@bongos/core 1.20.48 → 1.20.50

package/modules/hall-ui/public/sky-panel.js

@@ -78,7 +78,7 @@
         ${waiting.length ? fact('waits on', waiting.map(name).join(', ')) : ''}
         ${waitedOn.length ? fact('waited on by', waitedOn.map(name).join(', ')) : ''}
       </div>
-      ${g.crit.length ? `<ul class="crit">${g.crit.slice(0, 10).map((c) => `<li><span class="ring${c.satisfied ? ' on' : ''}"></span><span>${esc(plain(c.text).slice(0, 120))}${plain(c.text).length > 120 ? '…' : ''}${c.bornOf ? ` <span class="born">· born of a thought</span>` : ''}${c.credits ? ` <span class="lbl">${c.credits} cr</span>` : ''}</span></li>`).join('')}</ul>` : ''}
+      ${g.crit.length ? `<ul class="crit">${g.crit.slice(0, 10).map((c) => `<li><span class="ring${c.satisfied ? ' on' : ''}"></span><span>${esc(plain(c.text).slice(0, 120))}${plain(c.text).length > 120 ? '…' : ''}${c.bornOf ? ` <span class="born">· born of a thought</span>` : ''}${c.credits ? ` <span class="lbl">${c.credits} cr</span>` : ''}${c.uatLabel ? ` <span class="lbl">${esc(c.uatLabel)}</span>` : ''}${c.backendOnly ? ' <span class="lbl">backend-only</span>' : ''}</span></li>`).join('')}</ul>` : ''}
       <div class="doors">
         <button type="button" class="door primary" id="descendBtn">${g.status === 'open' ? 'descend into the well' : 'look closer'}</button>
         ${edgesOf(g).length ? `<button type="button" class="door" id="chartBtn">chart its routes</button>` : ''}

package/modules/hall-ui/public/thinking.html

@@ -142,11 +142,13 @@
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>
-<script src="/builders/sky-data.js?v=2026-09-27-split"></script>
+<!-- task 1004402: the UAT state words the rings share with the goal page. -->
+<script src="/builders/criterion-uat-ui.js?v=2026-09-30-uat1"></script>
+<script src="/builders/sky-data.js?v=2026-09-30-uat1"></script>
 <script src="/builders/sky-layout.js?v=2026-09-27-split"></script>
 <script src="/builders/sky-draw.js?v=2026-09-27-split"></script>
-<script src="/builders/sky-interaction.js?v=2026-09-27-split"></script>
-<script src="/builders/sky-panel.js?v=2026-09-27-split"></script>
+<script src="/builders/sky-interaction.js?v=2026-09-30-uat1"></script>
+<script src="/builders/sky-panel.js?v=2026-09-30-uat1"></script>
 <script src="/builders/sky-composer.js?v=2026-09-27-split"></script>
 <script src="/builders/sky-tour.js?v=2026-09-27-split"></script>
 </body>

package/modules/lifecycle/done-when.js

@@ -221,7 +221,9 @@ async function criterionProgress(versionId) {
   // about coverage. It uses idx_tasks_version_status (version_id leading).
   const [{ rows }, { rows: unattr }, goalRows] = await Promise.all([
     pool.query(
-      `WITH ranked AS (
+      // MATERIALIZED (task 1004402): the per-criterion UAT subqueries run once per
+      // criterion here, never once per (criterion, task) row after the join.
+      `WITH ranked AS MATERIALIZED (
          SELECT d.id, d.version_id, d.criterion_id, d.criterion_md, d.satisfied, d.goal_id,
                 ROW_NUMBER() OVER (ORDER BY d.sort_order, d.criterion_id) AS cnum,
                 ${uatReadColumnsSql('d')}

package/modules/lifecycle/sky.js

@@ -42,7 +42,7 @@ const api = require('../../src/module-api');
 const { pool } = api;
 const goalGraph = require('./goal-graph');
 const goalCategory = require('./goal-category');
-const { isPendingReview } = require('./done-when');
+const { isPendingReview, uatState, uatReadColumnsSql } = require('./done-when');
 const { TERMINAL_STATUSES } = require('./task-status');
 
 const SKY_CACHE_TTL_MS = 60 * 1000;
@@ -67,15 +67,24 @@ async function skyRows({ versionId = null, viewerId = null, viewerIsArchon = fal
     activePool.query(
       // The criterion→task join, read once. Flat rows on purpose (see the header):
       // the fold happens in shapeSky so a test can compare it with the rollup's.
-      `SELECT c.id::text AS id, c.goal_id::text AS goal_id, c.criterion_id, c.criterion_md,
-              c.satisfied, c.sort_order,
+      // task 1004402: each criterion's UAT columns (ADR 0351) are read ONCE per
+      // criterion, in a MATERIALIZED step before the task join fans the rows out;
+      // spliced into the flat join they re-ran once per linked task, on the one
+      // read that is the whole project's sky.
+      `WITH crit AS MATERIALIZED (
+         SELECT c.id, c.goal_id, c.criterion_id, c.criterion_md, c.satisfied, c.sort_order,
+                ${uatReadColumnsSql('c')}
+           FROM done_when_criteria c
+           JOIN goals g ON g.id = c.goal_id
+          WHERE c.goal_id IS NOT NULL
+            AND ($1::text IS NULL OR g.version_id = $1)
+       )
+       SELECT c.id::text AS id, c.goal_id::text AS goal_id, c.criterion_id, c.criterion_md,
+              c.satisfied, c.sort_order, c.uat_kind, c.backend_only,
               t.id::text AS task_id, t.status AS task_status
-         FROM done_when_criteria c
-         JOIN goals g ON g.id = c.goal_id
+         FROM crit c
          LEFT JOIN task_criteria tc ON tc.criterion_id = c.id
          LEFT JOIN tasks t          ON t.id = tc.task_id
-        WHERE c.goal_id IS NOT NULL
-          AND ($1::text IS NULL OR g.version_id = $1)
         ORDER BY c.goal_id, c.sort_order, c.criterion_id, t.id`,
       [version]
     ),
@@ -111,21 +120,27 @@ function foldCriteria(rows = []) {
         criterion_id: row.criterion_id,
         criterion_md: row.criterion_md,
         satisfied: row.satisfied === true,
+        backend_only: row.backend_only === true,
         task_ids: [],
         _unshipped: 0,
+        _shipped: 0,
+        _uatKind: row.uat_kind ?? null,
       };
       byId.set(c.id, c);
     }
     if (row.task_id != null) {
       c.task_ids.push(String(row.task_id));
       if (!TERMINAL_STATUSES.includes(row.task_status)) c._unshipped += 1;
+      if (row.task_status === 'shipped') c._shipped += 1;
     }
   }
   return [...byId.values()].map((c) => {
-    const { _unshipped, ...rest } = c;
+    const { _unshipped, _shipped, _uatKind, ...rest } = c;
     return {
       ...rest,
       pending_review: isPendingReview({ satisfied: c.satisfied, linked: c.task_ids.length, unshipped: _unshipped }),
+      // task 1004402: the same derivation the goal page and /status use.
+      uat_state: uatState({ satisfied: c.satisfied, linked: c.task_ids.length, unshipped: _unshipped, shipped: _shipped, latestKind: _uatKind }),
     };
   });
 }

package/modules/platform-identity/routes/sso.js

@@ -25,6 +25,7 @@ const hubKeys = require('../hub-keys');
 const hubDevice = require('../hub-device');
 // The D7 applicant-profile read (task 1002972) and the echo that gates it.
 const applicantProfile = require('../applicant-profile');
+const terms = require('../terms-acceptance');
 const applicationEcho = require('../application-echo');
 const instanceFeedback = require('../instance-feedback');
 
@@ -204,6 +205,10 @@ function registerSeams() {
       // Floors on the EXISTENCE predicate, not the rollup one: hide_stats
       // suppresses numbers, never addressability.
       getPublicHandle: (githubId) => canonicalProfile.getPublicHandle(githubId, { pool }),
+      // task 1004417 (BV2.PS05): the terms version /terms states, read by provisioning
+      // when a founder ticks the create wizard's terms box. A READ of the constant only —
+      // it stamps nothing on any account (that stays terms-acceptance.js's alone).
+      termsVersion: () => terms.TERMS_VERSION,
     });
   }
 }

package/modules/provisioning/migrations/provisioning_033_terms_ack.sql

@@ -0,0 +1,33 @@
+-- provisioning_033_terms_ack.sql — the founder's terms acknowledgement, kept on the project
+-- (task 1004417, BV2.PS05; goal 1000121, spec docs/specs/bongos-v2-project-startup.md).
+--
+-- WHY THIS EXISTS. The create wizard now opens on a terms screen: the founder ticks "I can
+-- sign legally, or can get a signature, for the use of this platform, and I acknowledge the
+-- terms and conditions" before anything else is asked. The owner chose (2026-09-30) to keep
+-- that record ON THE PROJECT, not on the person's platform account: the account-level stamp
+-- is ADR 0213's, written only at a witnessed sign-in (and task 1003361 adds the hub's own
+-- sign-in as its second capture point). This one says who founded WHICH project under WHICH
+-- text, which a later terms revision needs to know per project.
+--
+-- WHAT IT ADDS.
+--   provisioning_instances.terms_ack_at      — when the create that ticked the box was filed.
+--   provisioning_instances.terms_ack_version — the terms version the SERVER stamped: read from
+--     platform-identity's TERMS_VERSION through the platform-identity.hub port, never from the
+--     request body, so a caller cannot record agreement to a text it names itself. NULL on an
+--     instance with no hub to ask (the acknowledgement time is still kept).
+--
+-- The names are deliberately NOT terms_accepted_at / terms_version: those are the account's
+-- acceptance columns, and tests/terms_acceptance.mjs fails any second server file that writes
+-- them. This is a different record with a different owner.
+--
+-- Nullable, no backfill: a project created before this shipped never saw the screen, and a
+-- NULL says exactly that. Written once, at create; an idempotent re-request never rewrites it.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS terms_ack_at timestamptz;
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS terms_ack_version text;
+
+COMMIT;

package/modules/provisioning/onboard-plan.js

@@ -26,6 +26,11 @@
 // an existing repo; ADR 0121 §Decision 1 / task 2046). Every other leg is identical, so
 // `mode` only relabels the github-repo / init / scaffold steps.
 //
+// The hub wizard's FRONT DOOR (task 1004417 — the terms tick, then demo or create) is
+// deliberately NOT a step here: it comes before the rail, sets up nothing, and its record
+// is the project's own terms columns (./terms-ack.js), not a plan key. The /new-project
+// skill's "step 0" says the same for the other forms.
+//
 // `opts.domain` (task 1002703): the terminal enter-hall step names the instance's own
 // hall address when the renderer knows the domain, and falls back to the `bongos dev`
 // local-hall one-liner when it doesn't — the hall is the point of creating a project,

package/modules/provisioning/provisioning.js

@@ -1076,7 +1076,7 @@ async function listAllInstances(db, { status } = {}) {
 // re-fetches the existing row and returns { created:false } so the ROUTE can
 // decide (same owner → idempotent re-request; different owner → 409). Never
 // silently reassigns ownership.
-async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShape, domain, dbName, port, tier, onboardMode, type, description, detail, modules }) {
+async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShape, domain, dbName, port, tier, onboardMode, type, description, detail, modules, termsAck }) {
   // Unknown/absent coerces to the shape that costs nothing and trusts nothing. Was
   // 'co-tenant' (then the free front door); that shape is now retired + unrequestable,
   // so coercing to it would mint a row no caller is allowed to ask for.
@@ -1103,12 +1103,15 @@ async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShap
   try {
     const { rows } = await db.query(
       `INSERT INTO provisioning_instances
-         (owner_builder_id, slug, target_ref, hosting_shape, domain, db_name, port, tier, cost_estimate_usd, onboard_mode, type, description, detail, modules)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13::jsonb, $14::jsonb)
+         (owner_builder_id, slug, target_ref, hosting_shape, domain, db_name, port, tier, cost_estimate_usd, onboard_mode, type, description, detail, modules, terms_ack_at, terms_ack_version)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13::jsonb, $14::jsonb, CASE WHEN $15::boolean THEN now() END, $16)
        RETURNING *`,
       [ownerBuilderId, slug, targetRef ?? null, shape, domain ?? null,
        dbName ?? null, port ?? null, tier ?? null, cost, mode, declaredType,
-       told, JSON.stringify(answers), picked === null ? null : JSON.stringify(picked)]
+       told, JSON.stringify(answers), picked === null ? null : JSON.stringify(picked),
+       // the wizard's terms screen (task 1004417, ./terms-ack.js): the route resolved the
+       // version server-side; no acknowledgement leaves both columns NULL
+       !!termsAck, (termsAck && termsAck.version) || null]
     );
     return { instance: rows[0], created: true };
   } catch (e) {

package/modules/provisioning/routes/provisioning.js

@@ -56,7 +56,7 @@ const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
 const { requireAuthorityForShape } = require('../paid-shape-gate');
 const { requireRoomOnBox } = require('../capacity-gate');   // a full box refused up front (task 1003938)
-const { adoptCredentialFault } = require('../credential-preflight');
+const { adoptCredentialFault } = require('../credential-preflight'); const { termsAcknowledgement } = require('../terms-ack');
 const catalogBridge = require('../catalog-bridge');
 const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285, task 1003927)
 const { callbackPage } = require('./callback-page');
@@ -323,7 +323,7 @@ module.exports = function provisioningRoutes() {
       // exactly the set the panel preselected. An explicit [] is the different
       // answer "none of them". maxItems is a sanity ceiling well above a catalog
       // that is three modules wide today.
-      modules: { type: 'array', itemsType: 'string', maxItems: 50 },
+      modules: { type: 'array', itemsType: 'string', maxItems: 50 }, terms_acknowledged: { type: 'boolean' },   // the latter: the wizard's terms tick (task 1004417, ../terms-ack.js)
     })) return;
     const body = req.body || {};
     const detailFault = badProjectDetail(body.detail);
@@ -426,7 +426,7 @@ module.exports = function provisioningRoutes() {
         description: body.description, detail: body.detail,
         // The picker's selection (task 1002339) — absent for the same reason and
         // with the same standing: skipped, and resolved from the bundle on read.
-        modules: body.modules,
+        modules: body.modules, termsAck: termsAcknowledgement(body),
       });
       if (req.releaseFreePlace) await req.releaseFreePlace();   // the row exists: the one-free lock's work is done (../free-place-lock.js)
       // Slug already taken by ANOTHER builder — refuse (never reassign ownership).

package/modules/provisioning/terms-ack.js

@@ -0,0 +1,36 @@
+// modules/provisioning/terms-ack.js — the founder's terms acknowledgement, as the create
+// route records it (task 1004417, BV2.PS05; migration provisioning_033).
+//
+// The wizard's first screen asks the founder to tick one box before anything else. The
+// request carries only that the box was ticked (`terms_acknowledged: true`). WHICH terms
+// is the server's answer, never the caller's: the version is read from platform-identity's
+// TERMS_VERSION — the same constant /terms states and ADR 0213 stamps on an account —
+// through the platform-identity.hub port. A body cannot name the text it agreed to, so a
+// forged version is not a thing this record can hold.
+//
+// resolveOptional, not a `consumes` entry: platform-identity is hub-only (`default:
+// false`), so an instance running provisioning without it has no terms version to ask for.
+// The acknowledgement is still kept there, with a NULL version, rather than dropped —
+// the founder did tick the box.
+//
+// Its own file because routes/provisioning.js sits a few lines under the 1500-line
+// fitness ratchet.
+'use strict';
+
+const api = require('../../src/module-api');
+
+function currentTermsVersion() {
+  const hub = api.resolveOptional('platform-identity.hub');
+  const v = hub && typeof hub.termsVersion === 'function' ? hub.termsVersion() : null;
+  return typeof v === 'string' && v ? v : null;
+}
+
+// The record createInstance writes, or null when the box was not ticked (an older client,
+// the CLI, an adopt run from a script — none of them showed the screen, and a NULL row
+// says exactly that). Strictly `true`: the validator already refuses a non-boolean.
+function termsAcknowledgement(body) {
+  if (!body || body.terms_acknowledged !== true) return null;
+  return { version: currentTermsVersion() };
+}
+
+module.exports = { termsAcknowledgement };