@bongos/core 1.20.28 → 1.20.30

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.28",
-  "core_contract": "1.20.28",
-  "source_commit": "64dc694277165d8cd1227e09df2fda3dd99dd396",
+  "core_version": "1.20.30",
+  "core_contract": "1.20.30",
+  "source_commit": "b56a05d974ae5208394507078971bf8e22f415f3",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T20:23:58.237Z",
+  "built_at": "2026-09-30T21:06:55.806Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 562,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2659,
+    "functional_verbatim": 2663,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3247,
-  "tree_sha256": "06c076a09a9c706567f32a447e0d1600e2e07a868b9bdd4be62088a290714985",
+  "file_count": 3251,
+  "tree_sha256": "3b45f4c67302ad870157396c60f693712b46bcdc86a9236e964c914418657c35",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -327,12 +327,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "8dde50025e6ac0a8e9742455d62495b72c1803b87044455c48b13b95209f59a2"
+      "sha256": "08c6eaeee75d4fa5a447578107738e5357ffe088bde7f64e946a5f82d1c06106"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "77f3e9375343c45fd538d179928628a7422858ddea7540cc60cfbdfba95a8545"
+      "sha256": "808fd2048e5260dd4cc518d0e4697636b99ec393c925caa1d858976da2590baf"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -342,17 +342,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "2eea3743862e9ec173c63517b6f79073b25e71aa3cb2d0a2a19ecce95ef78ca0"
+      "sha256": "d6484208dc9acee624ed01503c36ad9fa4f06bd1e7b51738e2c58c1fe251ace8"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "065abbfa7d625aa5811ae9e6c27101ca5b9c824422a6a74bba22d92e3f5d53ae"
+      "sha256": "6298f90c0b7849ca342dd5e5235df57686e36b666cedba8db2d9018e8acb60c1"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "e2714285309adfdb0644e82319363fdcc6fc19ad9f5a2cf0e71e203da8c5e188"
+      "sha256": "eded947e375da51b79857e9d3452f21fbfca2136e774b2a3907d1a4d51436aa9"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2262,12 +2262,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "db03fd5370b7b592769a806607b9cd0880a56b53c64d8909ca24364feeff818e"
+      "sha256": "60243a4cf43ee8c37a06dda28bac07a9797c96eaef126cbcbda4d89c9ec9b986"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "27b8f6be81f9703a96a68f917dbb01a65048cc02f13adf308b414e96fb022668"
+      "sha256": "847818c90b206c7223114b868e32b1eb50e0cc9955ae4dd6b67c5614d1ab51d8"
     },
     {
       "path": "docs/architecture.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8de783d8efc2109b60de3758da0dfd4fecaf4d4a65dc364dacd1c17e8dac4a7d"
+      "sha256": "fca494d7f518bc42742fde6c5ba2e45cfbf0605d5a7a79024bba190ec4c3c1da"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7282,7 +7282,7 @@
     {
       "path": "modules/provisioning/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "ff2f256a550c5d83a83deb47448590fc9a8f4cfd30c52fd4e90a441223b2aaa7"
+      "sha256": "7604ea4c137c5c1cedca41329cfd6fce49458d454f2e956944f7fb8d0c4ab10a"
     },
     {
       "path": "modules/provisioning/cost-ledger.js",
@@ -7454,6 +7454,16 @@
       "mode": "0000644",
       "sha256": "9726682ff47916ca8ef999fe70ed5995c3bad7680b0821b87e4cab8a74d9f867"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_029_update_channel.sql",
+      "mode": "0000644",
+      "sha256": "b667ec5165e611bd6f0d86b09465c5d9e632de853becce139bac49f5a88e5c1e"
+    },
+    {
+      "path": "modules/provisioning/migrations/provisioning_030_intent_failure_class.sql",
+      "mode": "0000644",
+      "sha256": "7287181b4b42d3e391cd97e19ffa5fbc76026e81ad6f54648eb12a69dfea55a1"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -7547,7 +7557,7 @@
     {
       "path": "modules/provisioning/routes/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "5e74192eb8c4543da8af94a362d7516b54adb8fcbe114953923905d382e5f616"
+      "sha256": "980f25a157dfde5bda6ed903c727fab944b922abdc34be05dc0ccdb5fb3650cc"
     },
     {
       "path": "modules/provisioning/routes/disconnect.js",
@@ -8972,12 +8982,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cf64ad1f380ccd8f68a30f1f5b72aa8c03681fc37f044093ae435b7886529cc8"
+      "sha256": "872b4c6ad6eacb09cbcd5698c892fc798ce6e632b505304b5665c7f04ea99325"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d79bd6231aed473960ba8f6c644b69f2c930850a0937a504635e657aa733ea89"
+      "sha256": "6c29a554265b6c3e6fa7f29fbf9b334c3a73e30b240b393498b89304876b5495"
     },
     {
       "path": "public-docs/index.html",
@@ -8997,7 +9007,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "2ec3010abecc3e0ed0d2a9bda13ccad173d34e91d80a13bc4ff4aecace0944e8"
+      "sha256": "1ce998432070110f9c3a9b128145bf8d44c032aa2ff55437207ecaf5efe8943a"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9957,7 +9967,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "53b301ac91be7028d6b1f633eb0e8cdb105d34b0e6b8c6a2cc667f1ba77e8a85"
+      "sha256": "58599968201f98723a531c19f77985c0b26b9afa6d6448ae4803074497a6f2ad"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -10012,7 +10022,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "8f03f6c0e043ba7d80e6c4543cc0d6abc8b2ccb8d4a7e40e814a6a14d6859440"
+      "sha256": "0f7a9cd81a78ef3ed30a40e9f048f8905b6a88e99a930f7cbdcdcd5c1661f71d"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -10624,10 +10634,15 @@
       "mode": "0000644",
       "sha256": "1f0a8d52622328e29bd3bdbe0402f680f425480e37e29ee42ceee907368710af"
     },
+    {
+      "path": "scripts/gds/upgrade-outcome.js",
+      "mode": "0000644",
+      "sha256": "a4f05b5e1042cf3d8c7096ef413b47fd039a02b78f2e4dbefb5bd002973784cb"
+    },
     {
       "path": "scripts/gds/upgrade.js",
       "mode": "0000644",
-      "sha256": "cde9fb1f13e660981e6b6431edd399b4fbcd457cf2ff3ca6a01e92937fdbc746"
+      "sha256": "399c2225543fc0d37505bca9cd96e33cf5598aa1f364a458d5b5efb3a588ddb3"
     },
     {
       "path": "scripts/gds/validate-design.js",
@@ -11117,7 +11132,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "40910d211c287582e7066d72f651ff79862d9f5776be6086cd2c931e648136fd"
+      "sha256": "4002317dabfa7084c1b541e2a6a605197ce8c1e45df90f81bfa2ef186b0d6776"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12062,7 +12077,7 @@
     {
       "path": "tests/core_upgrade_door.mjs",
       "mode": "0000644",
-      "sha256": "52b55a04a99870a1501f2a422096337e3426a7624ec6e1728f291e426eb9567b"
+      "sha256": "24f41ed750fc24003e31cd1e551256162119016ab299a94dda5e4c4fe030ff69"
     },
     {
       "path": "tests/core_upgrade_owner_door.mjs",
@@ -12072,7 +12087,7 @@
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "c8b2ecca1681427e2e800f78961ba322443e4a2e5502d5d81fd5c2f20aeda711"
+      "sha256": "525e38bbafc2dd1419f3e41131dd89c6adc4f063f8585b193e2be72801bede5a"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -14687,7 +14702,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "ad4c6e5d4dd342e8c2b183c6decd7a38c976b207b30e211042bed0a42f3f5f17"
+      "sha256": "6b4405a5a4e0263f321a49e04d25cad87a042d5d9a296ba65ff3d14a1941deb0"
     },
     {
       "path": "tests/provision_account_identity.mjs",
@@ -16089,6 +16104,11 @@
       "mode": "0000644",
       "sha256": "d3f5b941b89ede78ebb3cd7af43467363e5d6c6d35c7ad26a2977683ecf869e7"
     },
+    {
+      "path": "tests/upgrade_outcome.mjs",
+      "mode": "0000644",
+      "sha256": "cec960e84573efe77003beb324c0679900f321249148418e7a04daf7a7a40215"
+    },
     {
       "path": "tests/upgrade_persist_pin.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 465 operations across 70 resource groups
+- 466 operations across 70 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -843,6 +843,8 @@ function createClient(opts = {}) {
       patchProvisioningInstancesIdSettings: (args) => request("PATCH", "/provisioning/instances/{id}/settings", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/teardown — rank: any-builder — POST /provisioning/instances/:id/teardown
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
+      // POST /provisioning/instances/{id}/update-channel — rank: archon — POST /provisioning/instances/:id/update-channel
+      postProvisioningInstancesIdUpdateChannel: (args) => request("POST", "/provisioning/instances/{id}/update-channel", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations

package/clients/bongos-client/index.cjs

@@ -842,6 +842,8 @@ function createClient(opts = {}) {
       patchProvisioningInstancesIdSettings: (args) => request("PATCH", "/provisioning/instances/{id}/settings", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/teardown — rank: any-builder — POST /provisioning/instances/:id/teardown
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
+      // POST /provisioning/instances/{id}/update-channel — rank: archon — POST /provisioning/instances/:id/update-channel
+      postProvisioningInstancesIdUpdateChannel: (args) => request("POST", "/provisioning/instances/{id}/update-channel", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations

package/clients/bongos-client/index.d.ts

@@ -1274,6 +1274,8 @@ export interface BongosClient {
     patchProvisioningInstancesIdSettings(args?: RequestArgs): Promise<PatchProvisioningInstancesIdSettingsResponse>;
     /** POST /provisioning/instances/{id}/teardown — rank: any-builder */
     postProvisioningInstancesIdTeardown(args?: RequestArgs): Promise<PostProvisioningInstancesIdTeardownResponse>;
+    /** POST /provisioning/instances/{id}/update-channel — rank: archon */
+    postProvisioningInstancesIdUpdateChannel(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /provisioning/onboard-plan — rank: public */
     getProvisioningOnboardPlan(args?: RequestArgs): Promise<GetProvisioningOnboardPlanResponse>;
     /** GET /provisioning/recommendations — rank: public */

package/clients/bongos-client/index.mjs

@@ -839,6 +839,8 @@ export function createClient(opts = {}) {
       patchProvisioningInstancesIdSettings: (args) => request("PATCH", "/provisioning/instances/{id}/settings", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/teardown — rank: any-builder — POST /provisioning/instances/:id/teardown
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
+      // POST /provisioning/instances/{id}/update-channel — rank: archon — POST /provisioning/instances/:id/update-channel
+      postProvisioningInstancesIdUpdateChannel: (args) => request("POST", "/provisioning/instances/{id}/update-channel", { hasBody: true }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations

package/docs/api/openapi.json

@@ -15676,6 +15676,54 @@
         ]
       }
     },
+    "/provisioning/instances/{id}/update-channel": {
+      "post": {
+        "operationId": "post_provisioning_instances_id_update_channel",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "POST /provisioning/instances/:id/update-channel",
+        "description": "POST /provisioning/instances/:id/update-channel — set the project's update rule (task 1004445). Body: { channel: \"pinned\" | \"patch\" | \"minor\" }. rank: `core.pin.move`, OR THE PROJECT'S OWN OWNER — the same two doors as the move, because the rule decides which moves the runner will perform: whoever may press Move may choose how far it reaches, and nobody else may. The platform's own row stays on the atom alone (OWNER_SHAPES excludes it), exactly as for the move.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/provisioning/routes/core-upgrade.js",
+        "x-permissions": [
+          "core.pin.move"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/provisioning/onboard-plan": {
       "get": {
         "operationId": "get_provisioning_onboard_plan",
@@ -29763,7 +29811,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 465,
+  "x-endpoint-count": 466,
   "x-schema-count": 498,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 337,

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 465 endpoints across 83 route files.
+> **Generated from the live route files** — the route file is authoritative. 466 endpoints across 83 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -562,7 +562,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/projects/featured` | `public` | — | the public map of projects; no auth by design. |
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | own-or-metic in effect: where to invite a builder into a project, asked by a `project.curate` holder OR the project's OWN OWNER (task 100… |
 
-## `provisioning` (34)
+## `provisioning` (35)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -594,6 +594,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/provisioning/instances/:id/settings` | `any-builder` | — | GET /provisioning/instances/:id/settings — read a project's effective settings + the allowed values (so a form can render its choices). |
 | PATCH | `/api/bongos/provisioning/instances/:id/settings` | `any-builder` | validated | PATCH /provisioning/instances/:id/settings — change a project's settings. |
 | POST | `/api/bongos/provisioning/instances/:id/teardown` | `any-builder` | — | POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. |
+| POST | `/api/bongos/provisioning/instances/:id/update-channel` | `archon` | — | POST /provisioning/instances/:id/update-channel — set the project's update rule (task 1004445). |
 | GET | `/api/bongos/provisioning/onboard-plan` | `public` | — | GET /provisioning/onboard-plan?mode=greenfield\|adopt&domain=<host> — the CANONICAL onboarding step sequence (task 2085; goal 35 / criteri… |
 | GET | `/api/bongos/provisioning/recommendations` | `public` | — | GET /provisioning/recommendations?type=<project type>&team_shape=<interview answer> — the RULE-BASED recommendation for one set of creati… |
 | POST | `/api/bongos/provisioning/render/lookup` | `any-builder` | `key`, `owner_id` | POST /provisioning/render/lookup — rank: any authenticated builder. |

package/docs/module-api-changelog.md

@@ -2713,5 +2713,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.26 with no explicit bump. run 36768642814. (task 1002620)
   1.20.28 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.27 with no explicit bump. run 36772266063. (task 1002620)
+  1.20.29 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.28 with no explicit bump. run 36775277990. (task 1002620)
+  1.20.30 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.29 with no explicit bump. run 36777226204. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/core-upgrade.js

@@ -318,6 +318,9 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
     slug: inst.slug,
     hosting_shape: inst.hosting_shape,
     served_version: served,
+    // The rule the runner bounds this project's moves by (task 1004445) — what the page
+    // shows beside the offer, so "nothing to deploy" can say WHICH rule made it so.
+    update_channel: updateChannelOf(inst),
     recommended_version: recommended,
     available_count: available.length,
     behind: !!behind,
@@ -358,6 +361,11 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
       // `git status` (the dirty-tree one lists every file). Never set on a DONE move:
       // a done row's last_error is the note below, and a move that worked is not an error.
       error: lastMove.state !== 'done' && lastMove.last_error ? String(lastMove.last_error).slice(0, 600) : null,
+      // WHAT KIND of failure it was (task 1004446, migration provisioning_030): the class the
+      // page and the self-heal steps key on, and its fixed reason code. null on a move that
+      // worked, and on one resolved before the columns existed.
+      failure: lastMove.state !== 'done' && lastMove.failure_class
+        ? { class: lastMove.failure_class, reason: lastMove.failure_reason || null } : null,
       // It LANDED, but GitHub did not get the new pin (task 1004065) — parseRepoNote.
       warning: lastMove.state === 'done' ? parseRepoNote(lastMove.last_error) : null,
     } : null,
@@ -429,5 +437,71 @@ function makeControlPlaneHandler({ provisioning, pool, log }) {
   };
 }
 
-module.exports = { CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+// ---- the project's update rule (task 1004445) -------------------------------------
+//
+// RE-STATED, NOT REQUIRED. The list is update-channel.js VALID_CHANNELS / DEFAULT_CHANNEL,
+// which lives in scripts/gds/ and a module may not require (ADR 0083) — the same reason
+// parseRepoNote re-states the runner's note shape. tests/core_upgrade_door.mjs asserts the
+// two lists are equal, so they cannot drift apart silently; migration provisioning_029's
+// CHECK is the third copy, and the database refuses anything outside it.
+const UPDATE_CHANNELS = Object.freeze(['pinned', 'patch', 'minor']);
+const DEFAULT_UPDATE_CHANNEL = 'patch';
+
+/** The row's update rule, or the default for a row read before the column existed. PURE. */
+function updateChannelOf(inst) {
+  const c = inst && typeof inst.update_channel === 'string' ? inst.update_channel : '';
+  return UPDATE_CHANNELS.includes(c) ? c : DEFAULT_UPDATE_CHANNEL;
+}
+
+/**
+ * POST /provisioning/instances/:id/update-channel — set how far this project's core
+ * may move (task 1004445). Body: { channel: 'pinned' | 'patch' | 'minor' }.
+ *
+ * WHY IT EXISTS. The runner's channel refusal told the owner to "change the channel
+ * first", and until this route there was no channel to change: every project was held to
+ * patch-only, so a step-up release (1.19 → 1.20) could never land through the door.
+ *
+ * It changes a RULE, never the core: nothing is queued and nothing restarts. The next
+ * runner tick re-resolves what is on offer under the new rule, which is why the reply
+ * says the offer updates on the next check rather than claiming it already has.
+ */
+function makeUpdateChannelHandler({ provisioning, pool, parseId, validateOrRespond, log }) {
+  return async function updateChannelHandler(req, res) {
+    const id = parseId(req, res);
+    if (!id) return;
+    if (validateOrRespond(req, res, { channel: { type: 'string', maxLength: 16 } }, { strict: true })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!inst) return res.fail('instance_not_found', 404);
+      const channel = req.body && typeof req.body.channel === 'string' ? req.body.channel.trim().toLowerCase() : '';
+      if (!UPDATE_CHANNELS.includes(channel)) {
+        return res.fail('bad_update_channel', {
+          status: 400,
+          message: `Choose one of: ${UPDATE_CHANNELS.join(', ')} — pinned moves nothing, patch takes fixes within the same release line, minor also takes the next step up.`,
+          details: { valid: UPDATE_CHANNELS },
+        });
+      }
+      const was = updateChannelOf(inst);
+      if (was !== channel) {
+        await pool.query('UPDATE provisioning_instances SET update_channel = $2, updated_at = now() WHERE id = $1', [id, channel]);
+        const actor = require('./core-upgrade-authz').coreUpgradeActor(req);
+        await provisioning.recordEvent(pool, {
+          instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'update-channel-changed',
+          detail: `update rule changed from ${was} to ${channel}`, actor,
+        }).catch(() => {});
+      }
+      return res.json({
+        ok: true, update_channel: channel, previous: was, changed: was !== channel,
+        message: was === channel
+          ? `This project already follows the '${channel}' rule — nothing changed.`
+          : `This project now follows the '${channel}' rule. What it can move to updates on the next check, within a few minutes.`,
+      });
+    } catch (err) {
+      log.error('[provisioning] POST /provisioning/instances/:id/update-channel', err);
+      return failFrom(res, err, 'update_channel_failed');
+    }
+  };
+}
+
+module.exports = { UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, makeUpdateChannelHandler, CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
 

package/modules/provisioning/migrations/provisioning_029_update_channel.sql

@@ -0,0 +1,24 @@
+-- provisioning_029_update_channel.sql — each project's own core update rule (task 1004445).
+--
+-- WHY. The deploy runner bounded every project by the platform default (update-channel.js
+-- DEFAULT_CHANNEL, patch-only), because nothing per-project existed to read. So a step-up
+-- release (1.19.x -> 1.20.0) could never reach ANY project through the deploy door: the
+-- runner refused it with "outside this project's 'patch' update channel ... Change the
+-- channel first", and there was no channel anywhere to change. This column is that channel.
+--
+-- Values are update-channel.js VALID_CHANNELS: pinned (the door moves nothing), patch
+-- (same major.minor — the old behaviour, hence the default), minor (any higher minor within
+-- the major). A major bump is never admitted by any channel. The CHECK mirrors the list so a
+-- hand-written UPDATE cannot store a value the runner would silently normalise away.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS update_channel text NOT NULL DEFAULT 'patch';
+
+ALTER TABLE provisioning_instances DROP CONSTRAINT IF EXISTS provisioning_instances_update_channel_check;
+ALTER TABLE provisioning_instances ADD CONSTRAINT provisioning_instances_update_channel_check
+  CHECK (update_channel IN ('pinned', 'patch', 'minor'));
+
+COMMIT;

package/modules/provisioning/migrations/provisioning_030_intent_failure_class.sql

@@ -0,0 +1,28 @@
+-- provisioning_030_intent_failure_class.sql — WHAT KIND of failure stopped an intent
+-- (task 1004446, goal 1000090 deploy self-heal).
+--
+-- WHY. A failed core move was one sentence in last_error, and every non-zero exit read
+-- "failed and was rolled back" — a refusal that changed nothing, a real rollback, and a
+-- rollback that itself failed were indistinguishable to the runner and to the page. These
+-- two columns carry scripts/gds/upgrade-outcome.js's classification beside the sentence:
+--
+--   failure_class   transient | known_wedge | needs_decision | unknown — what the runner
+--                   may do about it (retry later, fix it itself, ask the owner, ask a person)
+--   failure_reason  a fixed reason code (dirty_tree, outside_channel, rollback_failed, …) —
+--                   vocabulary only, never free text, so it is safe to index and to show
+--
+-- NULL on both means "not a classified failure": a done intent, a pending one, or a row
+-- written before this migration. Written by the drain loop (scripts/gds/provision.js).
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_intents ADD COLUMN IF NOT EXISTS failure_class text;
+ALTER TABLE provisioning_intents ADD COLUMN IF NOT EXISTS failure_reason text;
+
+ALTER TABLE provisioning_intents DROP CONSTRAINT IF EXISTS provisioning_intents_failure_class_check;
+ALTER TABLE provisioning_intents ADD CONSTRAINT provisioning_intents_failure_class_check
+  CHECK (failure_class IS NULL OR failure_class IN ('transient', 'known_wedge', 'needs_decision', 'unknown'));
+
+COMMIT;

package/modules/provisioning/routes/core-upgrade.js

@@ -25,7 +25,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const provisioning = require('../provisioning');
-const { makeCoreUpgradeHandler, makeCoreUpgradePreviewHandler, makeControlPlaneHandler } = require('../core-upgrade');
+const { makeCoreUpgradeHandler, makeCoreUpgradePreviewHandler, makeControlPlaneHandler, makeUpdateChannelHandler } = require('../core-upgrade');
 const { requireOwnProjectOrPin } = require('../core-upgrade-authz');
 
 const log = api.logger('provisioning');
@@ -86,6 +86,26 @@ module.exports = function buildCoreUpgradeRouter() {
     makeCoreUpgradePreviewHandler({ provisioning, pool: api.pool, parseId: api.parseId, log }),
   );
 
+  // POST /provisioning/instances/:id/update-channel — set the project's update rule
+  // (task 1004445). Body: { channel: "pinned" | "patch" | "minor" }.
+  //
+  // rank: `core.pin.move`, OR THE PROJECT'S OWN OWNER — the same two doors as the move,
+  // because the rule decides which moves the runner will perform: whoever may press
+  // Move may choose how far it reaches, and nobody else may. The platform's own row
+  // stays on the atom alone (OWNER_SHAPES excludes it), exactly as for the move.
+  router.post(
+    '/provisioning/instances/:id/update-channel',
+    api.requireBuilder,
+    requireOwnProjectOrPin({ pinGate: api.requirePermission('core.pin.move'), provisioning, pool: api.pool, log }),
+    makeUpdateChannelHandler({
+      provisioning,
+      pool: api.pool,
+      parseId: api.parseId,
+      validateOrRespond: api.validateOrRespond,
+      log,
+    }),
+  );
+
   // GET /provisioning/control-plane — "which row is this platform, and where does it
   // stand?" The deploy page's first call: the self row is created once by hand at
   // install time, so its id is per-install and nobody's to memorise. The atom ALONE

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.28",
+  "version": "1.20.30",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.28",
+      "version": "1.20.30",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.28",
+  "version": "1.20.30",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8240,5 +8240,17 @@
       "id": "1002969",
       "text": "An invitation to join a project now expires after 30 days; the person who sent it can simply invite again."
     }
+  ],
+  "1.20.29": [
+    {
+      "id": "1004445",
+      "text": "Each project now has its own update rule. A project can be allowed to take bigger step-up updates (like 1.19 to 1.20) instead of being stuck on small fixes only, and its owner can change the rule."
+    }
+  ],
+  "1.20.30": [
+    {
+      "id": "1004446",
+      "text": "When a software update fails, the system now records what kind of failure it was — a temporary glitch, a known snag, a rule only the owner can change, or something unknown — and tells the truth about it instead of always sayin"
+    }
   ]
 }