@bongos/core 1.20.82 → 1.21.1

package/scripts/gds/provision.js

@@ -13,7 +13,8 @@
 // composes the docs/recipes/cloudbongos-standup.md runbook into ONE idempotent,
 // dry-run-default, drift-reconciling flow (ADR 0016 / ADR 0031 §9.4 trust boundary):
 //
-//   server (a process on an allocated port — co-tenant or cloud-host)
+//   DNS A record FIRST (task 1004505 — the name must exist before anyone is shown it)
+//     → server (a process on an allocated port — co-tenant or cloud-host)
 //     → createdb + GDS-only migrate (MEDUSA_GDS_ONLY=1)
 //     → write config + per-instance /etc/<inst>/web.env
 //     → install + enable a per-instance systemd unit (+ allocate a port)
@@ -251,8 +252,8 @@ async function provisionInstance(inst, deps) {
 
   if (isByoHost(inst.hosting_shape)) return recordByoHost(inst, deps); // stand up NOTHING, ABOVE every preflight — reasoning in provision-byo-host.js's header (ADR 0323)
   // ── preflight: DNS token scope (task 1980) ─────────────────────────────────
-  // BEFORE committing to the address (allocating a port / the
-  // step-5 DNS UPSERT), verify the control-plane Cloudflare token can actually reach
+  // BEFORE committing to the address (the step-0 DNS UPSERT /
+  // allocating a port), verify the control-plane Cloudflare token can actually reach
   // the domain's zone. Turns the Emersonian standup's confusing mid-flow step-5 DNS
   // failure into an up-front, actionable stop with no half-done provision. Read-only.
   if (inst.domain && CONFIG.dnsHook) {
@@ -292,6 +293,64 @@ async function provisionInstance(inst, deps) {
     const gap = caddyCheck(boxExec, { domain: inst.domain });
     if (gap) return { ok: false, error: `Caddy preflight failed: ${gap}` };
   }
+  // ── step 0: DNS FIRST — Cloudflare A-record UPSERT for the instance's domain (P4) ──
+  // The first mutation of a standup, ahead of the status flip and every step after it
+  // (task 1004505, BV2.PS17). The hub can show a project's address from the moment it
+  // is created, and a lookup made before the record exists is cached as "not found" by
+  // the visitor's resolver for the zone's negative TTL (30 min on cloudbongos.com) — a
+  // founder's first click used to lock their own home network out of the project for
+  // half an hour. Created here, the name answers before any surface can offer it; the
+  // hub also holds every link until a platform lookup has seen it answer (dns_resolves).
+  // The A-record target (recordIp):
+  //   • co-tenant  → PROVISION_PUBLIC_IP (the box it runs on — under remote-exec that
+  //                  is the co-hosting box, ADR 0130).
+  //   • standalone → the CONTROL PLANE's own IP (task 2074): it runs control-plane-
+  //                  local, so its domain must point HERE, not at the co-hosting box.
+  //                  PROVISION_CONTROL_PLANE_IP when remote-exec splits the two boxes;
+  //                  else PROVISION_PUBLIC_IP (all-local: one and the same machine).
+  //                  Remote-exec set but no control-plane IP configured → null, which
+  //                  makes this step fail loud rather than point the domain at the wrong box.
+  const recordIp = standalone ? CONFIG.controlPlaneIp || (CONFIG.remoteHost ? null : CONFIG.publicIp) : CONFIG.publicIp;
+  // Formalized in P4 (#1945): the shared box-dns-cloudflare.sh hook UPSERTs an A
+  // record pointing the domain at recordIp, in the domain's own zone. It runs on the
+  // CONTROL PLANE for every shape: the hook needs the Cloudflare token, which never
+  // leaves the control plane. A DNS FAILURE SURFACES (the task-1180 lesson: never
+  // report provision success while the A record silently didn't land) — and, being
+  // first, it now fails before anything else was touched.
+  let dnsUpserted = false;
+  if (inst.domain && CONFIG.dnsHook) {
+    if (!recordIp) {
+      const ipEnvHint = standalone ? 'PROVISION_CONTROL_PLANE_IP (standalone)' : 'PROVISION_PUBLIC_IP (co-tenant)';
+      if (apply) throw new Error(`cannot UPSERT DNS for ${inst.domain}: no target IP — set ${ipEnvHint} in the control-plane box.env`);
+      log(`  [dns] would upsert A ${inst.domain} once the target IP is known (set ${ipEnvHint})`);
+    } else {
+      // Standalone runs control-plane-local under the *.cloudbongos.com wildcard origin
+      // cert (task 2074/2077) → proxied=true (CF edge fronts it, IP hidden); co-tenant
+      // stays proxied=false so their on-demand ACME challenge (step 6) reaches the origin.
+      const dnsEnv = dnsUpsertEnv(inst, { publicIp: recordIp, proxied: standalone });
+      log(`  [dns] upsert A ${inst.domain} -> ${recordIp} (zone ${dnsEnv.CLOUDFLARE_ZONE}, proxied=${dnsEnv.BOX_PROXIED === '1'}) via ${CONFIG.dnsHook}`);
+      // controlExec, NOT exec: the DNS hook needs the Cloudflare token, which lives
+      // only on the control plane — it must never run on the (token-free) co-hosting
+      // box even when the box-mutating steps below go there over SSH (task 2065).
+      controlExec(CONFIG.dnsHook, { env: dnsEnv });
+      dnsUpserted = true;
+      // The clear half of the birth-path note (F16): a revive after the operator
+      // configured the hook must retire the stale "point your A record" sentence.
+      if (apply && provisioning.recordDnsNote) {
+        await provisioning.recordDnsNote(db, inst.id, null).catch(() => {});
+      }
+    }
+  } else {
+    log('  [dns] skipped (no domain, or BOX_DNS_HOOK unset)');
+    // Birth-path twin of the domain-attach note (F16): a domain with no hook is
+    // the same silent skip here, so the owner card gets the same sentence.
+    if (apply && inst.domain) {
+      if (provisioning.recordDnsNote) await provisioning.recordDnsNote(db, inst.id,
+        `Automatic DNS isn't set up on this platform — point ${inst.domain}'s A record at ${recordIp || 'your server'}, and this card will show when it answers.`
+      ).catch(() => {});
+    }
+  }
+
   if (apply) await provisioning.setInstanceStatus(db, inst.id, 'provisioning');
   const patch = {};
 
@@ -318,16 +377,6 @@ async function provisionInstance(inst, deps) {
   }
 
   // ── step 1: server ───────────────────────────────────────────────────────
-  // The A-record target for step 5's DNS UPSERT:
-  //   • co-tenant  → PROVISION_PUBLIC_IP (the box it runs on — under remote-exec that
-  //                  is the co-hosting box, ADR 0130).
-  //   • standalone → the CONTROL PLANE's own IP (task 2074): it runs control-plane-
-  //                  local, so its domain must point HERE, not at the co-hosting box.
-  //                  PROVISION_CONTROL_PLANE_IP when remote-exec splits the two boxes;
-  //                  else PROVISION_PUBLIC_IP (all-local: one and the same machine).
-  //                  Remote-exec set but no control-plane IP configured → null, which
-  //                  makes step 5 fail loud rather than point the domain at the wrong box.
-  const recordIp = standalone ? CONFIG.controlPlaneIp || (CONFIG.remoteHost ? null : CONFIG.publicIp) : CONFIG.publicIp;
   // Co-tenant OR standalone: a process bound to an allocated port on the box it runs
   // on. Co-tenant shares that box's checkout ($0, cloudbongos.com model — under
   // remote-exec, the co-hosting box); standalone (ADR 0108) runs from its OWN repo
@@ -433,46 +482,7 @@ async function provisionInstance(inst, deps) {
   log('  [backup] create backup dir + install + enable nightly DB backup timer');
   pm.installBackup(inst, { exec: boxExec, writeFile: boxWriteFile, sudoP, log });
 
-  // ── step 5: DNS — Cloudflare A-record UPSERT for the instance's domain (P4) ──
-  // Formalized in P4 (#1945): the shared box-dns-cloudflare.sh hook UPSERTs an A
-  // record pointing the domain at its target IP (recordIp), in the domain's own
-  // zone, proxied=false so Caddy's on-demand ACME challenge (step 6) reaches the
-  // origin (dnsUpsertEnv). It runs on the CONTROL PLANE for every shape: the hook
-  // needs the Cloudflare token, which never leaves the control plane.
-  // Unlike P3's best-effort allowFail, a DNS FAILURE now SURFACES (the task-1180
-  // lesson: never report provision success while the A record silently didn't land).
-  if (inst.domain && CONFIG.dnsHook) {
-    if (!recordIp) {
-      const ipEnvHint = standalone ? 'PROVISION_CONTROL_PLANE_IP (standalone)' : 'PROVISION_PUBLIC_IP (co-tenant)';
-      if (apply) throw new Error(`cannot UPSERT DNS for ${inst.domain}: no target IP — set ${ipEnvHint} in the control-plane box.env`);
-      log(`  [dns] would upsert A ${inst.domain} once the target IP is known (set ${ipEnvHint})`);
-    } else {
-      // Standalone runs control-plane-local under the *.cloudbongos.com wildcard origin
-      // cert (task 2074/2077) → proxied=true (CF edge fronts it, IP hidden); co-tenant
-      // stays proxied=false so their on-demand ACME challenge reaches the origin.
-      const dnsEnv = dnsUpsertEnv(inst, { publicIp: recordIp, proxied: standalone });
-      log(`  [dns] upsert A ${inst.domain} -> ${recordIp} (zone ${dnsEnv.CLOUDFLARE_ZONE}, proxied=${dnsEnv.BOX_PROXIED === '1'}) via ${CONFIG.dnsHook}`);
-      // controlExec, NOT exec: the DNS hook needs the Cloudflare token, which lives
-      // only on the control plane — it must never run on the (token-free) co-hosting
-      // box even when the box-mutating steps above went there over SSH (task 2065).
-      controlExec(CONFIG.dnsHook, { env: dnsEnv });
-      // The clear half of the birth-path note (F16): a revive after the operator
-      // configured the hook must retire the stale "point your A record" sentence.
-      if (apply && provisioning.recordDnsNote) {
-        await provisioning.recordDnsNote(db, inst.id, null).catch(() => {});
-      }
-    }
-  } else {
-    log('  [dns] skipped (no domain, or BOX_DNS_HOOK unset)');
-    // Birth-path twin of the domain-attach note (F16): a domain with no hook is
-    // the same silent skip here, so the owner card gets the same sentence.
-    if (apply && inst.domain) {
-      if (provisioning.recordDnsNote) await provisioning.recordDnsNote(db, inst.id,
-        `Automatic DNS isn't set up on this platform — point ${inst.domain}'s A record at ${recordIp || 'your server'}, and this card will show when it answers.`
-      ).catch(() => {});
-    }
-  }
-
+  // (step 5, the DNS UPSERT, moved to step 0 at the top — task 1004505.)
   // A re-point on a PRE-ACTIVE instance records its release here and never
   // reaches the attach leg (that one no-ops for anything but 'active'), so this
   // run owns the drain — and an `error` row is frequently a partial standup that
@@ -542,6 +552,20 @@ async function provisionInstance(inst, deps) {
   // standalone paths never cleared it). The runner hands its own observation
   // to the liveness overlay so the card gets an honest verdict immediately
   // instead of waiting ~5 min for the first sweep.
+  // ── step 7c: the platform's own lookup (task 1004505) ─────────────────────
+  // The record went in at step 0, minutes ago, so this lookup cannot race it into a
+  // cached miss. An answer lets the hub link the address the moment the row reads
+  // active, instead of waiting for the first liveness sweep. Only for a record this
+  // run created: a manual-DNS domain is the owner's to point, and the sweep finds it.
+  if (apply && dnsUpserted && provisioning.lookupAnswers && provisioning.recordDnsResolved) {
+    if (await provisioning.lookupAnswers(inst.domain, { lookup: deps.lookup })) {
+      await provisioning.recordDnsResolved(db, inst.id).catch(() => {});
+      log(`  [dns] ${inst.domain} answers — the hub may link it now`);
+    } else {
+      log(`  [dns] ${inst.domain} does not answer the control plane yet — the hub holds its link until the sweep sees it`);
+    }
+  }
+
   if (apply) {
     await provisioning.setInstanceStatus(db, inst.id, 'active', { ...patch, error_note: null, provisioned_at: new Date().toISOString() });
     // The overlay column is DOMAIN-scoped when a domain exists (the sweep

package/scripts/gds/session-digest.js

@@ -34,6 +34,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { cliClient, loadSession, arg } = require('./cli-lib');
+const { uploadSessionTranscript } = require('./session-transcript-upload');
 const { buildSessionDigest, collectEnvSecrets, foldSubagentUsage } = require('./ship');
 
 
@@ -115,8 +116,11 @@ function parseTranscript(transcriptPath) {
 
 async function main() {
   // Watchdog: a SessionEnd hook must never stall session exit. If the read or
-  // POST hangs (slow/offline network — fetch has no default timeout), bail.
-  const watchdog = setTimeout(() => process.exit(0), 6000);
+  // POST hangs (slow/offline network — fetch has no default timeout), bail. 25s,
+  // not the old 6s, because the full transcript (ADR 0051, up to ~12 MB) now
+  // uploads after the digest; the .claude/settings.json hook timeout (30s) is the
+  // outer bound, and a hang still just drops the upload, never blocks exit.
+  const watchdog = setTimeout(() => process.exit(0), 25000);
   watchdog.unref();
   try {
     const stdinRaw = await readStdin();
@@ -143,7 +147,8 @@ async function main() {
     const extraSecrets = collectEnvSecrets();
     if (session.token) extraSecrets.push(session.token);
 
-    const digest = buildSessionDigest(parseTranscript(transcriptPath), { extraSecrets });
+    const entries = parseTranscript(transcriptPath);
+    const digest = buildSessionDigest(entries, { extraSecrets });
     // task 1003435: fold this session's subagents subtree into model_usage, the
     // same way the on-ship upload does — the whole session's tokens, not just the
     // interactive thread's.
@@ -174,6 +179,9 @@ async function main() {
       console.error(
         `session-digest: stored full session (${digest.metrics.assistant_turns} turns, ${digest.totalTokens} tokens, ${digest.metrics.tool_error_count} tool errors).`
       );
+      // ADR 0051: every session's FULL scrubbed transcript, after the digest (the
+      // server builds the transcript row from the digest's). Non-fatal.
+      console.error(`session-digest: ${await uploadSessionTranscript(api, sessionId, entries, extraSecrets)}`);
     } else {
       console.error(`session-digest: skipped (POST ${r && r.status}${r && r.data && r.data.error ? ' ' + r.data.error : ''}).`);
     }

package/scripts/gds/session-transcript-build.js

@@ -0,0 +1,155 @@
+// scripts/gds/session-transcript-build.js — the PURE transcript→full-transcript builder.
+//
+// ADR 0051 / task 1001004: every session is stored as its FULL per-turn content
+// (user prompts, assistant text, tool calls AND their results), not just the
+// metadata + 160-char snippets buildSessionDigest keeps. This is the sibling of
+// session-digest-build.js and shares its scrubber: EVERY string leaves this file
+// through scrubSecrets (modules/security/secret-scrub.js, the task-1003 scrubber),
+// on the builder's box, before anything is uploaded. A string that reaches the
+// output unscrubbed is a defect — keep that single choke point (`clean`).
+//
+// Bounded on purpose: each text field is capped and the whole transcript has a
+// byte ceiling (head + tail kept, like buildSessionDigest's turn cap), so one
+// runaway tool result cannot make an upload that the server must reject.
+// Extended-thinking blocks are NOT captured: they are model-internal, often
+// opaque, and ADR 0051 asks for what the builder asked and what they were told.
+const { scrubSecrets } = require('../../modules/security/secret-scrub');
+
+const MAX_FIELD_CHARS = 20000;          // one prompt / reply / tool result / tool input
+const MAX_TRANSCRIPT_BYTES = 12 * 1024 * 1024; // whole upload ceiling (the server enforces the same number)
+const MAX_TRANSCRIPT_TURNS = 20000;            // the route's maxItems; the builder trims to it so the server never has to refuse
+const MAX_TURN_BYTES = 200 * 1024;            // under the route's 256 KB per-turn cap, so a many-tool-call turn is shrunk here rather than refused there
+const MAX_RAW_CHARS = 200000;                  // bound on what the scrubber is ever handed (entropy-sweep cost)
+
+// clean — the one exit for every string: drop NULs (Postgres rejects them in
+// jsonb), SCRUB, then cap. Scrub BEFORE the final cap so a credential straddling
+// the cap boundary is redacted whole rather than sliced into a fragment too short
+// for any scrub shape to recognise. The scrubber is only ever handed MAX_RAW_CHARS
+// so a multi-MB tool result cannot make the entropy sweep unbounded.
+function clean(text, extraSecrets) {
+  if (typeof text !== 'string' || text.length === 0) return undefined;
+  const flat = text.replace(/\0/g, '');
+  if (!flat) return undefined;
+  const bounded = flat.length > MAX_RAW_CHARS ? flat.slice(0, MAX_RAW_CHARS) : flat;
+  const scrubbed = scrubSecrets(bounded, extraSecrets);
+  if (!scrubbed) return undefined;
+  if (scrubbed.length <= MAX_FIELD_CHARS && flat.length === bounded.length) return scrubbed;
+  const omitted = (flat.length - bounded.length) + Math.max(0, scrubbed.length - MAX_FIELD_CHARS);
+  return `${scrubbed.slice(0, MAX_FIELD_CHARS)}…[+${omitted} chars]`;
+}
+
+function resultText(content) {
+  if (typeof content === 'string') return content;
+  if (Array.isArray(content)) {
+    return content.map((p) => (p && typeof p.text === 'string' ? p.text : '')).filter(Boolean).join('\n');
+  }
+  return '';
+}
+
+// shrinkTurn — cut every string field of an oversize turn to an even share of a
+// fixed character budget (in place), marking the cut. Already scrubbed, so this
+// only ever removes text.
+function shrinkTurn(t) {
+  const fields = [];
+  if (typeof t.text === 'string') fields.push([t, 'text']);
+  for (const c of t.tool_calls || []) if (typeof c.input === 'string') fields.push([c, 'input']);
+  for (const r of t.tool_results || []) if (typeof r.text === 'string') fields.push([r, 'text']);
+  const cap = Math.max(200, Math.floor(40000 / Math.max(1, fields.length)));
+  for (const [o, k] of fields) {
+    if (o[k].length > cap) o[k] = `${o[k].slice(0, cap)}…[+${o[k].length - cap} chars]`;
+  }
+}
+
+// buildSessionTranscript — parsed Claude Code transcript entries →
+// { turns, turnCount, byteSize, truncated }. Pure; exported for tests.
+function buildSessionTranscript(entries, opts = {}) {
+  const extra = opts.extraSecrets || [];
+  const maxBytes = opts.maxBytes || MAX_TRANSCRIPT_BYTES;
+  const maxTurns = opts.maxTurns || MAX_TRANSCRIPT_TURNS;
+  const turns = [];
+  let i = 0;
+  for (const e of Array.isArray(entries) ? entries : []) {
+    if (!e || typeof e !== 'object' || !e.message) continue;
+    const ts = typeof e.timestamp === 'string' ? e.timestamp : undefined;
+    const msg = e.message;
+    if (e.type === 'assistant') {
+      const row = { i, role: 'assistant', ts };
+      const texts = [];
+      const calls = [];
+      for (const c of Array.isArray(msg.content) ? msg.content : []) {
+        if (c && c.type === 'text' && typeof c.text === 'string') texts.push(c.text);
+        else if (c && c.type === 'tool_use') {
+          let input;
+          try { input = clean(JSON.stringify(c.input), extra); } catch (_) { input = undefined; }
+          calls.push({ name: String(c.name || '?'), input });
+        }
+      }
+      const text = clean(texts.join('\n'), extra);
+      if (text) row.text = text;
+      if (calls.length) row.tool_calls = calls;
+      if (!text && !calls.length) continue; // pure-thinking line: nothing readable
+      turns.push(row);
+      i++;
+    } else if (e.type === 'user') {
+      const row = { i, role: 'user', ts };
+      if (typeof msg.content === 'string') {
+        const text = clean(msg.content, extra);
+        if (text) row.text = text;
+      } else if (Array.isArray(msg.content)) {
+        const texts = [];
+        const results = [];
+        for (const c of msg.content) {
+          if (c && c.type === 'text' && typeof c.text === 'string') texts.push(c.text);
+          else if (c && c.type === 'tool_result') {
+            const r = { text: clean(resultText(c.content), extra) };
+            if (c.is_error) r.is_error = true;
+            results.push(r);
+          }
+        }
+        const text = clean(texts.join('\n'), extra);
+        if (text) row.text = text;
+        if (results.length) row.tool_results = results;
+      }
+      if (!row.text && !row.tool_results) continue;
+      turns.push(row);
+      i++;
+    }
+  }
+
+  // Byte ceiling: keep the head (what was asked) and the tail (how it ended),
+  // drop the middle, and SAY so — a silently shortened record reads as complete.
+  // Serialize each turn once; an oversize turn (many tool calls, each at the field
+  // cap) is shrunk field-by-field to fit, so the route's per-turn cap never refuses
+  // a transcript the builder could have trimmed. Sizes include the comma each turn
+  // costs in the array, and the total the 2 bytes of brackets, so this total is the
+  // SAME number the route measures against its ceiling.
+  const sizes = turns.map((t, idx) => {
+    let json = JSON.stringify(t);
+    let bytes = Buffer.byteLength(json, 'utf8');
+    if (bytes > MAX_TURN_BYTES) {
+      shrinkTurn(t);
+      json = JSON.stringify(t);
+      bytes = Buffer.byteLength(json, 'utf8');
+    }
+    turns[idx] = t;
+    return bytes + 1;
+  });
+  let total = sizes.reduce((a, b) => a + b, 2);
+  let out = turns;
+  let truncated = false;
+  if (total > maxBytes || turns.length > maxTurns) {
+    truncated = true;
+    const headBudget = Math.floor(maxBytes * 0.6);
+    const tailBudget = maxBytes - headBudget;
+    let h = 0; let headEnd = 0;
+    const headCount = Math.floor(maxTurns * 0.6);
+    while (headEnd < turns.length && headEnd < headCount && h + sizes[headEnd] <= headBudget) h += sizes[headEnd++];
+    let t = 0; let tailStart = turns.length;
+    while (tailStart > headEnd && (turns.length - tailStart) < maxTurns - headEnd && t + sizes[tailStart - 1] <= tailBudget) t += sizes[--tailStart];
+    out = turns.slice(0, headEnd).concat(turns.slice(tailStart));
+    total = h + t + 2;
+  }
+  return { turns: out, turnCount: turns.length, byteSize: total, truncated };
+}
+
+module.exports = { buildSessionTranscript, MAX_FIELD_CHARS, MAX_TRANSCRIPT_BYTES, MAX_TRANSCRIPT_TURNS };

package/scripts/gds/session-transcript-upload.js

@@ -0,0 +1,29 @@
+// scripts/gds/session-transcript-upload.js — send a session's FULL scrubbed
+// transcript to the corpus (ADR 0051, task 1001004).
+//
+// Shared by the SessionEnd hook (session-digest.js — fires for EVERY session) and
+// the on-ship upload (ship-session-upload.js — covers the mid-session tail), so
+// both build and send the transcript the same way. BEST-EFFORT and NON-FATAL like
+// the digest upload beside it: returns a one-line outcome string, never throws.
+// It must run AFTER the digest POST — the server creates the transcript row only
+// from the caller's own session_records row.
+const { buildSessionTranscript } = require('./session-transcript-build');
+
+async function uploadSessionTranscript(api, sessionId, entries, extraSecrets) {
+  try {
+    const t = buildSessionTranscript(entries, { extraSecrets });
+    if (!t.turns.length) return 'transcript: nothing to store.';
+    const r = await api.sessions.putSessionsSidTranscript({
+      sid: sessionId,
+      body: { turns: t.turns, truncated: t.truncated },
+    });
+    if (r && r.ok) {
+      return `transcript: stored ${t.turns.length}/${t.turnCount} turns (${Math.round(t.byteSize / 1024)} KB${t.truncated ? ', truncated to the size ceiling' : ''}).`;
+    }
+    return `transcript: skipped (PUT ${r && r.status}${r && r.data && r.data.error ? ' ' + JSON.stringify(r.data.error) : ''}).`;
+  } catch (e) {
+    return `transcript: skipped — ${e && e.message ? e.message : e}`;
+  }
+}
+
+module.exports = { uploadSessionTranscript };

package/scripts/gds/ship-session-upload.js

@@ -13,6 +13,7 @@ const path = require('node:path');
 const { cliClient, loadSession } = require('./cli-lib');
 const { resolveTranscriptPath } = require('./ship-memory-sync.js');
 const { apiErrorLine } = require('./ship-io.js');
+const { uploadSessionTranscript } = require('./session-transcript-upload.js');
 const { REPO_ROOT } = require('./ship-state.js');
 
 // ---------- Session upload-on-ship (6D.1 / ADR 0027) ----------
@@ -268,11 +269,15 @@ async function uploadSessionOnShip(taskId) {
       metrics: digest.metrics,
       model_usage: digest.metrics.model_usage || {}, // per-model tokens → cost-plus reward (task 1005)
     };
-    const r = await (await cliClient({ allowUnauthenticated: true })).sessions.postSessions({ body: payload });
+    const api = await cliClient({ allowUnauthenticated: true });
+    const r = await api.sessions.postSessions({ body: payload });
     if (r.ok) {
       console.log(
         `  session upload: stored digest (${digest.metrics.assistant_turns} assistant turns, ${digest.totalTokens} tokens, ${digest.metrics.tool_error_count} tool errors, ${digest.metrics.harness_retry_count} harness retries).`
       );
+      // ADR 0051: the full scrubbed transcript rides after the digest (the server
+      // creates it from the digest's row). Non-fatal — its outcome is a log line.
+      console.log(`  session upload: ${await uploadSessionTranscript(api, sessionId, entries, extraSecrets)}`);
     } else if (r.status === 401) {
       recordUploadSkip(taskId, {
         code: 'session_invalid',

package/scripts/gds/upgrade-commit-identity.js

@@ -0,0 +1,32 @@
+'use strict';
+
+// scripts/gds/upgrade-commit-identity.js — WHO the pin commit is signed by when the project's
+// git names nobody (task 1004514). Kept out of upgrade.js, which sits at the 1500-line cap.
+//
+// THE BUG. persistPin staged the new pin and ran `git commit`. In a repo with no
+// user.name/user.email — none in the repo, none global for the account the upgrade runs as —
+// git refuses ("Please tell me who you are"), so the move reported success with the pin
+// STAGED but never committed. The next move then read its own leftovers as a dirty tree and
+// spent its one automatic fix (wedge-remedy.js) committing them. Seen live on 2026-10-01: a
+// throwaway hosted project on cloudbongos.com, and hermeslines-marketing, whose repo carries no
+// identity while every scaffolded one does (provision-repo.js sets it at scaffold time).
+//
+// THE FIX IS A FALLBACK, NEVER AN OVERRIDE. A repo or account that names someone keeps
+// signing as them. Only an empty answer gets the provisioner's own identity, the one the
+// scaffold commits as, through git's AUTHOR/COMMITTER env — so nothing is written into the
+// owner's git config, and the argv stays exactly what it was.
+
+/**
+ * Env for `git commit` in `instanceDir`: null when git already names a committer there, else
+ * the provisioner's identity. Asks git itself, so repo, global and system config all count.
+ */
+function commitIdentityEnv(instanceDir, run, env = process.env) {
+  const r = run('git', ['config', 'user.email'], { cwd: instanceDir, encoding: 'utf8' });
+  if (r && !r.error && r.status === 0 && String(r.stdout || '').trim()) return null;
+  if (env.GIT_AUTHOR_EMAIL || env.GIT_COMMITTER_EMAIL) return null;   // the caller already chose
+  const { provisionerBotName, provisionerBotEmail } = require('./instance-apex.js');
+  const name = provisionerBotName(), email = provisionerBotEmail(env);
+  return { ...env, GIT_AUTHOR_NAME: name, GIT_AUTHOR_EMAIL: email, GIT_COMMITTER_NAME: name, GIT_COMMITTER_EMAIL: email };
+}
+
+module.exports = { commitIdentityEnv };

package/scripts/gds/upgrade.js

@@ -352,7 +352,7 @@ function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = tru
     err('  ! could not stage the pin files — commit + push them by hand or the next deploy reverts this bump.');
     return { applicable: true, committed: false, pushed: false, dirty, error: 'git add failed' };
   }
-  const commit = run('git', ['commit', '-m', message], { cwd: instanceDir, encoding: 'utf8' });
+  const idEnv = require('./upgrade-commit-identity').commitIdentityEnv(instanceDir, run), commit = run('git', ['commit', '-m', message], { cwd: instanceDir, encoding: 'utf8', ...(idEnv ? { env: idEnv } : {}) }); // a repo naming nobody still commits (task 1004514)
   if (!commit || commit.error || commit.status !== 0) {
     err('  ! could not commit the pin — commit + push it by hand or the next deploy reverts this bump.');
     return { applicable: true, committed: false, pushed: false, dirty, error: 'git commit failed' };

package/src/bongos/routes.js

@@ -93,6 +93,9 @@ function buildGdsRouter() {
     if (
       req.path === '/memory/sync' ||
       req.path === '/sessions' ||
+      // ADR 0051 / task 1001004: the full-transcript upload (MB-scale), which
+      // mounts its own 16 MB parser in modules/sessions/routes/sessions.js.
+      /^\/sessions\/[A-Za-z0-9_-]+\/transcript$/.test(req.path) ||
       req.path === '/llm-cache/store' ||
       /^\/tasks\/\d+\/publish-branch$/.test(req.path) ||
       // task 1003109: the ship-time task visual — a base64 image up to ~5.3 MB

package/src/branding.js

@@ -94,6 +94,15 @@ const ENV_OVERRIDES = [
   ['NIGHT_TINT', ['project', 'nightTint']],
   ['LOOK_ACCENT', ['project', 'lookAccent']],
   ['LOGO_URL', ['project', 'logoUrl']],
+  // The birth marker (task 1004506): set by the platform only on a project created
+  // through the startup flow, so a project made before that never has it (spec D8).
+  // FOUNDING_BIRTH is when the platform made the row; DEMO_PEOPLE / DEMO_HOURS are the
+  // demo's time box, empty for a real project. The onboarding module reads them once to
+  // start genesis (modules/onboarding/founding-birth.js). SERVER-ONLY: clientBranding
+  // publishes no `founding` block.
+  ['FOUNDING_BIRTH', ['founding', 'birth']],
+  ['DEMO_PEOPLE', ['founding', 'demoPeople']],
+  ['DEMO_HOURS', ['founding', 'demoHours']],
 ];
 
 const isObj = (v) => v && typeof v === 'object' && !Array.isArray(v);

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.82'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.1'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/auto_satisfy_criteria.mjs

@@ -158,6 +158,26 @@ await test('NO-OP: nothing closed means no cascade query at all', async () => {
   assert.equal(exec.calls.length, 1, 'must not run the goal cascade when no criterion moved');
 });
 
+await test('NO-OP (scoped): a ship that flips no criterion still re-asks its OWN goal (task 1004513)', async () => {
+  // When every criterion was satisfied BEFORE the last task shipped, the ship
+  // flips none — and the early return above used to mean nothing re-checked the
+  // goal, which then sat `open` with all its work done (goal 1000119, 2026-10-01).
+  const exec = fakeExec(
+    { rows: [] },
+    { rows: [{ goal_id: 77 }] },
+    { rows: [{ id: 77, title: 'g', version_id: 'BONGOS-V1', status: 'achieved' }] }
+  );
+  const out = await autoSatisfyShippedCriteria(exec, { taskId: 5 });
+  assert.deepEqual(out.criteria, [], 'no criterion moved — ADR 0183 is untouched');
+  assert.deepEqual(out.goals.map((g) => g.id), [77], 'but the goal closes on the ship that finished it');
+  assert.match(exec.calls[1].sql, /SELECT goal_id FROM tasks WHERE id = \$1::bigint/, 'the shipping task names the candidate');
+  assert.deepEqual(exec.calls[1].params, [5]);
+  assert.match(String(exec.calls[2].sql), /UPDATE goals g/, 'and it runs the SAME cascade statement');
+  assert.match(String(exec.calls[2].sql).replace(/\s+/g, ' '), /NOT EXISTS \(SELECT 1 FROM tasks t WHERE t\.goal_id = g\.id/,
+    'carrying R09 — this entry may not be a looser rule than the cascade');
+  assert.deepEqual(exec.calls[2].params, [[77]], 'scoped to that one goal, nothing wider');
+});
+
 await test('CASCADE: only OPEN goals, only with >=1 criterion and zero unsatisfied', async () => {
   const exec = fakeExec({ rows: [CRIT] }, { rows: [] });
   await autoSatisfyShippedCriteria(exec, { taskId: 5 });