cb078f2a75a37072ca25430334d780733ea16def5cf6076"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -9732,7 +9742,7 @@
     {
       "path": "scripts/hall-preview/server.js",
       "mode": "0000644",
-      "sha256": "9c2fc2f33ddd4f51e715e89cc84d615c55aa070ee2173cdaa8fb7559f2f5a14a"
+      "sha256": "48607e2724aceb0a9e116748713dbef945585bacfa962785eb58bfa37349255c"
     },
     {
       "path": "scripts/hall-preview/task-visual.js",
@@ -10137,7 +10147,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e988b9dee4106b2d71184fa4e7df948efbc887e5b963d5bbeb8f709edd2abdba"
+      "sha256": "5c4f2b444f4f874cffab074db62621204eb8b2e198cf31cad9536ea6b0268911"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10332,7 +10342,7 @@
     {
       "path": "tests/api_alias_caller_ratchet.mjs",
       "mode": "0000644",
-      "sha256": "58e78fbcfada9df14fee87c526d225bdcc0e6f65a5e9085a4b6ea382a8041eb2"
+      "sha256": "ed6f7125359286b760f57355b50d04c00e6e8c0c9ecfb3f4f9f8cf3a6babb1ae"
     },
     {
       "path": "tests/api_alias_exceptions.mjs",
@@ -11047,12 +11057,12 @@
     {
       "path": "tests/core_upgrade_door.mjs",
       "mode": "0000644",
-      "sha256": "c4238e2f2e2c52f23fb6948f5e6545bc4880efe75eb9af229a455db6017db05c"
+      "sha256": "edaf8b6ea41f069bed111ff0a7330c4f3b1d4ffc63201364704ed0b25508e7b8"
     },
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "85bc665f5d80ff1c7e8134e6be7dd8fa336b4fb50344164b034b0e72a963f04d"
+      "sha256": "47618fa0dd42bfa8f542b6830c3e68b715e655280f9aaf6684085478b257d497"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -11202,7 +11212,7 @@
     {
       "path": "tests/deploy_page_projects.mjs",
       "mode": "0000644",
-      "sha256": "5c582192ddd83ef289be692b12d898c8837b54312348751082478d036987a647"
+      "sha256": "d9eeb744c03fe5cefa8a86b7128c6da43f24d0acc3705c39899f72c402b3a47e"
     },
     {
       "path": "tests/design_tokens_sync.mjs",
@@ -12332,7 +12342,7 @@
     {
       "path": "tests/idea_spark_hall.mjs",
       "mode": "0000644",
-      "sha256": "35b588799f4d7c72eecb13600800fe6b828c629fb4570c704857f09d9ff10c5d"
+      "sha256": "8f0631d6dd2dd3acf7706b5166aa831e26dd5a3625861b95e3b89187afa48e4a"
     },
     {
       "path": "tests/idea_spark_mark.mjs",
@@ -12517,7 +12527,7 @@
     {
       "path": "tests/known_failing_ratchet.mjs",
       "mode": "0000644",
-      "sha256": "256e691e969fbdb1f023b4673f181ced0663f344ed3a307c40e6531eb6585735"
+      "sha256": "7948d954b8ca3fc3a1229f69e18dc154857e61df812a49a11a7db89199185c4e"
     },
     {
       "path": "tests/land_watch.mjs",
@@ -12527,7 +12537,7 @@
     {
       "path": "tests/landing_legal_pages.mjs",
       "mode": "0000644",
-      "sha256": "b5e616b73f541f7a0e0c3ecbac6137f02a4ed0d59a042dd6f59f82f8eb5b2191"
+      "sha256": "91805fd1afccdfbf97bdfebf771ec22ad86325e8484d5280e234f00a0323a8e6"
     },
     {
       "path": "tests/landing_page.mjs",
@@ -13207,7 +13217,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "19e1b68463ddccb1a1155e1adfb3d4c130711745030183fb1d27650f1bfe5444"
+      "sha256": "b0aa7ed3cbc5a205942dbfb8a34344574a9a350c07dcda816ac70b8f36c5af38"
     },
     {
       "path": "tests/promote_deps_gate.mjs",
@@ -13767,7 +13777,7 @@
     {
       "path": "tests/served_paths_shipped.mjs",
       "mode": "0000644",
-      "sha256": "bae6e331f44fcebe2300b380a390afef771df9ae5a2cfc27caf1b957f9419713"
+      "sha256": "93f085601b9d537b945b18ffb323d511671c31126d7e9a128dad5c787ddfc493"
     },
     {
       "path": "tests/session-cards.mjs",

package/docs/adr/0111-instance-hosting-provisioning-module.md

@@ -1,6 +1,7 @@
 # ADR 0111 — Instance hosting + domains as a Cloud Bongos module: the `provisioning` module boundary + the self-host / managed split
 
 - **Status:** Accepted, **superseded in part by [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md)** (2026-09-21) — the module boundary and the enqueue-only trust boundary STAND; the DigitalOcean droplet and `co-tenant` shapes it provisions do not. Customer projects move to a managed platform; DigitalOcean hosts hubs only.
+- **Status:** §2 STANDS and is now kernel-enforced as of [task 1004176](https://cloudbongos.com/builders#/task/1004176) (2026-09-23). It was, until then, enforced by the code alone — the web tier does only enqueue intents, but both tiers run as the same unix user and the token file was readable by it, so the boundary was a convention ([ADR 0327](0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md) §5). A systemd drop-in (`InaccessiblePaths=/etc/cloudbongos/box.env`, tracked at `scripts/gds/cloudbongos-token-isolation.conf`) now puts an empty mode-000 node over that file in the web tier's own mount namespace. The two tiers still run as the same unix user; the isolation is namespace-based, not ownership-based, and the reasoning for that narrower remedy is in [ADR 0327](0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md) §5.
 - **Status (original):** Accepted (boundary + split decided with the owner; build is task-pending — see §Consequences for the seeded tasks)
 - **Date:** 2026-07-03
 - **Track:** internal (a portable Cloud Bongos platform capability)

package/docs/adr/0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md

@@ -1,6 +1,6 @@
 # ADR 0323 — Hosting is three shapes, and we are not the landlord
 
-- **Status:** accepted
+- **Status:** accepted, **superseded in part by [ADR 0327](0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md)** (2026-09-22) — the platform choice, the not-the-landlord posture and decisions 2, 4, 5 and 6 STAND. Changed: §1 drops `dedicated-cloud-host` (two shapes, not three); §3's ~$14/project is the **owner's** cost, not ours, because a `cloud-host` now runs on the owner's own account; §7's capped free tier is retired with its premise — we no longer pay for customer compute.
 - **Date:** 2026-09-21
 - **Task:** [task 1004140](https://cloudbongos.com/builders#/task/1004140) (goal 1000106 — working area 1, Project creation)
 - **Deciders:** Lars (Archon) — every numbered decision below is the owner's; Claude ran the audit and the platform comparison.

package/docs/adr/0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md

@@ -1,6 +1,6 @@
 # ADR 0325 — The managed fleet control plane is the hub we already run
 
-- **Status:** accepted
+- **Status:** accepted, **decision 4 superseded by [ADR 0327](0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md)** (2026-09-22) — decisions 1, 2, 3, 5 and 6 STAND. Decision 4's "one credential … never per-customer" is reversed: each project brings its own platform key, borrowed for standup and never stored. Its description of `/etc/cloudbongos/box.env` as "root-only on the control plane" was also wrong: the file is mode 600 owned by `lars`, not root, and the web tier runs as that same user, so the web tier could read it. **Fixed by [task 1004176](https://cloudbongos.com/builders#/task/1004176) (2026-09-23)** — a systemd drop-in carrying `InaccessiblePaths` makes the file unreadable inside the web tier's mount namespace, which is what §4 always meant even though it is not what §4 said. The runner units load it unchanged. "Root-only" remains the wrong description of the file; "unreadable by the web tier" is the right one.
 - **Date:** 2026-09-22
 - **Task:** [task 1001948](https://cloudbongos.com/builders#/task/1001948) (goal 1000106 — working area 1, Project creation)
 - **Deciders:** the owner's decisions are [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md)'s. Claude ran the inventory, and decisions 1–4 and 6 follow from that inventory plus 0323 without a new owner call — each one retires a plan rather than choosing between options. **Decision 5 is a recommendation, not a ruling**, and says so; it is filed for the owner rather than acted on.

package/docs/adr/0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md

@@ -0,0 +1,107 @@
+# ADR 0327 — A cloud-host runs on the owner's own account, and the key is borrowed, not stored
+
+- **Status:** accepted
+- **Date:** 2026-09-22
+- **Task:** [task 1004175](https://cloudbongos.com/builders#/task/1004175) (goal 1000106 — working area 1, Project creation)
+- **Deciders:** Lars (Archon) — decisions 1, 3 and 4 are the owner's. Decision 2 is Claude's design answer to the owner's question "is there a simpler way", and decision 5 records a measurement.
+- **Supersedes in part:** [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) §1 (three shapes) · §3 (who pays) · §7 (the capped trial) · [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) §4 (one credential, "never per-customer")
+- **Depends on:** [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) (Render as the platform, and the not-the-landlord posture this completes)
+- **Related:** [ADR 0111](0111-instance-hosting-provisioning-module.md) §2 (the trust boundary, whose enforcement §5 below corrects) · [ADR 0133](0133-github-app-manifest-onboarding-signin.md) (the short-lived-value pattern decision 2 reuses) · [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) (the credential-free liveness pull) · [ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md) (the deploy door, which needs no platform credential)
+
+## Context
+
+[ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) moved a `cloud-host` off our droplet and onto Render so that we would stop being an infrastructure landlord. It left one thing unexamined: **whose Render account.** Its §3 priced a `cloud-host` at ~$14/month and its §7 capped the free tier *because we were paying*; [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) §4 then ruled the platform token is ours, "root-only on the control plane … and never per-customer".
+
+Standing that up exposed what the unexamined assumption costs. A Render API key is issued against a *user* and carries that user's rights in **every workspace they belong to**. The owner's key reached three workspaces, one of them another builder's, holding their live production services. We would have been one bug away from acting on a third party's infrastructure with a credential they never gave us.
+
+The same check found the second thing: **`mercury` was already on Render**, run by its own owner from their own repository. Under ADR 0323 we would have migrated a working project *off* a correct setup and onto our bill.
+
+Both facts point the same way. The remaining landlord relationship was never the servers — it was the **account**.
+
+## Decision
+
+### 1. Each project brings its own platform key
+
+The project's owner supplies their own Render credential. Bongos does not operate a platform account that customer projects are created inside, and does not hold a billing relationship for anyone's compute.
+
+This retires the ~$14/project line from [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) §3 as *our* cost. It is still the owner's cost, and it is still the right number to show them — see the consequences.
+
+It also makes the blast radius of a leaked key exactly one account: its own owner's. That property comes from this decision, not from any cryptography, and it is the strongest security property in the design.
+
+### 2. The key is borrowed for standup and cleared — never stored
+
+The credential is needed **only to create the services**. Nothing afterwards needs it:
+
+| Afterwards | How it works without a credential |
+|---|---|
+| Routine deploys | Render auto-deploys from Git. Render talks to GitHub; we are not in the loop. |
+| The owner's deploy door ([ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md)) | Moves the core pin and pushes. Render deploys on its own. |
+| Liveness and status | The [ADR 0252](0252-the-self-hosted-visibility-report-is-a-pull-and-auto-appear-buys-a-retraction-lever.md) pull against the instance's own public manifest. Already shipped. |
+| Teardown | We disconnect. We do not delete — see decision 3. |
+
+So the key rides the existing queue as a short-lived value: the web tier validates it, encrypts it with `src/bongos/secret-box.js` as it already exists, and the runner consumes it within one drain and **clears the column**. This is the same shape as the GitHub App Manifest handshake ([ADR 0133](0133-github-app-manifest-onboarding-signin.md)) — a value that lives in a row only long enough for the runner to spend it.
+
+**What this deliberately does not build**, because nothing is stored: no asymmetric sealing module, no per-row credential binding, no rotation or revocation flow, and no separate-unix-user precondition. Each was designed and then deleted when the retention question was asked instead of assumed. A design that stores nothing has no storage to protect.
+
+**What it honestly does not buy.** Encrypting the value protects it from a database dump or a nightly backup, which is the realistic threat. It does **not** defend against a compromised web tier, because the owner's key arrives there in plaintext before anything can encrypt it. That defence was never available at any retention length; only browser-side encryption would reach it, and it is not worth its cost here. Say so rather than implying the encryption is a boundary.
+
+**The cost of not storing it:** a failed standup is retried by the owner re-entering their key, not silently by us. For a once-per-project action that is the better default — an unattended retry holding someone else's cloud credential is not a thing this platform should do.
+
+### 3. We never destroy a customer's infrastructure
+
+Teardown disconnects the instance. The owner deletes their own Render services, in their own account, when they choose to stop paying.
+
+This is why decision 2 works, but it is a safety property first: **the platform should not hold the ability to delete infrastructure it does not own.** A force-teardown that reaches into a customer's account is a capability worth not having.
+
+### 4. Two shapes, not three; and the free tier is free
+
+`dedicated-cloud-host` is removed. On the owner's own account a larger plan is a setting they choose, not a hosting shape we model. [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) §1 already called it "a plan size, not a second code path" — this finishes that thought by deleting the shape as well as the code path. The shapes are:
+
+| Shape | Meaning |
+|---|---|
+| `byo-host` | The owner runs the instance. |
+| `cloud-host` | We stand it up, on the owner's own platform account. |
+
+`control-plane` is unchanged and stays unrequestable. `co-tenant` stays retired and remains a valid *stored* value ([ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) §1).
+
+**The free tier is free.** [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md) §7 capped it because an indefinite subsidy at ~$14/project was not viable. We no longer pay for customer compute, so the premise is gone. Whatever caps exist are about the hub and the hall — our own costs — and are not this decision's to set.
+
+### 5. The ADR 0111 §2 boundary is a convention, not an operating-system boundary — recorded, not fixed here
+
+[ADR 0111](0111-instance-hosting-provisioning-module.md) §2 says the internet-facing web tier holds no cloud token, and [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) §4 describes the token file as "root-only on the control plane". Measured on the box, 2026-09-22:
+
+- `cloudbongos.service` runs `User=lars` with **no** sandboxing directives — no `ProtectHome`, no `ProtectSystem`, no `ReadOnlyPaths`.
+- `/etc/cloudbongos/box.env` is mode `600`, owned by **`lars`**, not root.
+- The runner units also run `User=lars`.
+
+So the web tier process **can** read the DigitalOcean, Cloudflare and platform tokens. The separation is real in the *code* — the web tier only enqueues intents — but it is enforced by that code's discipline, not by the kernel. ADR 0325 §4's "root-only" is not what is on the box, and this ADR corrects it.
+
+**Correction, 2026-09-23 (task 1004176).** This section originally carried a second finding — that `~/.config/otb/builder-secret.key` is mode **777** on a box with a second shell account. **That finding is void.** The path is a *symlink* to the real key, and `lrwxrwxrwx` is the only thing a symlink's mode ever displays on Linux; access is governed by the target, which is mode 600 owned by `lars`. The "49 bytes" was the length of the target path, not of a key. It was inferred from an `ls` listing rather than from an attempted read, which is exactly the mistake the verification note below exists to prevent. The retraction itself was then confirmed the way the original claim should have been: as the box's *other* shell account, both `cat` and a write test against that path are refused. The legacy read path in `src/instance-config.js` is real but carries no exposure.
+
+**Resolved 2026-09-23 by [task 1004176](https://cloudbongos.com/builders#/task/1004176)**, and more narrowly than this section proposed. The remedy is not the unix-user split sketched below — that would mean relocating the checkout, the config dir, `web.env` and the secret-box master key, which the web tier *legitimately* needs for per-builder AI keys. It is a systemd drop-in carrying `InaccessiblePaths=/etc/cloudbongos/box.env`, which puts an empty mode-000 node over the file in the web tier's own mount namespace. Verified after applying: refused as the service user inside that namespace, still loaded by the runner units in the host namespace, no errors, site up. The drop-in lives at `scripts/gds/cloudbongos-token-isolation.conf`.
+
+**A verification trap worth carrying forward:** the first check read the file as **root**, which bypasses a mode-000 over-mount via `CAP_DAC_OVERRIDE` and reported "no effect" against a working configuration. Prove an isolation as the process's own user, never as root.
+
+**It was recorded here rather than fixed here.** It is a real pre-existing exposure of *our own* tokens, and it is emphatically **not** a precondition for decisions 1–4 — that is the point of storing nothing. Had we stored per-project keys sealed with a private key in `box.env`, this finding would have made the sealing worthless, and the two would have had to land together.
+
+## Consequences
+
+- **The migration shrinks to an adoption.** `mercury` is already in the target state; its instance record needs pointing at a deployment its owner runs, not a move. <redacted> is a distinction `scripts/gds/provision-repo.js` already draws for repositories, and the platform leg needs it too. [task 1004142](https://cloudbongos.com/builders#/task/1004142) is re-scoped accordingly.
+
+- **The fleet cost ledger's question changes, and it is no longer "what do we owe".** [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) §6 filed [task 1004148](https://cloudbongos.com/builders#/task/1004148) because `costEstimateUsd` returns 0 for a project "the platform is about to be billed for". The platform is not going to be billed for it. A ledger reporting our spend should read ~$0 per `cloud-host` and be *correct*; what an owner is worth telling is **their** estimated Render cost, which is a different column with a different meaning. Reporting one as the other is the defect now.
+
+- **Metering and charging lose their forcing function.** [task 1001949](https://cloudbongos.com/builders#/task/1001949) was sized against recovering ~$14/project/month. There is nothing to recover. Cost *visibility* — showing an owner what their project costs them — survives as a product feature; billing for hosting does not, because we do not host.
+
+- **`dedicated` becomes dead data as well as dead code.** Its stored value must be migrated, not merely orphaned. That migration runs over live rows and belongs with the rest of the shape rename in [task 1004142](https://cloudbongos.com/builders#/task/1004142).
+
+- **Our own token exposure is now the largest unmitigated item in this area.** Decision 5 is filed as its own task. It was not urgent while it protected only tokens we could rotate ourselves; it stays that way, but it should not stay unowned.
+
+## Alternatives considered
+
+- **Store each project's key, sealed with a key pair.** The web tier holds a public half and can only lock; the runner holds the private half and can open. Designed in full, then rejected: it buys permanent automation we found no use for, and it requires the decision-5 unix split first, because a private key in `box.env` is readable by the web tier exactly like everything else there. Three days of work and a live-site infrastructure change, to keep a value we established is needed once.
+
+- **One platform account, ours, with every project inside it** — [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md) §4 as written. Rejected: it keeps us the billing landlord, it makes one leaked credential reach every customer, and the account-wide scope of a real Render key means it would have reached workspaces we were never given.
+
+- **Never take a key at all — generate a Blueprint and have the owner click once in Render.** Genuinely the simplest, and tempting. Rejected because the manual click is the exact friction `cloud-host` exists to remove: an owner clicking through Render's dashboard has bought very little over `byo-host`.
+
+- **Keep the key only in the browser and have it call Render directly.** Rejected: standup is a multi-step runner job with retries and an audit trail, not a page that stays open.