@bongos/core 1.21.118 → 1.21.120

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.118",
-  "core_contract": "1.21.118",
-  "source_commit": "dcd72a0708a97d3f7456fa0a81107290b96735e1",
+  "core_version": "1.21.120",
+  "core_contract": "1.21.120",
+  "source_commit": "a0abf3fc6c913d358ffd525f1592603c5ba771b0",
   "source_ref": "HEAD",
-  "built_at": "2026-10-14T10:48:05.194Z",
+  "built_at": "2026-10-14T16:25:27.328Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 605,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3116,
+    "functional_verbatim": 3117,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3750,
-  "tree_sha256": "b11512b16cdfc9e1d2262db9dd14ef853c0e50f162acb1d37d7a5dcde00624af",
+  "file_count": 3751,
+  "tree_sha256": "9223a47c6d78a1edb87bbb0565101cac2b5d3c655b3cc9a703bee7c6116db5be",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2922,7 +2922,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0bca8168d0f2d10c8d83bb1af215cb20c58dd4567d03ae883736a0f41f04599a"
+      "sha256": "72ce941af880f14ccd6a7b1df337934e527a8553d85cbe8b986076bbcf1358cc"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3012,7 +3012,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "03476cabc2dae58cf07f00b17125cfaca03a5de921359c8a6e14e540cb40d2ce"
+      "sha256": "cda2d7936c5a440c9bf7a535d553c316ee41271a7081b283d52d1599f605d052"
     },
     {
       "path": "docs/project-context.template.md",
@@ -8537,7 +8537,7 @@
     {
       "path": "modules/provisioning/github-setup.js",
       "mode": "0000644",
-      "sha256": "78d6aa74315507f0de80b676858fd2c952cdf1e2038b197326bded06b5708170"
+      "sha256": "3de4b170e869c21236d5e5c60f4a0774788dc3022a9879c20dab09a50b210f04"
     },
     {
       "path": "modules/provisioning/look.js",
@@ -8772,7 +8772,7 @@
     {
       "path": "modules/provisioning/pollers/liveness-sweep.js",
       "mode": "0000644",
-      "sha256": "57cf7145af0f4236f6fb6a3a9e9ac7efd39de04f604e4b7498c811df8cf3ec93"
+      "sha256": "2403b4c3da7a401e65f9d97815d6582e17c28dcb5fdc78fc3956906163acb712"
     },
     {
       "path": "modules/provisioning/pollers/runner-drift-notify.js",
@@ -8907,7 +8907,7 @@
     {
       "path": "modules/provisioning/tests/liveness.mjs",
       "mode": "0000644",
-      "sha256": "a0783526eac5ad6394d85f93e9ff709eff7ab588969390303f70763b5c6f9a23"
+      "sha256": "a0889e57bf8f620f678dbd5d39799ae261e6a813586af9206dd87e453b34edba"
     },
     {
       "path": "modules/provisioning/tests/provisioning.mjs",
@@ -9667,7 +9667,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "97b606c1d45295be87adb7165ceb5ab36aca28f89b86a91302ffc212c1053b27"
+      "sha256": "060c9904c6fefb2848819609a61bbb76822c273c601d670500a9e031380120e1"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -10467,12 +10467,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8e4eea79cadc227a61eae2aa188d59b77164d48bb6ced42f3a12fdc0337d3552"
+      "sha256": "acf5cb64360f149851f33d37eb868b75ea6a476b6a26fe8c7fba494d0a530202"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d80da007318c57a326aade4c46f86611e2b4c880238ce41b6687fc0eb16ccb58"
+      "sha256": "0e819e620052f3e27e6088f87839bfa0ac850b3b1992024fd13c5540930cafce"
     },
     {
       "path": "public-docs/index.html",
@@ -10492,7 +10492,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "1d8eee0dd66972332df040258a793f718f61d157d519942957e85269e04413f6"
+      "sha256": "6969dc70a1c0541fcd0a79f7b801d7de58b8a84b96c22e8e36b5524432878219"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11742,7 +11742,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "b57b79a2c32798f7f8f1479b06dd9994ffafdd13e01fd80e7bfa758e02b2d317"
+      "sha256": "d6d81c3bb8017122cb6b5a46355b637f7986ec324132bcd583f0c02d2725b6d0"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -12802,7 +12802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4bd32a9182893767f8c604f943ca6a760dd6907894107bee785f51ae6c39d559"
+      "sha256": "ea34607161a0fbc072ecd805d5e150692df9557f574b6c74ebd53f96ea8ba341"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14482,7 +14482,7 @@
     {
       "path": "tests/github_one_trip.mjs",
       "mode": "0000644",
-      "sha256": "fe4267e980206aa0dfe2180889af1139eb77c7ce0e3f7bfdb60e2a0565314152"
+      "sha256": "55c30dc99188ef3db4a69f61b048e5d9f65b0a62bfe2236e17b61fd1076137ee"
     },
     {
       "path": "tests/github_org_account.mjs",
@@ -14524,6 +14524,11 @@
       "mode": "0000644",
       "sha256": "d0c12aab13423b92d3b1d1199ac75950da769f56d361853f4ab2f3eda98e6620"
     },
+    {
+      "path": "tests/github_sign_in_seen.mjs",
+      "mode": "0000644",
+      "sha256": "7a337ab8268947ad705872d341e1d1d95df70fed342e4ecb1df82ff3ef0044c2"
+    },
     {
       "path": "tests/github_token_session_life.mjs",
       "mode": "0000644",
@@ -15632,7 +15637,7 @@
     {
       "path": "tests/hub_profile_leak.mjs",
       "mode": "0000644",
-      "sha256": "e9609a8adad0c460c24db69211f02beef3699e3e841d44c1385105c4f5c93385"
+      "sha256": "298afa1c71a485c3c64d90a3976c1a7147f1e888a9362a84502d5a9a94611d56"
     },
     {
       "path": "tests/hub_recent_ships.mjs",
@@ -17832,7 +17837,7 @@
     {
       "path": "tests/setup_status_facts.mjs",
       "mode": "0000644",
-      "sha256": "8a82be51e797e64e1525fa703b88a2fd0af00125565027d54085a45b2a279cd0"
+      "sha256": "3ef47e51d12d3cfc49d4da87145d9bb29e213e51cf77e0a0c5ecbf424e3b5a37"
     },
     {
       "path": "tests/shell_stat_portability.mjs",

package/docs/module-api-changelog.md

@@ -3073,5 +3073,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.116 with no explicit bump. run 38548762428. (task 1002620)
   1.21.118 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.117 with no explicit bump. run 38552002742. (task 1002620)
+  1.21.119 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.118 with no explicit bump. run 38574092141. (task 1002620)
+  1.21.120 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.119 with no explicit bump. run 38597828843. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -5129,7 +5129,7 @@
       "surface": "landing",
       "title": "{{productName}} — projects",
       "states_read": ["out-map","in-map","in-map-projects","in-map-profile","in-map-kbd","in-map-search","in-map-mine-on","in-table","in-table-by-builders","in-mine","in-manage","in-manage-address","in-manage-planet","in-manage-card","in-manage-look","in-manage-kind","in-manage-invite","in-manage-invite-handoff","in-manage-invite-guild","in-manage-app-live","in-manage-app-building","in-manage-app-failed","in-manage-app-retry","in-manage-app-offer","in-manage-app-connect","in-manage-snag","in-manage-gone","in-manage-missing","out-manage","in-new","in-new-named","in-new-ready","in-new-name-prefilled","in-new-demo","in-new-demo-used","in-new-checks-filled","in-new-checks-entity","in-new-row-code","in-new-row-address","in-new-row-team","in-new-row-extras","in-new-row-rewards","in-new-row-app","in-new-row-run","in-new-row-ship","in-new-look","in-new-look-custom","in-new-create-blocked","in-new-done","in-new-resume-offer","out-new","out-map-projects","card","card-noart","card-self","in-manage-demo","in-mine-dns-pending","in-manage-dns-pending","in-mine-empty","card-floor","card-backdrop","in-new-done-live","setup-just-created","setup-waiting-on-github","setup-installing","setup-stopped","setup-all-done","setup-cloud-hop-open"],
-      "files_hash": "7cf86c7f93b39749",
+      "files_hash": "82d94c8932993dbd",
       "reading_hash": "302909900601b80c",
       "counts": {"lines":825,"placed":246,"shared":21,"unplaced":558},
       "omitted": {"data":150},

package/modules/provisioning/github-setup.js

@@ -19,7 +19,11 @@
 //              docs warn it can be spoofed, so that redirect only records that the founder
 //              SAYS they installed it ('github-app-install-reported'), which makes the
 //              runner look again.
-//   sign_in  — the runner saw the project report auth_configured (the manifest row 'done').
+//   sign_in  — the runner saw the project report auth_configured (the manifest row 'done'),
+//              OR the liveness sweep did ('github-sign-in-seen', task 1004410). The second
+//              is what keeps the step honest when sign-in was wired some other way (a manual
+//              OAuth app, or a GitHub tab that never came back): the project's own answer
+//              is the fact the step names, so it ticks whatever the attempt row says.
 //   device   — the runner started a device-flow sign-in with the app's client id and GitHub
 //              did not refuse it with device_flow_disabled ('github-app-device-flow').
 //              GitHub offers no manifest field and no API to switch device flow on (the
@@ -43,6 +47,9 @@ const SETUP_EVENTS = Object.freeze({
   // the founder pressed "Pick up where it stopped" or "Check again" (task 1004652). Like an
   // install report it re-opens the runner's checking window; it claims nothing itself.
   checkRequested: 'github-app-check-requested',
+  // the liveness sweep saw the project's own /healthz answer auth_configured: true (task
+  // 1004410). Recorded once per attempt (recordSignInSeen); no detail.
+  signInSeen: 'github-sign-in-seen',
 });
 
 const { effectiveManifestStatus } = require('./manifest-truth');
@@ -99,7 +106,7 @@ async function githubSetupFacts(db, instanceId, since) {
   const org = find(SETUP_EVENTS.appOrg);
   return {
     installReportedAt: at(SETUP_EVENTS.installReported), installedAt: at(SETUP_EVENTS.installed), deviceFlowAt: at(SETUP_EVENTS.deviceFlow),
-    checkRequestedAt: at(SETUP_EVENTS.checkRequested),
+    checkRequestedAt: at(SETUP_EVENTS.checkRequested), signInSeenAt: at(SETUP_EVENTS.signInSeen),
     appOrg: org && validGithubLogin(org.detail) ? org.detail : null,
   };
 }
@@ -108,22 +115,42 @@ async function githubSetupFacts(db, instanceId, since) {
 // vocabulary) + the facts above. A closed vocabulary the page turns into words:
 //   'done' · 'now' (waiting on GitHub, the founder or the platform) · 'todo' (not reached)
 //   · 'stopped' (this attempt failed at this step) · 'later' (device flow only: optional, off).
+// A project that answers sign-in works with no app of ours recorded was wired some other
+// way: approve and install name steps it never needed, so they read done and
+// `wired_elsewhere` says why (task 1004410). With an app recorded, they keep their own facts.
 // PURE.
 function githubChecklist(status, appSlug, facts = {}) {
   const s = String(status || '');
   const inFlight = s === 'pending' || s === 'code_received' || s === 'converting';
   const failed = s === 'error' || s === 'expired';
-  const approve = appSlug ? 'done' : inFlight ? 'now' : failed ? 'stopped' : 'todo';
-  const install = facts.installedAt ? 'done' : appSlug ? 'now' : 'todo';
-  const signIn = s === 'done' ? 'done' : appSlug && failed ? 'stopped' : appSlug ? 'now' : 'todo';
+  const seen = !!facts.signInSeenAt;
+  const elsewhere = seen && !appSlug;
+  const approve = appSlug || elsewhere ? 'done' : inFlight ? 'now' : failed ? 'stopped' : 'todo';
+  const install = facts.installedAt || elsewhere ? 'done' : appSlug ? 'now' : 'todo';
+  const signIn = s === 'done' || seen ? 'done' : appSlug && failed ? 'stopped' : appSlug ? 'now' : 'todo';
   const device = facts.deviceFlowAt ? 'done' : s === 'done' ? 'later' : 'todo';
   return {
     approve, install, sign_in: signIn, device_flow: device,
     // what "is alive" waits for — device flow is optional by design
     connected: approve === 'done' && install === 'done' && signIn === 'done',
+    wired_elsewhere: elsewhere,
   };
 }
 
+// The liveness sweep saw this project answer auth_configured: true (task 1004410). One row
+// per attempt: nothing is written when one already stands since the latest attempt began
+// (or ever, for a project with no attempt), so a five-minute sweep never grows the ledger.
+async function recordSignInSeen(db, instanceId) {
+  await db.query(
+    `INSERT INTO provisioning_events (instance_id, event, actor)
+     SELECT $1, $2, 'liveness'
+      WHERE NOT EXISTS (
+        SELECT 1 FROM provisioning_events e
+         WHERE e.instance_id = $1 AND e.event = $2
+           AND e.created_at >= COALESCE((SELECT max(m.created_at) FROM provisioning_oauth_manifests m WHERE m.instance_id = $1), 'epoch'::timestamptz))`,
+    [instanceId, SETUP_EVENTS.signInSeen]);
+}
+
 // Is the runner still checking this attempt? While it is, an install or a 'later'
 // device-flow step can still tick itself, so the page keeps polling. PURE.
 function stillVerifying(row, facts = {}, now = Date.now()) {
@@ -147,6 +174,8 @@ function stillVerifying(row, facts = {}, now = Date.now()) {
 // PURE.
 function pickUpFor(row, status, checklist, verifying, now = Date.now()) {
   if (!row) return null;
+  // sign-in works without our app (task 1004410): there is nothing left to pick up
+  if (checklist && checklist.wired_elsewhere) return null;
   if (status === 'pending') return 'reopen';
   if (status === 'expired') return 'fresh';
   if (row.app_slug || row.app_id) {
@@ -195,8 +224,12 @@ async function requeueConversion(db, id) {
 // lands on the setup page, which sends the founder back to their projects.
 // A failed facts read is "nothing verified yet" — the honest 'now' states, never a 500.
 async function githubSetupRead(db, inst, row, status, { now = Date.now(), withState = true } = {}) {
-  if (!row) return { checklist: githubChecklist(null, null), install_url: null, repo: targetRepo(inst), verifying: false, app_org: null, pick_up: null };
   let facts = {};
+  if (!row) {
+    // no attempt: only the project's own answer can tick anything (task 1004410)
+    try { facts = (inst && inst.id != null) ? await module.exports.githubSetupFacts(db, inst.id, null) : {}; } catch (_) { facts = {}; }
+    return { checklist: githubChecklist(null, null, facts), install_url: null, repo: targetRepo(inst), verifying: false, app_org: null, pick_up: null };
+  }
   // through module.exports so a route test can stub the one DB read on the cached module
   try { facts = await module.exports.githubSetupFacts(db, row.instance_id, row.created_at); } catch (_) { facts = {}; }
   const checklist = githubChecklist(status, row.app_slug, facts);
@@ -216,5 +249,5 @@ async function githubSetupRead(db, inst, row, status, { now = Date.now(), withSt
 
 module.exports = {
   SETUP_EVENTS, VERIFY_WINDOW_MS, installUrlFor, targetRepo, githubSetupFacts, githubChecklist, stillVerifying, githubSetupRead,
-  validGithubLogin, pickUpFor, mintGuard, requeueConversion,
+  validGithubLogin, pickUpFor, mintGuard, requeueConversion, recordSignInSeen,
 };

package/modules/provisioning/pollers/liveness-sweep.js

@@ -27,6 +27,7 @@ const dns = require('node:dns').promises;
 const { Agent: UndiciAgent } = require('undici');
 const api = require('../../../src/module-api');
 const provisioning = require('../provisioning');
+const githubSetup = require('../github-setup');
 const { planNotices, postNotice } = require('./liveness-notify');
 // task 1004000: the runner-drift check rides this tick rather than installing a timer of
 // its own — the sweep already runs every ~5 min on the one host that can see the systemd
@@ -163,8 +164,35 @@ function probeReason(err) {
   return err.message ? String(err.message).slice(0, 40) : 'error';
 }
 
+// The /healthz answer is tiny; read no more than this of a body a builder's host chose.
+const BODY_CAP_BYTES = 4096;
+
+// Did the answer say auth_configured: true (task 1004410)? Reads at most BODY_CAP_BYTES
+// and answers false for anything else — a big, slow or non-JSON body is never "configured".
+async function readAuthConfigured(res) {
+  try {
+    if (!res.body || typeof res.body.getReader !== 'function') {
+      return typeof res.json === 'function' ? (await res.json()).auth_configured === true : false;
+    }
+    const reader = res.body.getReader();
+    const chunks = [];
+    let size = 0;
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.length;
+      if (size > BODY_CAP_BYTES) { reader.cancel().catch(() => {}); return false; }
+      chunks.push(Buffer.from(value));
+    }
+    return JSON.parse(Buffer.concat(chunks).toString('utf8')).auth_configured === true;
+  } catch (_) {
+    return false;
+  }
+}
+
 // Knock once. Any 2xx = up; everything else (non-2xx, refused, DNS, TLS, timeout)
-// = down with a reason. Never throws — a probe result is the whole point.
+// = down with a reason. Never throws — a probe result is the whole point. An up answer
+// also carries whether the project says its sign-in is configured (task 1004410).
 async function probeHealthz(url, { timeoutMs = PROBE_TIMEOUT_MS, fetchImpl, pin } = {}) {
   const doFetch = fetchImpl || globalThis.fetch;
   const dispatcher = pin && !fetchImpl ? pinnedDispatcher(pin, timeoutMs) : null;
@@ -178,7 +206,7 @@ async function probeHealthz(url, { timeoutMs = PROBE_TIMEOUT_MS, fetchImpl, pin
       headers: { accept: 'application/json, text/plain;q=0.9, */*;q=0.8' },
       ...(dispatcher ? { dispatcher } : {}),
     });
-    if (res.status >= 200 && res.status < 300) return { up: true };
+    if (res.status >= 200 && res.status < 300) return { up: true, authConfigured: await readAuthConfigured(res) };
     return { up: false, reason: `http ${res.status}` };
   } catch (e) {
     return { up: false, reason: probeReason(e) };
@@ -229,6 +257,10 @@ async function sweepOnce(deps = {}) {
     if (row.domain && !row.dns_resolved_at && (pin || probe.up)) {
       await provisioning.recordDnsResolved(db, row.id).catch((e) => log(`[liveness] dns record failed (non-blocking): ${e && e.message ? e.message : e}`));
     }
+    // The project's own word that sign-in works ticks its setup checklist (task 1004410).
+    if (probe.up && probe.authConfigured) {
+      await githubSetup.recordSignInSeen(db, row.id).catch((e) => log(`[liveness] sign-in record failed (non-blocking): ${e && e.message ? e.message : e}`));
+    }
     return { row, probed: true, prevUp: rec ? rec.prev_up : null, ...probe };
   }));
 

package/modules/provisioning/tests/liveness.mjs

@@ -330,7 +330,7 @@ await ta('the pin is load-bearing on the REAL client: same URL, the pinned addre
   try {
     // 'pinned.invalid' resolves nowhere; only the pin can make this connect.
     const hit = await liveness.probeHealthz(url, { timeoutMs: 3000, pin: { address: '127.0.0.1', family: 4 } });
-    assert.deepEqual(hit, { up: true }, 'the pinned address is what gets connected');
+    assert.deepEqual(hit, { up: true, authConfigured: false }, 'the pinned address is what gets connected');
     const miss = await liveness.probeHealthz(url, { timeoutMs: 3000, pin: { address: '127.0.0.2', family: 4 } });
     assert.equal(miss.up, false, 'a different pin cannot reach the same server — the pin, not DNS, decides');
   } finally {

package/modules/public-landing/public/projects.html

@@ -6987,7 +6987,11 @@ summary{min-height:24px;padding:3px 0;}
          including when a LATER step stopped (sign-in unconfirmed) */
       var appMade = (ghStep('approve') === 'done' || live.appSlug) && live.manifest !== 'expired' &&
         (live.manifest !== 'error' || live.manifestFailure === 'sign_in_unconfirmed');
-      if (appMade) { approve.state = 'done'; approve.sub = name + ' app on ' + (appOrgLogin() || 'your account'); }
+      /* sign-in works with no app of ours: it was wired another way, and the project's own
+         answer is the fact (task 1004410) — never "waiting on GitHub" for a step it skipped */
+      var elsewhere = !!ghStep('wired_elsewhere');
+      if (elsewhere) { approve.state = 'done'; approve.sub = 'Not needed. Sign-in was set up another way.'; }
+      else if (appMade) { approve.state = 'done'; approve.sub = name + ' app on ' + (appOrgLogin() || 'your account'); }
       else if (!dom) { approve.state = 'todo'; approve.sub = 'Opens once it has an address.'; }
       /* GitHub refuses app manifests whose hook URL it cannot reach (owner walk, 2026-08-12) */
       else if (!apexBase()) { approve.state = 'todo'; approve.sub = 'GitHub can’t reach a platform on a local address, so this works only on a public one.'; }
@@ -7010,7 +7014,8 @@ summary{min-height:24px;padding:3px 0;}
 
       var install = { key: 'install', title: 'Install it on your repo', sub: repo || '' };
       var installUrl = live.installUrl || (live.appSlug ? 'https://github.com/apps/' + encodeURIComponent(live.appSlug) + '/installations/new' : null);
-      if (ghStep('install') === 'done') install.state = 'done';
+      if (elsewhere) { install.state = 'done'; install.sub = 'Not needed. Sign-in was set up another way.'; }
+      else if (ghStep('install') === 'done') install.state = 'done';
       else if (!live.appSlug) install.state = 'todo';
       /* the runner stopped checking and GitHub never confirmed the install: the link opens the
          SAME app's install page, and the click asks the runner to look again */

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.118",
+  "version": "1.21.120",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.118",
+      "version": "1.21.120",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.118",
+  "version": "1.21.120",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9690,5 +9690,17 @@
       "id": "1004729",
       "text": "Hosted projects now take released core updates on their own, one at a time, by each project's update rule (pinned projects never move), with a platform-wide off switch."
     }
+  ],
+  "1.21.119": [
+    {
+      "id": "1004664",
+      "text": "A profile privacy test that had been switched off because it failed on a fresh database is fixed and switched back on, so it guards the public profile page again."
+    }
+  ],
+  "1.21.120": [
+    {
+      "id": "1004410",
+      "text": "The new-project page no longer says GitHub sign-in is unfinished when it already works: the platform now checks the project itself and ticks the step."
+    }
   ]
 }

package/scripts/gds/run-unit-tests.js

@@ -465,7 +465,7 @@ const INTEGRATION_PARKED = new Set([
   'bfg', 'bfg_write',
   'claim_gate_open_blocker', 'claim_gate_rebase',
   'clawback_confirmed_backlog', 'copy_desk_flags_db',
-  'government_board_membership_db', 'handle_machinery', 'hub_profile_leak',
+  'government_board_membership_db', 'handle_machinery',
   'idea_credit_streams_db', 'memory_isolation', 'memory_pull', 'needs_rebase',
   'profile_fields', 'project_visibility_db', 'reward_mode_cost_plus_only',
   'session_earnings_mirror_db', 'setup_smoke', 'status-probe',

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.118'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.120'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/github_one_trip.mjs

@@ -35,7 +35,7 @@ const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>
 
 test('each step reads only what the server has seen — the honest "not yet" states included', () => {
   const none = GS.githubChecklist(null, null);
-  assert.deepEqual(none, { approve: 'todo', install: 'todo', sign_in: 'todo', device_flow: 'todo', connected: false }, 'never started');
+  assert.deepEqual(none, { approve: 'todo', install: 'todo', sign_in: 'todo', device_flow: 'todo', connected: false, wired_elsewhere: false }, 'never started');
   assert.equal(GS.githubChecklist('pending', null).approve, 'now', 'waiting for the approval on GitHub');
   for (const s of ['code_received', 'converting']) {
     const c = GS.githubChecklist(s, null);

package/tests/github_sign_in_seen.mjs

@@ -0,0 +1,148 @@
+// tests/github_sign_in_seen.mjs — the project's own "sign-in works" ticks its setup
+// checklist (task 1004410, from a Discord #bugs report: "says that github wiring is not done.
+// When in reality i did make it and was able to sign in via github to my account").
+//
+// Sign-in used to tick only from the one-click GitHub attempt reaching 'done', so a project
+// whose sign-in was wired some other way — a hand-made OAuth app, or a GitHub tab that never
+// came back — sat at "Waiting on GitHub" for good. Now the liveness sweep reads the project's
+// /healthz answer, records 'github-sign-in-seen' once per attempt, and githubChecklist reads it.
+// The page half (what the founder sees) is tests/setup_status_facts.mjs §6.
+//
+// Pinned here, DB-free over recording fakes and real loopback servers:
+//   * githubChecklist: the fact ticks sign-in; with no app of ours it is wired_elsewhere and
+//     connected; with one, the install keeps its own fact;
+//   * pickUpFor offers nothing to pick up once sign-in works elsewhere;
+//   * githubSetupRead reads the fact even when no attempt exists;
+//   * recordSignInSeen writes at most one row per attempt;
+//   * probeHealthz reports auth_configured only from a small JSON answer saying true;
+//   * sweepOnce records the fact only for an up project that says so.
+//
+// Run:  node --test tests/github_sign_in_seen.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const gs = require(path.join(ROOT, 'modules', 'provisioning', 'github-setup.js'));
+const liveness = require(path.join(ROOT, 'modules', 'provisioning', 'pollers', 'liveness-sweep.js'));
+
+const SEEN = { signInSeenAt: '2026-10-14T10:00:00.000Z' };
+
+// ── the checklist ──────────────────────────────────────────────────────────────────────
+test('the project saying sign-in works ticks sign-in, whatever the attempt row says', () => {
+  for (const status of [null, 'pending', 'expired', 'error', 'code_received']) {
+    const c = gs.githubChecklist(status, null, SEEN);
+    assert.equal(c.sign_in, 'done', `${status}: sign-in is the project's own answer`);
+    assert.equal(c.wired_elsewhere, true, `${status}: no app of ours, so it was wired another way`);
+    assert.equal(c.approve, 'done');
+    assert.equal(c.install, 'done');
+    assert.equal(c.connected, true, `${status}: the project is not held back`);
+  }
+});
+
+test('without that answer, nothing changes: a pending attempt still waits on GitHub', () => {
+  const c = gs.githubChecklist('pending', null, {});
+  assert.deepEqual(c, { approve: 'now', install: 'todo', sign_in: 'todo', device_flow: 'todo', connected: false, wired_elsewhere: false });
+});
+
+test('with our app recorded, the answer ticks sign-in and the install keeps its own fact', () => {
+  const c = gs.githubChecklist('converting', 'kestrel-cloudbongos-com', SEEN);
+  assert.equal(c.sign_in, 'done');
+  assert.equal(c.install, 'now', 'the install is still GitHub\'s to confirm');
+  assert.equal(c.wired_elsewhere, false);
+  assert.equal(c.connected, false);
+  assert.equal(gs.githubChecklist('done', 'k', { ...SEEN, installedAt: SEEN.signInSeenAt }).connected, true);
+});
+
+test('nothing to pick up once sign-in works another way', () => {
+  const now = Date.now();
+  for (const [status, row] of [['pending', { state: 'S', attempts: 0 }], ['expired', { attempts: 0 }], ['error', { attempts: 2, created_at: new Date(now).toISOString(), github_code: 'c' }]]) {
+    const checklist = gs.githubChecklist(status, null, SEEN);
+    assert.equal(gs.pickUpFor(row, status, checklist, false, now), null, `${status}: no Reopen, Start fresh or Convert`);
+  }
+  // and the old answers stand when it does not
+  assert.equal(gs.pickUpFor({ state: 'S' }, 'pending', gs.githubChecklist('pending', null, {}), false, now), 'reopen');
+});
+
+// ── the read ───────────────────────────────────────────────────────────────────────────
+test('githubSetupRead reads the fact for a project with no attempt at all', async () => {
+  const seen = [];
+  const pool = {
+    query: async (sql, params) => {
+      seen.push(params);
+      assert.match(sql, /FROM provisioning_events/);
+      return { rows: params[1].includes('github-sign-in-seen') ? [{ event: 'github-sign-in-seen', at: SEEN.signInSeenAt, detail: null }] : [] };
+    },
+  };
+  const r = await gs.githubSetupRead(pool, { id: 42, target_ref: 'you/kestrel' }, null, null);
+  assert.equal(seen[0][0], 42, 'read by the project\'s own id');
+  assert.equal(r.checklist.connected, true);
+  assert.equal(r.checklist.wired_elsewhere, true);
+  assert.equal(r.pick_up, null);
+  // a failed read is "nothing verified yet", never a 500
+  const broken = await gs.githubSetupRead({ query: async () => { throw new Error('db down'); } }, { id: 42 }, null, null);
+  assert.equal(broken.checklist.sign_in, 'todo');
+});
+
+test('recordSignInSeen writes at most one row per attempt, from the liveness sweep', async () => {
+  let sql = '', params = null;
+  await gs.recordSignInSeen({ query: async (s, p) => { sql = s; params = p; return { rows: [] }; } }, 42);
+  assert.deepEqual(params, [42, 'github-sign-in-seen']);
+  assert.match(sql, /INSERT INTO provisioning_events/);
+  assert.match(sql, /WHERE NOT EXISTS/, 'a five-minute sweep never grows the ledger');
+  assert.match(sql, /max\(m\.created_at\) FROM provisioning_oauth_manifests m WHERE m\.instance_id = \$1/, 'once per attempt, so a fresh attempt is seen afresh');
+  assert.match(sql, /'liveness'/);
+});
+
+// ── the probe and the sweep ────────────────────────────────────────────────────────────
+function serve(body, type = 'application/json') {
+  const server = http.createServer((req, res) => { res.writeHead(200, { 'content-type': type }); res.end(body); });
+  return new Promise((r) => server.listen(0, '127.0.0.1', () => r(server)));
+}
+function close(server) { if (server.closeAllConnections) server.closeAllConnections(); server.close(); }
+
+test('probeHealthz says auth_configured only from a small JSON answer saying true', async () => {
+  const cases = [
+    ['{"ok":true,"auth_configured":true}', true],
+    ['{"ok":true,"auth_configured":false}', false],
+    ['{"ok":true}', false],
+    ['{"ok":true,"auth_configured":"true"}', false],
+    ['ok', false],
+    [JSON.stringify({ ok: true, auth_configured: true, pad: 'x'.repeat(8000) }), false],
+  ];
+  for (const [body, want] of cases) {
+    const s = await serve(body);
+    try {
+      const r = await liveness.probeHealthz(`http://127.0.0.1:${s.address().port}/healthz`, { timeoutMs: 3000 });
+      assert.equal(r.up, true, 'any 2xx is still up');
+      assert.equal(r.authConfigured, want, body.slice(0, 50));
+    } finally { close(s); }
+  }
+});
+
+test('the sweep records the fact for an up project that says so, and for no other', async () => {
+  const yes = await serve('{"ok":true,"auth_configured":true}');
+  const no = await serve('{"ok":true,"auth_configured":false}');
+  const inserts = [];
+  const db = {
+    query: async (sql, params) => {
+      if (/FROM provisioning_instances/.test(sql) && /WHERE status = 'active'/.test(sql)) {
+        return { rows: [{ id: 1, slug: 'kestrel', domain: null, port: yes.address().port }, { id: 2, slug: 'tern', domain: null, port: no.address().port }] };
+      }
+      if (/^UPDATE provisioning_instances/.test(sql)) return { rows: [{ id: params[0], prev_up: true }] };
+      if (/INSERT INTO provisioning_events/.test(sql)) { inserts.push(params); return { rows: [] }; }
+      throw new Error(`unexpected SQL: ${sql}`);
+    },
+  };
+  try {
+    liveness.resetNoticeState();
+    const out = await liveness.sweepOnce({ pool: db, log: () => {}, timeoutMs: 3000, notify: () => {}, collectRunnerDrift: async () => [] });
+    assert.equal(out.up, 2);
+    assert.deepEqual(inserts, [[1, 'github-sign-in-seen']]);
+  } finally { close(yes); close(no); }
+});

package/tests/hub_profile_leak.mjs

@@ -68,7 +68,8 @@ const SECRET_HASH = 'HASH-DO-NOT-LEAK-p05';
 const SECRET_PROJECT = 'P05-PRIVATE-DO-NOT-LEAK';
 const SECRET_PREV = 'p05-prev-sentinel';
 const PUB_ORIGIN = 'https://p05-pub.example', PRIV_ORIGIN = 'https://p05-priv.example';
-const CP_KEYS = ['totals', 'disciplines', 'last_active', 'projects', 'more_projects'];
+// crafts: each craft's own summed numbers (task 1004440), named or not like the totals.
+const CP_KEYS = ['totals', 'disciplines', 'crafts', 'last_active', 'projects', 'more_projects'];
 const ACCOUNT_KEYS = ['handle', 'github_login', 'display_name', 'avatar_url', 'member_since', 'bio', 'links'];
 
 const q = (sql, params) => pool.query(sql, params);
@@ -128,6 +129,16 @@ try {
   // 42703 "column does not exist" instead of a 404-vs-200 assertion.
   await q(migrationSql('platform_identity_012_account_privacy.sql'));
   await q(migrationSql('platform_identity_019_terms_acceptance.sql'));
+  // getRollupForBuilder reads four more (task 1004664 — this file failed 3 of 7 on a FRESH
+  // database: every check that reaches the rollup answered 42703, while an old shared
+  // database that already had the columns hid it). It names a project only when it is ON
+  // THE MAP (projects-feed.js onMapSql: status, the publish gate's description, a known
+  // door) AND its door is public — 011 + 020 — and serializes a.recent_ships (012) and
+  // a.crafts (029).
+  await q(migrationSql('platform_identity_011_project_visibility.sql'));
+  await q(migrationSql('platform_identity_012_recent_ships.sql'));
+  await q(migrationSql('platform_identity_020_visibility_pull.sql'));
+  await q(migrationSql('platform_identity_029_activity_crafts.sql'));
   await cleanup();
 
   // The active account carries the P02 fields + a user-set name source, so the
@@ -150,9 +161,13 @@ try {
      VALUES ($1, $3, 'P05 Pub Proj', $4), ($2, $3, $5, $6)`,
     [SECRET_CLIENT_PUB, SECRET_CLIENT_PRIV, SECRET_HASH, PUB_ORIGIN, SECRET_PROJECT, PRIV_ORIGIN],
   );
+  // Both projects are on the map — active, described, door known — so the ONLY thing that
+  // keeps the second one unnamed is its private door. A fixture that left out the
+  // description would pass the "never named" check for the wrong reason (unpublishable).
   await q(
-    `INSERT INTO platform_identity_projects (origin, name, featured, status)
-     VALUES ($1, 'P05 Pub Proj', true, 'active'), ($2, $3, false, 'active')`,
+    `INSERT INTO platform_identity_projects (origin, name, featured, status, description, visibility, visibility_source)
+     VALUES ($1, 'P05 Pub Proj', true, 'active', 'A public P05 project.', 'public', 'control-plane'),
+            ($2, $3, false, 'active', 'A private P05 project.', 'private', 'control-plane')`,
     [PUB_ORIGIN, PRIV_ORIGIN, SECRET_PROJECT],
   );
   await q(
@@ -180,7 +195,7 @@ try {
     assert.equal(r.json.cross_project.totals.projects, 2, 'both projects count');
     assert.equal(r.json.cross_project.projects.length, 1, 'only the publicly listed project is named');
     assert.equal(r.json.cross_project.projects[0].name, 'P05 Pub Proj');
-    assert.deepEqual(Object.keys(r.json.cross_project.projects[0]).sort(), ['name', 'origin', 'rank_held'].sort());
+    assert.deepEqual(Object.keys(r.json.cross_project.projects[0]).sort(), ['name', 'origin', 'rank_held', 'recent_ships'].sort());
     assert.equal(r.json.cross_project.more_projects, 1, 'the non-public project is counted, never named');
     assert.equal(r.json.account.bio, 'Builds things.', 'bio serializes (P02)');
     assert.deepEqual(r.json.account.links, { website: 'https://p05.example/' }, 'links serialize (P02)');

package/tests/setup_status_facts.mjs

@@ -398,3 +398,36 @@ test('part 03 names its own classes: the map table already owns .facts / .fact',
   assert.match(PANEL, /<div class="setFacts" id="homeFacts"/);
   assert.match(FACTS, /textNode\('div', 'setFact ' \+ r\.state\)/);
 });
+
+// ── 6. sign-in set up another way (task 1004410) ───────────────────────────────────────
+// A founder whose project already answers "sign-in works" was told "Waiting on GitHub" for
+// good: the step ticked only from the one-click attempt. The liveness sweep now records the
+// project's own answer ('github-sign-in-seen'), and that fact is what the step names.
+const seen = { event: 'github-sign-in-seen', at: ago(2), detail: null };
+const elsewhereCases = {
+  'a GitHub tab that never came back': attempt({ status: 'pending', attempts: 0, created_at: ago(1), expires_at: soon(29) }),
+  'a GitHub link that lapsed': attempt({ status: 'pending', attempts: 0, created_at: ago(90), expires_at: ago(30) }),
+  'no attempt at all (a hand-made OAuth app)': null,
+};
+for (const [label, manifest] of Object.entries(elsewhereCases)) {
+  test(`sign-in that works is never "waiting on GitHub": ${label}`, async () => {
+    db = JSON.parse(JSON.stringify({ inst: inst(), intent: null, manifest, events: [seen] }));
+    const v = (await page()).read();
+    assert.deepEqual(v.byKey, { address: 'done', server: 'done', answers: 'done', approve: 'done', install: 'done', sign_in: 'done', device_flow: 'todo' });
+    assert.equal(v.count, 'ready ✓');
+    assert.equal(v.said, 'Kestrel is ready. Command-line sign-in is optional; it ticks itself whenever you turn it on.');
+    const approve = v.facts.find((f) => f.key === 'approve');
+    assert.equal(approve.sub, 'Not needed. Sign-in was set up another way.', 'says why a step it skipped is done');
+    assert.deepEqual(approve.acts, [], 'no Connect, Reopen or Pick up for a step that is not needed');
+    assert.equal(v.aliveHidden, false, 'the project is alive');
+  });
+}
+
+test('with our app recorded, the project\'s answer ticks sign-in and leaves the install its own fact', async () => {
+  db = JSON.parse(JSON.stringify({ inst: inst(), intent: null, manifest: attempt({ status: 'converting', app_id: 5, app_slug: 'kestrel-cloudbongos-com', updated_at: ago(1) }), events: [seen] }));
+  const v = (await page()).read();
+  assert.equal(v.byKey.approve, 'done');
+  assert.equal(v.byKey.sign_in, 'done');
+  assert.equal(v.byKey.install, 'you', 'the install is still GitHub\'s to confirm');
+  assert.notEqual(v.facts.find((f) => f.key === 'approve').sub, 'Not needed. Sign-in was set up another way.');
+});