@bongos/core 1.20.15 → 1.20.17

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.15",
-  "core_contract": "1.20.15",
-  "source_commit": "139b563191ef97af7e538f783d3fb256baa6c075",
+  "core_version": "1.20.17",
+  "core_contract": "1.20.17",
+  "source_commit": "4e92fa5764cf7041b99baefbf8d249edbba9159d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T12:16:56.172Z",
+  "built_at": "2026-09-30T13:31:15.089Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 556,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3210,
-  "tree_sha256": "814cbc7e5df7346b441a3ac6faa4217852105b51708505d98b9e090d68bd8b6a",
+  "tree_sha256": "4715c740ddb7d2c5cdfed3960679731b4a2cdef5b901f92945ba362f12f26570",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1547,7 +1547,7 @@
     {
       "path": "docs/adr/0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md",
       "mode": "0000644",
-      "sha256": "828e785306df71d1620e0bb541d0ce3cce9ff65dcd996adc4a817803000cbb7c"
+      "sha256": "15d0455b7a29968c01ea01fb64d9c01fb63d7d2db0ef351df5f0fb9dfa677a94"
     },
     {
       "path": "docs/adr/0216-a-fake-pool-interpreter-must-fail-loudly-not-silently-ignore.md",
@@ -2242,7 +2242,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "c1360ad6a6659819a5a2db72cef07fd3631a3052745ef4fcf20075e9849f7fbd"
+      "sha256": "829ba538e06cca081f0540bf819f280ba36e738a553e5fa3634af5f5af5bc5b0"
     },
     {
       "path": "docs/architecture.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "05833e301ee659bde426bdae2d327183b03a6e40b08230a07ce99ba8ccef9705"
+      "sha256": "c2490d5cdc3d8044ad02ba2ade0a9918e8c3d041e79f0ac0d61f3126152053d1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7057,7 +7057,7 @@
     {
       "path": "modules/platform-identity/read-rate-limit.js",
       "mode": "0000644",
-      "sha256": "dc11b89460e4cca22af1ab61672104ac99298f477c1bad890d688f87456494fa"
+      "sha256": "fb22fef7442c1488499dce4ec8aafce30400166df51f5c7bd88577c83fb8873e"
     },
     {
       "path": "modules/platform-identity/recruiter-sliver.js",
@@ -7112,7 +7112,7 @@
     {
       "path": "modules/platform-identity/routes/scouting.js",
       "mode": "0000644",
-      "sha256": "fbd1f8679be51718131d3d95d6ed7d8dcd1ebe091df6cfc190b69fd62c00013c"
+      "sha256": "3fbaaafe605fd891c449499ca85a716f9b8780bb1869f25b32162593ada8fedd"
     },
     {
       "path": "modules/platform-identity/routes/sso.js",
@@ -8862,12 +8862,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cc8381c4866cb96ae92e56199b4666a515f8c4fb6aa0214fe332a2c960f5c9df"
+      "sha256": "f04a559437cf80ab6eeb46905a8f943091dd4601e02b7d7ae58ca57aae35b050"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5125b2ece4cbf29c1c89b0eec97b4bce224fa0b25c8b3351e0b6253ade41c8e5"
+      "sha256": "b8cd817f9d22b1222c06404648c197080fce17573ce0c83f43b4f03f87fb06b4"
     },
     {
       "path": "public-docs/index.html",
@@ -8887,7 +8887,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "d12e72f6946fb8c0884d7b014d8673e58314ad5ff4d01593d397f5d96d8c8a6e"
+      "sha256": "06f6c8587835146b2f325adf518aca1e74699cb2f38f0313ad4bf7f5fe37577c"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9842,7 +9842,7 @@
     {
       "path": "scripts/gds/provision-config.js",
       "mode": "0000644",
-      "sha256": "eef551d38110a43e295f465a9a61b0ac136ac14e79f40821c2ea0501ee8fa58a"
+      "sha256": "5d8c07ebba17c797d7c8506e199f408a9490418e74089f5441a6141d76400be5"
     },
     {
       "path": "scripts/gds/provision-core-upgrade.js",
@@ -9852,12 +9852,12 @@
     {
       "path": "scripts/gds/provision-disconnect.js",
       "mode": "0000644",
-      "sha256": "eabada0abfcca12b744952a0bea9402ef95946ce5685b1ed08ae0f9b38da24b6"
+      "sha256": "43aabd985e5ec2b2eff12b5d624158c3240e7777887705228945fedf691d95c3"
     },
     {
       "path": "scripts/gds/provision-net.js",
       "mode": "0000644",
-      "sha256": "85c84ac0ceb00133acb0a86c5c48a3887908a7c2e51490ec9de549d7714f4103"
+      "sha256": "cc3bd9146e6f513239f564df67fe3dd0a4b50e7889a759c7528c9a4d34e64ce4"
     },
     {
       "path": "scripts/gds/provision-pin-key.js",
@@ -9887,22 +9887,22 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "7ab829842156f06853991a96d1eb0d0e800013b5e7a50d4d02c42c7733d3a37b"
+      "sha256": "d1fd247608db02805168cd306d27378cf2ac964bf8ac156019eb969cc7b410d4"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
       "mode": "0000644",
-      "sha256": "b2bb567debb248f2488d26e4bb87fff1258d6226a490e054ba601febdad288a6"
+      "sha256": "eca5ebb6a796e336b3e5c542de171923488a3f4edd24e2e5da07d0a53f239c23"
     },
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "876697e79f9a3e3933bbd7623f97655962e2d10c298b6ba5f27d5b75cb885f9d"
+      "sha256": "2fd3cd47bce98f32ec151557908fdde48f91d7a3d7a144f7e3e7f77638eb5165"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "0f9b3bc9e540e9a1ff0c210ce58aef97963c8bdcdd4674b31267e5fd7af3fe43"
+      "sha256": "8f03f6c0e043ba7d80e6c4543cc0d6abc8b2ccb8d4a7e40e814a6a14d6859440"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -11002,7 +11002,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d97c483c3599928877210a4ceea2c9a384cf61dc86d1fec156de8a95dce743e5"
+      "sha256": "ae8085fdd1b2e41ff442de4a863b7b105bebaad915054a0cfa38bb57321289be"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14512,12 +14512,12 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "550f0342dd556bb0f974875edfc570ac8a4734938832a75d00b019d19db0f8ed"
+      "sha256": "ad4c6e5d4dd342e8c2b183c6decd7a38c976b207b30e211042bed0a42f3f5f17"
     },
     {
       "path": "tests/provision_account_identity.mjs",
       "mode": "0000644",
-      "sha256": "9f62eea1b43a478334a83df52d0e81a3b3b67f4c4eea54680d2d8db3b25ee513"
+      "sha256": "63a9052194dbeca658aab24b839f549ba3193b34f564001ad889dd5671166fd9"
     },
     {
       "path": "tests/provision_byo_host.mjs",
@@ -14532,7 +14532,7 @@
     {
       "path": "tests/provision_disconnect.mjs",
       "mode": "0000644",
-      "sha256": "20de6ef694e176459b690aac55351f97a77bf91a3076870ba43972a6b8b6e54c"
+      "sha256": "8c117a05b0c4af8e4f6a465cad02d208210148aaa7e26adfe9098967911f1be5"
     },
     {
       "path": "tests/provision_render.mjs",
@@ -14547,17 +14547,17 @@
     {
       "path": "tests/provision_restart.mjs",
       "mode": "0000644",
-      "sha256": "b9cdf2ef4d1af83c084b77ce44d3c142a935fb25f3a275f052db0cf3ede9b205"
+      "sha256": "caa345e6708d896b42c597a9f83919b4795222e61955c728975d56a873a04fb8"
     },
     {
       "path": "tests/provision_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "08761779d0e8e733dd4db9de9c90cd147037ac30909883ec36e104389bac1edf"
+      "sha256": "b8721014fea6a0cb60335077fff10fe55ab0c745511ab680154cbc291e357f9c"
     },
     {
       "path": "tests/provision_teardown_address.mjs",
       "mode": "0000644",
-      "sha256": "45f771259689319eff14f2c90fb9ebb063b172c290731b195770b02e923a133b"
+      "sha256": "e835c2b0b75640dc96954815c1f13ecd6d8fddcb08ae64fb0b6d98818959eb0a"
     },
     {
       "path": "tests/provisioning_app_status.mjs",
@@ -14842,7 +14842,7 @@
     {
       "path": "tests/recruiter_sliver_boundary.mjs",
       "mode": "0000644",
-      "sha256": "522df6e7930347ff312ef5b2cb98cfde3c53f7465a133618dd970872241bc2b3"
+      "sha256": "34c56222c40ab58be128f380a2881a2d17bd6c483560d878f6de01a00bcef297"
     },
     {
       "path": "tests/redteam_followup_kind.mjs",

package/docs/adr/0215-the-recruiter-sliver-is-a-ceiling-not-a-step.md

@@ -61,7 +61,7 @@ A **previous** handle resolves to nothing here either, deliberately unlike `reso
 
 ### D4 — The sliver holds spec D3's **archon floor**; the directory's wider door is not reused, and the audience goes to the owner
 
-`GET /scouting/:handle` sits in `modules/platform-identity/routes/scouting.js` beside `GET /scouting`, and the two do **not** share a gate. The sliver is `requireBuilder` → `api.requireRank('archon')`; the directory keeps `requireScoutingReader({ curateGate: requirePermission('project.curate') })`. Each gate is spelled in its own route's middleware list, so `route-rank-check.js` and `gen-api-docs.js` classify each from its real floor rather than recording a privileged route as `any-builder`.
+`GET /scouting/:handle` sits in `modules/platform-identity/routes/scouting.js` beside `GET /scouting`, and the two do **not** share a gate. The sliver is `requireBuilder` → `api.requireRank('archon')` (behind its own read budget since [task 1003540](https://cloudbongos.com/builders#/task/1003540) — see the last honest limit); the directory keeps `requireScoutingReader({ curateGate: requirePermission('project.curate') })`. Each gate is spelled in its own route's middleware list, so `route-rank-check.js` and `gen-api-docs.js` classify each from its real floor rather than recording a privileged route as `any-builder`.
 
 Spec D3 says the sliver is "gated at the route by `project.recruit`" — and that atom **does not exist**. ADR 0201 D3 and ADR 0210 both refuse to mint it, on the same grounds: it belongs to the project-admin-console wave ([spike 1002786](https://cloudbongos.com/builders#/task/1002786) R3), which defines it, and minting it in a third place would fork its definition across three waves before any had shipped. **So which door does it use meanwhile?** The first draft reused the directory's, and that was wrong in the dangerous direction. Spec D1 declares the missing atom's shape — **floor archon**, widenable per instance through the governance tab — while the directory admits `project.curate` at the **metic** floor (ADR 0157) **OR any project owner**, who is typically a bare `xenos` on the hub (ADR 0210 D2). That door is *wider* than the signed floor on both halves. Reusing it would have widened an owner-signed privacy decision by implementation convenience, on the first surface that discloses a private account — and narrowing after people have been disclosed is not a recoverable move, while widening later is. So the sliver holds D3's declared floor, by rank, until the atom exists.
 
@@ -102,7 +102,7 @@ Both columns exist (migration `platform_identity_012_account_privacy.sql`); the
 - **A recruiting read added in another FILE would not trip the two-route guard.** D6's count is over `routes/scouting.js` alone, so the "both recruiting surfaces" copy could become false without reddening. Sweeping every route file for reach-joining reads is a structural guard of its own and belongs with the shared-predicate work, not here.
 - **`getRecruiterSliver` (the by-id port spec D3 names) has no production caller yet** — [task 1002972](https://cloudbongos.com/builders#/task/1002972) is its consumer. The route uses the by-handle sibling; the proof exercises both.
 - **`active_recently` is coarse by design and coarse in practice.** It is derived from `max(last_active)` across the rollup, which is refreshed on federated sign-in and on ship — so a builder active only on a project that never reports will read as inactive. That understates rather than overstates, which is the safe direction for a privacy surface.
-- **This route is not rate-limited, and there is an asymmetry worth naming.** `GET /profiles/:handle` carries a per-IP read limiter precisely so the handle→identity mapping cannot be scripted at line rate (task 1002798), and `GET /scouting/:handle` — which is authenticated and permission-gated, so it starts from a much stronger position — has none. The asymmetry that remains is specific: a reader of this surface can probe guessed handles unmetered and learn *which private accounts opted into recruiting*, a set no other surface publishes. It is bounded by needing to guess a private account's handle (nothing publishes it) and by the audience already holding the full rollup of every public builder, so it is a widening of degree, not of kind. It is **not** fixable by reusing `accountExistenceReadRateLimit`: ADR 0209's whole decision is one budget per oracle, and this is a different oracle — sharing it would hand an enumerator the sum of two budgets on the route it cares about. The right fix is a dedicated budget behind a doorway-exported factory, which is a decision about the doorway rather than about the sliver; filed rather than smuggled in here.
+- **~~This route is not rate-limited~~ — closed by [task 1003540](https://cloudbongos.com/builders#/task/1003540); what was open, and why the fix took the shape it did.** `GET /profiles/:handle` carries a per-IP read limiter so the handle→identity mapping cannot be scripted at line rate (task 1002798), and `GET /scouting/:handle` shipped with none: a reader could probe guessed handles and learn *which private accounts opted into recruiting*, a set no other surface publishes — bounded by needing to guess a private handle, so a widening of degree, not of kind. It now spends its **own** per-IP budget, `recruiter-sliver-read`, at the `/public/*` posture (120 reads / 60s), mounted **ahead of** `requireBuilder`: the tag takes the route off core's default read ceiling (`rate-limit.js` #6), so a limiter behind the gate would have left every refused probe unmetered. It is **not** `accountExistenceReadRateLimit` — ADR 0209 is one budget per oracle, and sharing would hand an enumerator the sum of two. This note used to name a **doorway-exported factory** as the fix. That was wrong on ADR 0209's own terms, which rejects a limiter factory on the doorway as *"more general and more wrong"* (two call sites with matching config get two budgets), and it was overtaken: the module has had its own single limiter factory since task 1002978 (`modules/platform-identity/read-rate-limit.js`, mounted by the community and guild reads). The sliver's budget is one instance from that factory, built at module scope so every router the file builds spends from the same bucket — no new copy, and no change to the doorway. `tests/recruiter_sliver_boundary.mjs` §6b pins the budget, its position ahead of the gate, and that it is none of core's shared instances.
 
 **Rejected:**
 

package/docs/api/openapi.json

@@ -16630,7 +16630,7 @@
           "scouting"
         ],
         "summary": "GET /scouting/:handle",
-        "description": "the PRE-ACCEPT SLIVER for ONE builder (privacy spec D3, ADR 0215 D4, task 1002968). This is the FIRST surface on the platform that discloses a PRIVATE account, and its audience is deliberately NOT the directory's. WHY A RANK GATE AND NOT THE RECRUITING DOOR ABOVE. Spec D3 gates this read on `project.recruit`, an atom whose declared shape is FLOOR ARCHON, widenable per instance (spec D1). That atom does not exist — ADR 0201 D3 and ADR 0210 both refuse to mint it outside the project-admin-console wave that defines it (spike 1002786 R3), and this task does not either. The directory's door (`project.curate` at metic, OR any project owner — ADR 0210 D2) is WIDER than the signed floor on both halves, so adopting it here would widen an owner-signed privacy decision by implementation convenience. Until the atom lands, the honest reading of D3 is its floor, held by rank. Whether the wider recruiting audience is authorized for this surface is the owner's call and is filed as a blocker, NOT resolved here; when it is answered, this one line moves and nothing else does. 404, never 403, for a builder who is not recruiter-reachable: a 403 would confirm the handle exists, which is the disclosure the opt-out removes. The sliver's own predicate does the deciding, inside the module.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).",
+        "description": "the PRE-ACCEPT SLIVER for ONE builder (privacy spec D3, ADR 0215 D4, task 1002968). This is the FIRST surface on the platform that discloses a PRIVATE account, and its audience is deliberately NOT the directory's. WHY A RANK GATE AND NOT THE RECRUITING DOOR ABOVE. Spec D3 gates this read on `project.recruit`, an atom whose declared shape is FLOOR ARCHON, widenable per instance (spec D1). That atom does not exist — ADR 0201 D3 and ADR 0210 both refuse to mint it outside the project-admin-console wave that defines it (spike 1002786 R3), and this task does not either. The directory's door (`project.curate` at metic, OR any project owner — ADR 0210 D2) is WIDER than the signed floor on both halves, so adopting it here would widen an owner-signed privacy decision by implementation convenience. Until the atom lands, the honest reading of D3 is its floor, held by rank. Whether the wider recruiting audience is authorized for this surface is the owner's call and is filed as a blocker, NOT resolved here; when it is answered, this one line moves and nothing else does. 404, never 403, for a builder who is not recruiter-reachable: a 403 would confirm the handle exists, which is the disclosure the opt-out removes. The sliver's own predicate does the deciding, inside the module. Rate-limited per IP (120 reads / 60s, 429 scope `recruiter-sliver-read`), and the budget is spent FIRST, ahead of the gate: its tag takes this route off core's default read ceiling, so a limiter behind requireBuilder would leave every refused probe unmetered.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).",
         "x-rank": "archon",
         "x-source": "modules/platform-identity/routes/scouting.js",
         "parameters": [

package/docs/module-api-changelog.md

@@ -2687,5 +2687,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.13 with no explicit bump. run 36712510525. (task 1002620)
   1.20.15 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.14 with no explicit bump. run 36713710510. (task 1002620)
+  1.20.16 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.15 with no explicit bump. run 36717488992. (task 1002620)
+  1.20.17 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.16 with no explicit bump. run 36722139698. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/platform-identity/read-rate-limit.js

@@ -1,12 +1,14 @@
-// modules/platform-identity/read-rate-limit.js — a per-IP read cap for an
-// UNAUTHENTICATED public GET in this module. The global limiter meters writes
+// modules/platform-identity/read-rate-limit.js — a per-IP read cap for a GET
+// in this module that must not be scripted at line rate. The global limiter meters writes
 // only, and core's per-IP sliding window (src/bongos/middleware/rate-limit.js
 // perIpSlidingWindow) reaches modules only as ready-built instances on the
 // doorway (ADR 0209: an instance per budget), none of which is this module's.
 // This is the module-side twin of that function — same 429 envelope and
 // headers — written once (task 1002978) and mounted by the community reads
-// (routes/community-leaderboard.js, routes/community-search.js) and the public
-// guild read (routes/guilds-public.js).
+// (routes/community-leaderboard.js, routes/community-search.js), the public
+// guild read (routes/guilds-public.js) and the recruiter sliver
+// (routes/scouting.js GET /scouting/:handle, task 1003540 — authenticated, but a
+// handle probe there reveals who opted into recruiting).
 // routes/public-profile.js and routes/sso.js still carry older vendored copies.
 'use strict';
 

package/modules/platform-identity/routes/scouting.js

@@ -41,9 +41,26 @@ const pi = require('../platform-identity');
 const scoutingAuthz = require('../scouting-authz');
 const recruiterSliver = require('../recruiter-sliver');
 const scoutingNameOnly = require('../scouting-name-only');
+const { createReadRateLimit } = require('../read-rate-limit');
 
 const { pool, requireBuilder, parsePagination } = api;
 
+// The sliver's per-IP read budget (task 1003540, ADR 0215). Probing guessed
+// handles tells a reader WHICH private accounts opted into recruiting — a set no
+// other surface publishes — so the probe is metered at the /public/* posture.
+// Its OWN budget, never accountExistenceReadRateLimit: ADR 0209 is one budget per
+// oracle, and sharing hands an enumerator the sum of two. Built ONCE at module
+// scope, so every router this file builds spends from the same bucket, by the
+// module's one limiter factory rather than a vendored copy. Not a doorway
+// factory: ADR 0209 rejected that shape because two call sites get two budgets.
+const SLIVER_READ_WINDOW_MS = 60 * 1000;
+const SLIVER_READ_LIMIT = 120;
+const sliverReadRateLimit = createReadRateLimit({
+  scope: 'recruiter-sliver-read',
+  limit: SLIVER_READ_LIMIT,
+  windowMs: SLIVER_READ_WINDOW_MS,
+});
+
 // Resolved at CALL time, never at load. Proofs that exercise this route pin a
 // PARTIAL doorway (tests/profile_route.mjs stubs pool + the two gates and
 // nothing else), and a module-scope api.logger() would make this file
@@ -118,8 +135,14 @@ module.exports = function scoutingRoutes() {
   // 404, never 403, for a builder who is not recruiter-reachable: a 403 would
   // confirm the handle exists, which is the disclosure the opt-out removes. The
   // sliver's own predicate does the deciding, inside the module.
+  //
+  // Rate-limited per IP (120 reads / 60s, 429 scope `recruiter-sliver-read`),
+  // and the budget is spent FIRST, ahead of the gate: its tag takes this route
+  // off core's default read ceiling, so a limiter behind requireBuilder would
+  // leave every refused probe unmetered.
   router.get(
     '/scouting/:handle',
+    sliverReadRateLimit,
     requireBuilder,
     api.requireRank('archon'),
     async (req, res) => {
@@ -139,3 +162,7 @@ module.exports = function scoutingRoutes() {
 
   return router;
 };
+
+// Exported for tests — the sliver's budget instance and its limits (the
+// routes/community-search.js precedent).
+module.exports._internals = { sliverReadRateLimit, SLIVER_READ_LIMIT, SLIVER_READ_WINDOW_MS };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.15",
+  "version": "1.20.17",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.15",
+      "version": "1.20.17",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.15",
+  "version": "1.20.17",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8146,5 +8146,17 @@
       "id": "1004177",
       "text": "Installing the Windows runner now tells you up front that it needs an administrator window, and why, instead of failing with a bare \"access denied\"; the setup guide no longer says the opposite."
     }
+  ],
+  "1.20.16": [
+    {
+      "id": "1004185",
+      "text": "Cleaned out leftover code for a hosting option we retired, with proof that every live project's setup is unchanged — no project sees any difference."
+    }
+  ],
+  "1.20.17": [
+    {
+      "id": "1003540",
+      "text": "Guessing someone's private profile name on the recruiting page is now speed-limited, so it can't be used to discover who is open to recruiting."
+    }
   ]
 }

package/scripts/gds/provision-config.js

@@ -77,12 +77,11 @@ const CONFIG = {
   // systemd (ADR 0306). Unused on a systemd box. No sudo is applied to writes here: the
   // planes that select supervisord run unprivileged and already own this dir.
   supervisorConfDir: process.env.PROVISION_SUPERVISOR_CONF_DIR || '/etc/supervisor/conf.d',
-  // Dedicated-droplet defaults (only used for hosting_shape='dedicated').
-  region: process.env.PROVISION_REGION || 'nyc3',
-  baseImage: process.env.PROVISION_BASE_IMAGE || 'ubuntu-24-04-x64',
-  tag: process.env.PROVISION_TAG || 'cloudbongos-instance',
+  // The DigitalOcean token. No runner leg spends it since the dedicated droplet path went
+  // (task 1004185); the read stays because it is what makes this file a registered
+  // credential reader (modules/government/protected-surfaces.json + the tripwire in
+  // tests/government_protected_surfaces.mjs). Dropping it is a governance change of its own.
   doToken: process.env.DO_API_TOKEN || null,
-  sshKeyIds: (process.env.BOX_SSH_KEY_IDS || '').split(',').map((s) => s.trim()).filter(Boolean),
   // The Cloudflare DNS hook (the instance's infra/box-dns-cloudflare.sh).
   // P4 (#1945) formalizes the UPSERT: point the instance's domain at the target
   // public IP (below), in the domain's OWN Cloudflare zone, proxied=false (see
@@ -90,8 +89,7 @@ const CONFIG = {
   // still reachable by IP; TLS then can't be issued until DNS lands).
   dnsHook: process.env.BOX_DNS_HOOK || null,
   // This box's PUBLIC IP — the A-record target for a CO-TENANT instance's domain.
-  // Set in the control-plane /etc/<inst>/box.env (never the web tier). A dedicated
-  // instance instead points its A record at the freshly-created droplet's IP. Under
+  // Set in the control-plane /etc/<inst>/box.env (never the web tier). Under
   // remote-exec (PROVISION_REMOTE_HOST) this is the CO-HOSTING box's IP — where the
   // co-tenant actually runs (ADR 0130).
   publicIp: process.env.PROVISION_PUBLIC_IP || process.env.BOX_PUBLIC_IP || null,
@@ -159,8 +157,8 @@ const CONFIG = {
   // allows 97 non-superuser backends, so nine busy projects exhaust it whatever the
   // RAM headroom. Idle projects hold zero backends, so this bounds bursts, not the
   // steady state: 3 × 15 slots + the control plane's own 10 stays under the 97. The
-  // control plane keeps pg's default (it is not provisioned by this runner), and a
-  // dedicated droplet has its own server, so neither is written.
+  // control plane keeps pg's default (it is not provisioned by this runner), so it is
+  // not written there.
   instancePoolMax: numEnv('PROVISION_INSTANCE_PGPOOL_MAX', 3),
 };
 
@@ -188,8 +186,6 @@ function loadDeps() {
   const { pool } = require(path.join(REPO_ROOT, 'src/bongos/pool'));
   // eslint-disable-next-line global-require
   const provisioning = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning'));
-  // eslint-disable-next-line global-require
-  const { DoApi } = require(path.join(REPO_ROOT, 'scripts/gds/do-api'));
   // Cross-site identity (ADR 0141 §4, task #1002109). Resolve the hub-side module by a
   // VARIABLE key, gated on isModuleEnabled — the module-loader's own dynamic-dispatch
   // pattern (the run-unit-tests.js precedent), NOT a static 'modules/platform-identity/'
@@ -206,14 +202,14 @@ function loadDeps() {
     try { platformIdentity = require(path.join(piBase, 'platform-identity')); hubKeys = require(path.join(piBase, 'hub-keys')); projectCatalog = require(path.join(piBase, 'project-catalog')); }
     catch { platformIdentity = null; hubKeys = null; projectCatalog = null; }
   }
-  _deps = { pool, provisioning, DoApi, platformIdentity, hubKeys, projectCatalog };
+  _deps = { pool, provisioning, platformIdentity, hubKeys, projectCatalog };
   return _deps;
 }
 
 // ---------------------------------------------------------------------------
 // PURE step-command generators (exported for tests). Each returns the exact shell
-// command a runbook step runs. Kept pure so local exec (co-tenant) and the
-// dedicated droplet's cloud-init both build from ONE source of truth.
+// command a runbook step runs. Kept pure so the runbook and its tests build from ONE
+// source of truth.
 // ---------------------------------------------------------------------------
 
 // A slug is validated DNS/db-safe upstream (provisioning.isValidSlug), so it is

package/scripts/gds/provision-disconnect.js

@@ -62,12 +62,10 @@ async function disconnectInstance(inst, deps) {
   // A teardown returns ok or throws; a throw ends the run here, before anything is erased.
   await teardownInstance(inst, deps);
 
-  if (inst.hosting_shape !== 'dedicated') {
-    const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
-    for (const cmd of eraseCommands(inst, { privileged })) {
-      try { boxExec(cmd); }
-      catch (e) { return { ok: false, error: `erase step failed (${cmd.split(' ').slice(0, 3).join(' ')}): ${(e && e.message) || e}` }; }
-    }
+  const boxExec = inst.hosting_shape === 'cloud-host' ? (deps.controlExec || exec) : exec;
+  for (const cmd of eraseCommands(inst, { privileged })) {
+    try { boxExec(cmd); }
+    catch (e) { return { ok: false, error: `erase step failed (${cmd.split(' ').slice(0, 3).join(' ')}): ${(e && e.message) || e}` }; }
   }
 
   const origin = catalogOriginForInstance(inst);

package/scripts/gds/provision-net.js

@@ -33,8 +33,7 @@ function federationHubOrigin() {
 // platform-identity module is present, a signing key is loadable, AND a hub origin
 // resolves), the instance is a CO-TENANT (the mothership-hosted shape whose web.env is
 // written locally — a `standalone` is owner-hosted and keeps its own GitHub app, the
-// self-hosted path; a `dedicated` droplet has no local web.env write yet, same gap the
-// ADR 0133 manifest flow leaves — see placeManifestCreds), and it has a public domain
+// self-hosted path), and it has a public domain
 // (the origin the hub binds the CLI mint audience to — the #1002108 account-takeover
 // fix). Returns { federate, reason } so the caller can log WHY it skipped. PURE-ish
 // (reads env + the injected module handles; no DB, no I/O).
@@ -110,7 +109,7 @@ function zoneForDomain(domain) {
 // The env a DNS UPSERT invocation of infra/box-dns-cloudflare.sh needs for a
 // PROVISIONED host: the hostname, the target public IP (the A-record content), the
 // zone the record lives in, and whether Cloudflare proxies it.
-//   • proxied=false (default) is LOAD-BEARING for a CO-TENANT/dedicated host: it uses
+//   • proxied=false (default) is LOAD-BEARING for a CO-TENANT host: it uses
 //     Caddy on-demand ACME (Let's Encrypt), whose challenge must reach Caddy directly —
 //     Cloudflare proxy ON would intercept :80/:443 at the edge and the challenge would
 //     silently fail (ADR 0003 / docs/recipes/ops-gotchas.md). Do NOT proxy those.
@@ -297,11 +296,9 @@ function ingressPlaneGap(exec, { caddyfile = CONFIG.caddyfile } = {}) {
 }
 // The preflight around ingressPlaneGap: the narration its sibling preflights already carry,
 // including the dry-run line without which the plan prints step 6's Caddy write as though it
-// will work. Returns the refusal, or null to proceed. `dedicated` skips it (Caddy comes from
-// cloud-init). Lives here rather than inline at the two call sites to keep provision.js under
-// its 1,500-line ratchet.
-function ingressPreflight({ exec, apply, log, shape, probe = ingressPlaneGap, before = 'writing any Caddy config' }) {
-  if (shape === 'dedicated') return null;
+// will work. Returns the refusal, or null to proceed. Lives here rather than inline at the two
+// call sites to keep provision.js under its 1,500-line ratchet.
+function ingressPreflight({ exec, apply, log, probe = ingressPlaneGap, before = 'writing any Caddy config' }) {
   if (!apply) { log(`  [preflight] would probe the plane for a reverse proxy before ${before}`); return null; }
   const missing = probe(exec);
   if (missing) return `Ingress preflight failed: ${missing}`;

package/scripts/gds/provision-repo.js

@@ -62,9 +62,8 @@ function migrateCmd(inst, { privileged = false } = {}) {
 // The id/name/done_when come from instanceInitSpec so the starter version has ONE
 // source of truth (the same spec the greenfield `bongos init` seed uses). SQL string
 // literals are DOLLAR-QUOTED ($v$…$v$) so the whole -c argument is single-quoted —
-// the one form that is safe UNCHANGED across all three executors: inline (/bin/sh),
-// over SSH (bash -s), AND embedded in a dedicated droplet's cloud-init (bash -lc "…"),
-// with no nested-quote or $-expansion hazard.
+// the one form that is safe UNCHANGED across both executors: inline (/bin/sh) and
+// over SSH (bash -s), with no nested-quote or $-expansion hazard.
 function seedFirstVersionCmd(inst, { privileged = false } = {}) {
   const v = instanceInitSpec(inst).version;
   const q = (s) => `$v$${s}$v$`;                 // dollar-quoted literal (no value contains a single quote or $)
@@ -299,10 +298,8 @@ function accountPlaneGap(exec, { privileged = false } = {}) {
 
 // The preflight around accountPlaneGap: the narration its sibling preflights carry,
 // including the dry-run line without which the plan prints step 1c's useradd as though it
-// will work. Returns the refusal, or null to proceed. `dedicated` skips it — that account
-// is created by cloud-init, which runs as root. Lives here beside the account it guards.
-function accountPreflight({ exec, apply, log, shape, privileged = false, probe = accountPlaneGap }) {
-  if (shape === 'dedicated') return null;
+// will work. Returns the refusal, or null to proceed. Lives here beside the account it guards.
+function accountPreflight({ exec, apply, log, privileged = false, probe = accountPlaneGap }) {
   if (!apply) { log('  [preflight] would probe whether the runner can create this instance\'s own unix account'); return null; }
   const missing = probe(exec, { privileged });
   if (missing) return `Account preflight failed: ${missing}`;
@@ -327,38 +324,20 @@ function accountPreflight({ exec, apply, log, shape, privileged = false, probe =
 //
 // QUOTING, which is load-bearing in a way that is easy to undo by accident. Every literal
 // is DOLLAR-QUOTED and every identifier goes through format(%I), so the rendered command
-// contains no single quote and NO DOUBLE QUOTE. It has to survive three executors
-// unchanged — inline /bin/sh, `bash -s` over SSH, and, the strict one, `- [ bash, -lc,
-// "..." ]` inside the dedicated droplet's cloud-init, which is a YAML DOUBLE-QUOTED
-// scalar. A plain "role" identifier reads fine in psql and silently truncates the YAML.
-// seedFirstVersionCmd dollar-quotes for the same reason; a test asserts the absence.
-// `peerOnly` is the DEDICATED shape's mode, and it exists because of where that
-// command TRAVELS (task 1003369). A dedicated droplet's steps ride DigitalOcean
-// cloud-init user-data, which DO RETAINS and serves back through its API, its console
-// and the droplet's own metadata endpoint — so a password embedded there is a second,
-// permanent copy of the credential in a place this task cannot lock down, which is
-// strictly worse than what it protects against. A dedicated droplet is SINGLE-TENANT:
-// there are no siblings on it, so the co-tenancy vector B3 describes does not exist,
-// and the role can peer-auth to its own unix account. The role, its DB ownership and
-// the PUBLIC revoke are still created — only the password is omitted, deliberately.
-function dbRoleCmd(inst, { password = null, peerOnly = false, privileged = false } = {}) {
+// contains no single quote and NO DOUBLE QUOTE, so it survives both executors unchanged —
+// inline /bin/sh and `bash -s` over SSH. seedFirstVersionCmd dollar-quotes for the same
+// reason; a test asserts the absence.
+function dbRoleCmd(inst, { password = null, privileged = false } = {}) {
   const role = instanceDbRole(inst), db = dbName(inst);
-  if (peerOnly) {
-    if (password) throw new Error('dbRoleCmd: peerOnly takes no password — it exists to keep one out of cloud-init user-data');
-  } else if (!/^[A-Za-z0-9_-]+$/.test(String(password || ''))) {
+  if (!/^[A-Za-z0-9_-]+$/.test(String(password || ''))) {
     throw new Error('dbRoleCmd: password must be a non-empty base64url string (generateDbPassword)');
   }
-  // Two shapes of the same upsert. peerOnly omits the PASSWORD clause entirely rather
-  // than passing an empty one — `WITH LOGIN` leaves any existing password untouched.
-  const login = peerOnly
-    ? { clause: 'WITH LOGIN', args: '' }
-    : { clause: 'WITH LOGIN PASSWORD %L', args: `, $p$${password}$p$` };
   const sql =
     `DO $do$ BEGIN ` +
     `IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = $r$${role}$r$) THEN ` +
-    `EXECUTE format($f$ALTER ROLE %I ${login.clause}$f$, $r$${role}$r$${login.args}); ` +
+    `EXECUTE format($f$ALTER ROLE %I WITH LOGIN PASSWORD %L$f$, $r$${role}$r$, $p$${password}$p$); ` +
     `ELSE ` +
-    `EXECUTE format($f$CREATE ROLE %I ${login.clause}$f$, $r$${role}$r$${login.args}); ` +
+    `EXECUTE format($f$CREATE ROLE %I WITH LOGIN PASSWORD %L$f$, $r$${role}$r$, $p$${password}$p$); ` +
     `END IF; ` +
     `EXECUTE format($f$ALTER DATABASE %I OWNER TO %I$f$, $d$${db}$d$, $r$${role}$r$); ` +
     `EXECUTE format($f$REVOKE CONNECT ON DATABASE %I FROM PUBLIC$f$, $d$${db}$d$); ` +
@@ -1158,7 +1137,7 @@ async function refreshStandaloneCorePin(inst, deps) {
 // bound to the instance's port + DB + brand, secrets from its own env file. SHAPE-AWARE:
 // a STANDALONE instance runs the CORE PACKAGE's platform-server from its OWN repo dir
 // (WorkingDirectory=standaloneRoot → resolveInstanceRoot() resolves to the instance via
-// cwd, deploy-instance.sh §4); co-tenant/dedicated run this control-plane checkout's src/.
+// cwd, deploy-instance.sh §4); co-tenant runs this control-plane checkout's src/.
 
 module.exports = {
   appGroupExpr,

package/scripts/gds/provision-teardown.js

@@ -24,24 +24,20 @@ async function teardownInstance(inst, deps) {
   // Tear down on the box the instance actually RAN on: a standalone ran control-plane-
   // local (task 2074), so disable/remove its unit HERE — not on the remote co-hosting
   // box, where it was never installed (that would allowFail-noop and leave the real
-  // control-plane unit running). Co-tenant + dedicated are unchanged.
+  // control-plane unit running). Co-tenant is unchanged.
   const boxExec = inst.hosting_shape === 'cloud-host' ? controlExec : exec;
   const sudoP = privileged ? 'sudo ' : '';   // systemctl / rm-under-/etc escalation (task 2066)
   log(`teardown ${inst.slug} (status=${inst.status})`);
   if (apply) await provisioning.setInstanceStatus(db, inst.id, 'tearing_down');
-  if (inst.hosting_shape !== 'dedicated') {
-    // Stop + remove the service AND the nightly backup units (task 2213; the dir + dumps stay — precious data, like the DB below). Whoever supervises the instance owns its removal (ADR 0306) — the systemd manager keeps the reset-failed step task 1003940 added, since a removed unit's FAILED state outlives its file and `systemctl --failed` listed torn-down ghosts for weeks.
-    (deps.processManager || resolveProcessManager()).removeService(inst, { exec: boxExec, sudoP });
-    // The site snippet standup step 6 wrote: while it stays, Caddy proxies the hostname to
-    // a port nothing listens on and every visitor gets a 502 (task 1002897). Not precious.
-    boxExec(`${sudoP}rm -f ${caddySnippetPath(inst)}`, { allowFail: true });
-    boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
-    // Left for an operator (data is precious), naming ONLY what this row created —
-    // teardown now takes 'requested'/'error'. `port` + `domain` stay held: ADR 0181.
-    if (inst.db_name) log(`  (left for the operator: dropdb ${dbName(inst)}, prune ${CONFIG.backupDir}/${dbName(inst)}-*.sql.gz)`);
-  } else if (apply && inst.droplet_id && deps.doApi) {
-    await deps.doApi.deleteDroplet(inst.droplet_id);
-  }
+  // Stop + remove the service AND the nightly backup units (task 2213; the dir + dumps stay — precious data, like the DB below). Whoever supervises the instance owns its removal (ADR 0306) — the systemd manager keeps the reset-failed step task 1003940 added, since a removed unit's FAILED state outlives its file and `systemctl --failed` listed torn-down ghosts for weeks.
+  (deps.processManager || resolveProcessManager()).removeService(inst, { exec: boxExec, sudoP });
+  // The site snippet standup step 6 wrote: while it stays, Caddy proxies the hostname to
+  // a port nothing listens on and every visitor gets a 502 (task 1002897). Not precious.
+  boxExec(`${sudoP}rm -f ${caddySnippetPath(inst)}`, { allowFail: true });
+  boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
+  // Left for an operator (data is precious), naming ONLY what this row created —
+  // teardown now takes 'requested'/'error'. `port` + `domain` stay held: ADR 0181.
+  if (inst.db_name) log(`  (left for the operator: dropdb ${dbName(inst)}, prune ${CONFIG.backupDir}/${dbName(inst)}-*.sql.gz)`);
   parkAddress(inst, { controlExec, log, apply });
   // The app's Render services are the OWNER's: forget them, never delete them (ADR 0327 §3, task 1004183).
   await require('./provision-render.js').forgetRenderApp(inst, { db, log, apply });