@bongos/core 1.20.49 → 1.20.50

package/modules/platform-identity/routes/sso.js

@@ -25,6 +25,7 @@ const hubKeys = require('../hub-keys');
 const hubDevice = require('../hub-device');
 // The D7 applicant-profile read (task 1002972) and the echo that gates it.
 const applicantProfile = require('../applicant-profile');
+const terms = require('../terms-acceptance');
 const applicationEcho = require('../application-echo');
 const instanceFeedback = require('../instance-feedback');
 
@@ -204,6 +205,10 @@ function registerSeams() {
       // Floors on the EXISTENCE predicate, not the rollup one: hide_stats
       // suppresses numbers, never addressability.
       getPublicHandle: (githubId) => canonicalProfile.getPublicHandle(githubId, { pool }),
+      // task 1004417 (BV2.PS05): the terms version /terms states, read by provisioning
+      // when a founder ticks the create wizard's terms box. A READ of the constant only —
+      // it stamps nothing on any account (that stays terms-acceptance.js's alone).
+      termsVersion: () => terms.TERMS_VERSION,
     });
   }
 }

package/modules/provisioning/migrations/provisioning_033_terms_ack.sql

@@ -0,0 +1,33 @@
+-- provisioning_033_terms_ack.sql — the founder's terms acknowledgement, kept on the project
+-- (task 1004417, BV2.PS05; goal 1000121, spec docs/specs/bongos-v2-project-startup.md).
+--
+-- WHY THIS EXISTS. The create wizard now opens on a terms screen: the founder ticks "I can
+-- sign legally, or can get a signature, for the use of this platform, and I acknowledge the
+-- terms and conditions" before anything else is asked. The owner chose (2026-09-30) to keep
+-- that record ON THE PROJECT, not on the person's platform account: the account-level stamp
+-- is ADR 0213's, written only at a witnessed sign-in (and task 1003361 adds the hub's own
+-- sign-in as its second capture point). This one says who founded WHICH project under WHICH
+-- text, which a later terms revision needs to know per project.
+--
+-- WHAT IT ADDS.
+--   provisioning_instances.terms_ack_at      — when the create that ticked the box was filed.
+--   provisioning_instances.terms_ack_version — the terms version the SERVER stamped: read from
+--     platform-identity's TERMS_VERSION through the platform-identity.hub port, never from the
+--     request body, so a caller cannot record agreement to a text it names itself. NULL on an
+--     instance with no hub to ask (the acknowledgement time is still kept).
+--
+-- The names are deliberately NOT terms_accepted_at / terms_version: those are the account's
+-- acceptance columns, and tests/terms_acceptance.mjs fails any second server file that writes
+-- them. This is a different record with a different owner.
+--
+-- Nullable, no backfill: a project created before this shipped never saw the screen, and a
+-- NULL says exactly that. Written once, at create; an idempotent re-request never rewrites it.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS terms_ack_at timestamptz;
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS terms_ack_version text;
+
+COMMIT;

package/modules/provisioning/onboard-plan.js

@@ -26,6 +26,11 @@
 // an existing repo; ADR 0121 §Decision 1 / task 2046). Every other leg is identical, so
 // `mode` only relabels the github-repo / init / scaffold steps.
 //
+// The hub wizard's FRONT DOOR (task 1004417 — the terms tick, then demo or create) is
+// deliberately NOT a step here: it comes before the rail, sets up nothing, and its record
+// is the project's own terms columns (./terms-ack.js), not a plan key. The /new-project
+// skill's "step 0" says the same for the other forms.
+//
 // `opts.domain` (task 1002703): the terminal enter-hall step names the instance's own
 // hall address when the renderer knows the domain, and falls back to the `bongos dev`
 // local-hall one-liner when it doesn't — the hall is the point of creating a project,

package/modules/provisioning/provisioning.js

@@ -1076,7 +1076,7 @@ async function listAllInstances(db, { status } = {}) {
 // re-fetches the existing row and returns { created:false } so the ROUTE can
 // decide (same owner → idempotent re-request; different owner → 409). Never
 // silently reassigns ownership.
-async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShape, domain, dbName, port, tier, onboardMode, type, description, detail, modules }) {
+async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShape, domain, dbName, port, tier, onboardMode, type, description, detail, modules, termsAck }) {
   // Unknown/absent coerces to the shape that costs nothing and trusts nothing. Was
   // 'co-tenant' (then the free front door); that shape is now retired + unrequestable,
   // so coercing to it would mint a row no caller is allowed to ask for.
@@ -1103,12 +1103,15 @@ async function createInstance(db, { ownerBuilderId, slug, targetRef, hostingShap
   try {
     const { rows } = await db.query(
       `INSERT INTO provisioning_instances
-         (owner_builder_id, slug, target_ref, hosting_shape, domain, db_name, port, tier, cost_estimate_usd, onboard_mode, type, description, detail, modules)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13::jsonb, $14::jsonb)
+         (owner_builder_id, slug, target_ref, hosting_shape, domain, db_name, port, tier, cost_estimate_usd, onboard_mode, type, description, detail, modules, terms_ack_at, terms_ack_version)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13::jsonb, $14::jsonb, CASE WHEN $15::boolean THEN now() END, $16)
        RETURNING *`,
       [ownerBuilderId, slug, targetRef ?? null, shape, domain ?? null,
        dbName ?? null, port ?? null, tier ?? null, cost, mode, declaredType,
-       told, JSON.stringify(answers), picked === null ? null : JSON.stringify(picked)]
+       told, JSON.stringify(answers), picked === null ? null : JSON.stringify(picked),
+       // the wizard's terms screen (task 1004417, ./terms-ack.js): the route resolved the
+       // version server-side; no acknowledgement leaves both columns NULL
+       !!termsAck, (termsAck && termsAck.version) || null]
     );
     return { instance: rows[0], created: true };
   } catch (e) {

package/modules/provisioning/routes/provisioning.js

@@ -56,7 +56,7 @@ const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
 const { requireAuthorityForShape } = require('../paid-shape-gate');
 const { requireRoomOnBox } = require('../capacity-gate');   // a full box refused up front (task 1003938)
-const { adoptCredentialFault } = require('../credential-preflight');
+const { adoptCredentialFault } = require('../credential-preflight'); const { termsAcknowledgement } = require('../terms-ack');
 const catalogBridge = require('../catalog-bridge');
 const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285, task 1003927)
 const { callbackPage } = require('./callback-page');
@@ -323,7 +323,7 @@ module.exports = function provisioningRoutes() {
       // exactly the set the panel preselected. An explicit [] is the different
       // answer "none of them". maxItems is a sanity ceiling well above a catalog
       // that is three modules wide today.
-      modules: { type: 'array', itemsType: 'string', maxItems: 50 },
+      modules: { type: 'array', itemsType: 'string', maxItems: 50 }, terms_acknowledged: { type: 'boolean' },   // the latter: the wizard's terms tick (task 1004417, ../terms-ack.js)
     })) return;
     const body = req.body || {};
     const detailFault = badProjectDetail(body.detail);
@@ -426,7 +426,7 @@ module.exports = function provisioningRoutes() {
         description: body.description, detail: body.detail,
         // The picker's selection (task 1002339) — absent for the same reason and
         // with the same standing: skipped, and resolved from the bundle on read.
-        modules: body.modules,
+        modules: body.modules, termsAck: termsAcknowledgement(body),
       });
       if (req.releaseFreePlace) await req.releaseFreePlace();   // the row exists: the one-free lock's work is done (../free-place-lock.js)
       // Slug already taken by ANOTHER builder — refuse (never reassign ownership).

package/modules/provisioning/terms-ack.js

@@ -0,0 +1,36 @@
+// modules/provisioning/terms-ack.js — the founder's terms acknowledgement, as the create
+// route records it (task 1004417, BV2.PS05; migration provisioning_033).
+//
+// The wizard's first screen asks the founder to tick one box before anything else. The
+// request carries only that the box was ticked (`terms_acknowledged: true`). WHICH terms
+// is the server's answer, never the caller's: the version is read from platform-identity's
+// TERMS_VERSION — the same constant /terms states and ADR 0213 stamps on an account —
+// through the platform-identity.hub port. A body cannot name the text it agreed to, so a
+// forged version is not a thing this record can hold.
+//
+// resolveOptional, not a `consumes` entry: platform-identity is hub-only (`default:
+// false`), so an instance running provisioning without it has no terms version to ask for.
+// The acknowledgement is still kept there, with a NULL version, rather than dropped —
+// the founder did tick the box.
+//
+// Its own file because routes/provisioning.js sits a few lines under the 1500-line
+// fitness ratchet.
+'use strict';
+
+const api = require('../../src/module-api');
+
+function currentTermsVersion() {
+  const hub = api.resolveOptional('platform-identity.hub');
+  const v = hub && typeof hub.termsVersion === 'function' ? hub.termsVersion() : null;
+  return typeof v === 'string' && v ? v : null;
+}
+
+// The record createInstance writes, or null when the box was not ticked (an older client,
+// the CLI, an adopt run from a script — none of them showed the screen, and a NULL row
+// says exactly that). Strictly `true`: the validator already refuses a non-boolean.
+function termsAcknowledgement(body) {
+  if (!body || body.terms_acknowledged !== true) return null;
+  return { version: currentTermsVersion() };
+}
+
+module.exports = { termsAcknowledgement };