@bongos/core 1.21.125 → 1.21.126

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.125",
-  "core_contract": "1.21.125",
-  "source_commit": "6537f85e10dcb60107037c138237fe4e5d855500",
+  "core_version": "1.21.126",
+  "core_contract": "1.21.126",
+  "source_commit": "94a48727259da5ad6269d8e1982648c5a263116b",
   "source_ref": "HEAD",
-  "built_at": "2026-10-15T15:06:45.205Z",
+  "built_at": "2026-10-15T15:32:06.327Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 605,
+    "docs_redacted": 606,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3128,
+    "functional_verbatim": 3133,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3762,
-  "tree_sha256": "7fb72ed794b2cdaa7f0fe66ffdccb7b56f5c18a9d4d66f18b4767254072e1827",
+  "file_count": 3768,
+  "tree_sha256": "aaa23a52f299e82601309b1dc11007fe842e9686674c9c5cc96991f5412286e3",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2382,7 +2382,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "b8d8cae75596996b38203b5b73b8fc4f5cfc4afa8fa6a170541131fdfed924ea"
+      "sha256": "cd89b6776167172503ef68a77b1cfa68a00bf886d8f586c456f67e3cfef84fba"
     },
     {
       "path": "docs/architecture.md",
@@ -2407,12 +2407,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "2f6c0fff979e7a52a1dff20184291da110751084197f9619497bc5a8668c2c0f"
+      "sha256": "24ace5710d2fd5823ec9f1c030570e53b48ccdff5b356b193e5d055fe9209d9f"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "2fa52a4d4411a29e5aadeb0a03898a32144834527c7e84804f4c9df5f584cab6"
+      "sha256": "d1bf2d46cc50c80729a6b705eef2313753ea48b56eed76bb365b8bda635ca68f"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2922,7 +2922,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a1ec4ace0bc91b34031c59bb4fd08263af542f5ddd1284204bfd821cf843b527"
+      "sha256": "8b70cfa6cac3da1e08d0f969f6d2a3f0c43ca0533b28d7e8a58ca12044165c26"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3007,12 +3007,12 @@
     {
       "path": "docs/page-inventory.json",
       "mode": "0000644",
-      "sha256": "b9608b2d132b5fff25d2d7baac59e2d25b565414a63fba1372a436e328d302cd"
+      "sha256": "688c15d7b79c60a561be7fca61931627898d1544d52dd912a79ff3fa6c160876"
     },
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "d59a98a2c166e276275156dfb13887c9147f1596ca65fb777c97e988dd23bf25"
+      "sha256": "2ade456b9e5e4e51e4c4e541f3336360d694022bd43b6ea5da77ae63367bd809"
     },
     {
       "path": "docs/project-context.template.md",
@@ -5917,12 +5917,12 @@
     {
       "path": "modules/hall-ui/public/goal-forest-lib.js",
       "mode": "0000644",
-      "sha256": "f4eef6f9ec782aa76369b98cbbd95152ab0e11858a4bb9d2c2f9839a1d71a08c"
+      "sha256": "84ea32523a9bc1fdd34e00cd28f75b52189d18bd72491739dafd2b08b40be39e"
     },
     {
       "path": "modules/hall-ui/public/goal-forest-render.js",
       "mode": "0000644",
-      "sha256": "9edf4cf99fe2726e75b4ac21b6f41a5e51ecc1b933659ac0f9c7d98c3de217b1"
+      "sha256": "19df08dd72ce42827c825c6ee32233a6bb51f534e060c33d42552aff6e39a8ba"
     },
     {
       "path": "modules/hall-ui/public/goal-inbox.js",
@@ -5947,22 +5947,22 @@
     {
       "path": "modules/hall-ui/public/goals-page.js",
       "mode": "0000644",
-      "sha256": "9f5944388fa573d7c483a6a690d0de53527a407facc13a9a00b01b06c5772047"
+      "sha256": "3836cafa9edc429cdcd847f48f324f7f3aa412ca42b847ed1622126525e67c9a"
     },
     {
       "path": "modules/hall-ui/public/goals-render.js",
       "mode": "0000644",
-      "sha256": "82bbcc5d2b7c098dbf228b30cdccadca6fbb7d3b3a73189f6298b0697c56f110"
+      "sha256": "d7cbd599a69f43851bf6af8be33166cc4ddc949d22f28f36bf2282def0cfc6ba"
     },
     {
       "path": "modules/hall-ui/public/goals.css",
       "mode": "0000644",
-      "sha256": "d5257a3e4f755d17300490eeb8dce9bd91d9c1b8faa31f6a4d6f6d3a79e232a9"
+      "sha256": "6042df284acac7f5af12688651aad7e8d0cf38829a9395a1e28e0e0ded7b8bf3"
     },
     {
       "path": "modules/hall-ui/public/goals.html",
       "mode": "0000644",
-      "sha256": "2f9fe0010658b8aac1a3942bd1e8804c60f99438d789ff52b4fb1d18a2b1fd1d"
+      "sha256": "11b681a246ba5a6a662e6fb0b0eae795460bd1f8cdf251f8cd0e2e52c4869756"
     },
     {
       "path": "modules/hall-ui/public/goals.js",
@@ -5972,7 +5972,7 @@
     {
       "path": "modules/hall-ui/public/goals.states.json",
       "mode": "0000644",
-      "sha256": "36c7b1b130b6255a35494600ecb3e2136a16eab26407b6f14cdd572a794484ab"
+      "sha256": "8b458aa1afaaf9e122217d912bcf15390550cf75953414a94c6bd912c98574e5"
     },
     {
       "path": "modules/hall-ui/public/gov-feeds.js",
@@ -6757,7 +6757,7 @@
     {
       "path": "modules/hall-ui/records/goal-dependency-forest.md",
       "mode": "0000644",
-      "sha256": "dde9b115c2db984ddd86c7dbf3e9e8164f5ae9d3bf09638702bd5206f68f2d04"
+      "sha256": "32d57c27724e1c6e263762a7b150a1db4fbe849f7e3ac3e05ee3af4edb0493d5"
     },
     {
       "path": "modules/hall-ui/records/governor-street.md",
@@ -8137,7 +8137,7 @@
     {
       "path": "modules/platform-identity/invite-authz.js",
       "mode": "0000644",
-      "sha256": "2eb5577450d3bc1d67b7eab9a13256889aca945c6ac6a6a0ca919e195952b7a1"
+      "sha256": "dd54f1456e383de90c7440dbddeb3919718588bd4fb43621f1d192ae16061db5"
     },
     {
       "path": "modules/platform-identity/invite-notices.js",
@@ -8487,7 +8487,7 @@
     {
       "path": "modules/provisioning/catalog-bridge.js",
       "mode": "0000644",
-      "sha256": "6978ddde30cb0b378a2decbe18c2824817d8d57a941a8de6230483453e99acd7"
+      "sha256": "ddc1228706e8f8342bbbd7705acae6a99f1e65e700e72c701c8afe62cd67d732"
     },
     {
       "path": "modules/provisioning/control-plane-guard.js",
@@ -8792,7 +8792,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "c99cfa7d071ece3f6d821709a8610baa25bb0323f7219016ac53d7e8ebb5e197"
+      "sha256": "29ce4dc7dacfa6b9bdddf35ab80fd4b226c96ebcf9a4235297619defe0174119"
     },
     {
       "path": "modules/provisioning/public-refusal.js",
@@ -8824,6 +8824,11 @@
       "mode": "0000644",
       "sha256": "aa3e794ed904157f8549d6ab8ce28ae4a9fa3c2235758b59fc4bd3a66a3b7049"
     },
+    {
+      "path": "modules/provisioning/route-helpers.js",
+      "mode": "0000644",
+      "sha256": "8a4b7f5d8696a1f3e8c80f01e51663a98f14c6115fb76610b66d65e98e68545d"
+    },
     {
       "path": "modules/provisioning/routes/body-validators.js",
       "mode": "0000644",
@@ -8847,12 +8852,12 @@
     {
       "path": "modules/provisioning/routes/disconnect.js",
       "mode": "0000644",
-      "sha256": "e817af6b207a45a61fe8b80e00328537bfeb629d0164a6125af1f8e459bc700f"
+      "sha256": "eae0b840da488f3a9a9a1c0a4eb1de5a0f4fb72ec7120041af9101957e5661c0"
     },
     {
       "path": "modules/provisioning/routes/env-manifest.js",
       "mode": "0000644",
-      "sha256": "dbc156fa4cb2c74132a8034c481ec676f818f4f19139cb10d7d5d669e2e4bbd9"
+      "sha256": "53778501a1265d9e43d49281052e6dbc52730a8fb06fb644ff7c20745d086a6e"
     },
     {
       "path": "modules/provisioning/routes/github-setup.js",
@@ -8867,7 +8872,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "336ac83ef1fcdc91416bd6ca4d0cd040a2b926e0b695a9fbd528a5ab262a4974"
+      "sha256": "55e3e478e7a1978e1e12c5d5fc551fa9b58d51e6d0e920a4d71ef02618e7b78f"
     },
     {
       "path": "modules/provisioning/routes/render-standup.js",
@@ -10477,12 +10482,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cb1fe1a974c6063f91ae16893f1daddb028647374dc13d9df725ea4be5074d9a"
+      "sha256": "341426e0e35db5113dd017485f4479dc0674db124643388aeec9d883e113f7e3"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e92ae06c5b33aa14e3ec516f009526f335ebec59b5e03b4e774a4a48c252d087"
+      "sha256": "f5522e5c98564bbf8ffd3a4817e094732239f369a1850e1b743030a4b03d00b2"
     },
     {
       "path": "public-docs/index.html",
@@ -10502,7 +10507,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "415b376c73ce06c6803897093c02aa9157378d55487a0f84dd8387dc749a75a0"
+      "sha256": "4fbea8b3dd2714eb5ec49751e18f66a0b995e94d64163edfbbf5fa837b196d81"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11392,12 +11397,27 @@
     {
       "path": "scripts/gds/module-assess-tests.js",
       "mode": "0000644",
-      "sha256": "83dc9529be926f8e10043ab78d644d1a72096d02000623035798bd420b2b3261"
+      "sha256": "802ee523248df153dace07e364b29516f6c6dcfcf8eaa301aa97bb723c135983"
     },
     {
       "path": "scripts/gds/module-assess-version.js",
       "mode": "0000644",
-      "sha256": "d240e15768b1cd5869c52ef2c93656cdcdd870554893dd58031b12c78f212e36"
+      "sha256": "b21c85714a8b93e43857c26237eec9dca9830abb53f44146957525f262fb8e7b"
+    },
+    {
+      "path": "scripts/gds/module-test-runner.js",
+      "mode": "0000644",
+      "sha256": "00c844922f5b465485847e45782c71c3103fe9d6aa0e09d4908121769aecbe78"
+    },
+    {
+      "path": "scripts/gds/module-test-runner/README.md",
+      "mode": "0000644",
+      "sha256": "e6253ef4056f35355d5c19af247de840b0f925f7a2b8ead8f2598227be9e6d38"
+    },
+    {
+      "path": "scripts/gds/module-test-runner/module-tests.yml",
+      "mode": "0000644",
+      "sha256": "d721ad7959afb899877aafd31c6a22287d6e479e0fb4fb4f600d12ce5e12a2fd"
     },
     {
       "path": "scripts/gds/module.js",
@@ -12827,7 +12847,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "81694f072dbbb4e64a286a4f5157d07a8e1105ae8a94d800f09eba00f30848e6"
+      "sha256": "05cbabab7a15ea12d403cdce32d0e9accfb56fe1dc44c691dc5e8920933edaf0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14667,12 +14687,12 @@
     {
       "path": "tests/goal_forest_lib.mjs",
       "mode": "0000644",
-      "sha256": "3b309358c195469bee0ab1ce95242914fbc0b1b3def0bb7de3d51dc09dd29c6a"
+      "sha256": "a647398539783aed52b9cf7e5026ae6ab1e9f7337c5e7920d57c9cc106fd9581"
     },
     {
       "path": "tests/goal_forest_page.mjs",
       "mode": "0000644",
-      "sha256": "fdad13a1d265a3506229712816e244ebe026f449beabe3f98a5d652b36d01365"
+      "sha256": "143033e1a1d6178a6d7da40be7b649f61c48997327a34d53d0f32d5e0df08e3a"
     },
     {
       "path": "tests/goal_graph.mjs",
@@ -16342,12 +16362,12 @@
     {
       "path": "tests/module_assess_price_parity.mjs",
       "mode": "0000644",
-      "sha256": "78f36a8bbbd948c4485dfd80df55e1ee053af1b510b4d98607c0d2545bcfa66c"
+      "sha256": "b0cbedfe78c04c5e7ec55d1d50e607c8730784d1e820a2ec64ace05689968c2a"
     },
     {
       "path": "tests/module_assess_score.mjs",
       "mode": "0000644",
-      "sha256": "5255bc0c4e721190d588d5d6c812a8814788598929d38d3bbd87480371ee0b05"
+      "sha256": "5e80628e696af499d95e7d59cc8c655902b9d3bdbe63473f68e573c0acaa2dd3"
     },
     {
       "path": "tests/module_assess_security.mjs",
@@ -16474,6 +16494,11 @@
       "mode": "0000644",
       "sha256": "0db12d802203780f489e9a6d7abf970dfcde9099ac7011fcaaa6c575336804cd"
     },
+    {
+      "path": "tests/module_test_runner.mjs",
+      "mode": "0000644",
+      "sha256": "e6fbb32fd8f43c748d89aca5a9025872582d1628e47de12c4ce4bca834c8be88"
+    },
     {
       "path": "tests/module_toggle_restart.mjs",
       "mode": "0000644",
@@ -16957,7 +16982,7 @@
     {
       "path": "tests/project_catalog_routes.mjs",
       "mode": "0000644",
-      "sha256": "e19d61fb2734092104276d1f74f1cbdf691bfe4f920414c543a1c07e839725e6"
+      "sha256": "52bb32c6e47676407b96e447969cd09cecf12d040d5aa0aef71d5f017b4b0a12"
     },
     {
       "path": "tests/project_door_ui.mjs",
@@ -17237,7 +17262,7 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "3be5d5409c5ffc223ac0ad9aad885fe63d4c8ffe0b11c3aa409d42bee5286932"
+      "sha256": "6aa80d1dd73c9437429b37d8b8af375383a992d4fc8e68909c8346987f2ebc06"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",
@@ -17254,6 +17279,11 @@
       "mode": "0000644",
       "sha256": "2a7769c430da7f81509659eb592c16abe7f95b2b3a3a447dac85fd10f0c780ee"
     },
+    {
+      "path": "tests/provisioning_project_owner_gate.mjs",
+      "mode": "0000644",
+      "sha256": "c632c7fd2b797f40cfda0e62be35f10769c836bc13164ecbc10cb28ab63f8320"
+    },
     {
       "path": "tests/provisioning_public_refusal.mjs",
       "mode": "0000644",

package/docs/api/openapi.json

@@ -17838,7 +17838,7 @@
           "provisioning"
         ],
         "summary": "POST /provisioning/instances/:id/domain",
-        "description": "POST /provisioning/instances/:id/domain — give the caller's OWN instance its address (task 1002692, gap 5: no path existed to add a domain after creation). Validates + records the domain; for an already-ACTIVE instance it also enqueues a 'domain-attach' intent the control-plane runner drains (web tier holds no cloud tokens — ADR 0111 §2). A requested/error instance only records it: the (re)provision run wires the domain itself. A bring-your-own address may be RE-POINTED (task 1003237, ADR 0200): the same guards the first attach applies decide it, and the address it moved off is queued for release. Body: { domain (required) }.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /provisioning/instances/:id/domain — give the caller's OWN instance its address (task 1002692, gap 5: no path existed to add a domain after creation). Validates + records the domain; for an already-ACTIVE instance it also enqueues a 'domain-attach' intent the control-plane runner drains (web tier holds no cloud tokens — ADR 0111 §2). A requested/error instance only records it: the (re)provision run wires the domain itself. A bring-your-own address may be RE-POINTED (task 1003237, ADR 0200): the same guards the first attach applies decide it, and the address it moved off is queued for release. Body: { domain (required) }. An archon may set any project's address; the override is audited via the actor.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "parameters": [
@@ -18193,7 +18193,7 @@
           "provisioning"
         ],
         "summary": "POST /provisioning/instances/:id/github-app",
-        "description": "POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 0133). rank: any authenticated builder (own resource). Returns the pre-filled manifest + the GitHub form-POST target (personal + org variants) + a one-time `state`; the browser POSTs the manifest to GitHub, the owner approves, and GitHub redirects back to the public callback below. The web tier only RECORDS the attempt (state token) — the control-plane runner does the token exchange + cred placement (trust boundary intact, ADR 0111 §2). Body: { account? ('personal'|'org'), org? (a GitHub organisation login) }. A personal or an organisation account (task 1004651): account 'org' makes the app on the organisation the founder chose on the page (`org`), else on the repo's owner. The org name is checked against GitHub's login rules here, never trusted from the page; whether the founder may make an app there is GitHub's to enforce on its own page (this module holds no GitHub token to ask with, ADR 0111 §2). Anything other than account 'org' is the founder's personal account, exactly as before.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 0133). rank: any authenticated builder (own resource; archon may mint for any — audited via the actor). Returns the pre-filled manifest + the GitHub form-POST target (personal + org variants) + a one-time `state`; the browser POSTs the manifest to GitHub, the owner approves, and GitHub redirects back to the public callback below. The web tier only RECORDS the attempt (state token) — the control-plane runner does the token exchange + cred placement (trust boundary intact, ADR 0111 §2). Body: { account? ('personal'|'org'), org? (a GitHub organisation login) }. A personal or an organisation account (task 1004651): account 'org' makes the app on the organisation the founder chose on the page (`org`), else on the repo's owner. The org name is checked against GitHub's login rules here, never trusted from the page; whether the founder may make an app there is GitHub's to enforce on its own page (this module holds no GitHub token to ask with, ADR 0111 §2). Anything other than account 'org' is the founder's personal account, exactly as before.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "parameters": [
@@ -18301,7 +18301,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/instances/:id/invite-suggestions",
-        "description": "── Who is worth inviting (BV1.R28, task 1002347, goal 1000046 C6) ──────── GET /provisioning/instances/:id/invite-suggestions — turn the engine's `invites.seeking` into NAMES. ADR 0239 §6 left `invites.suggested` empty on purpose: ranking builders is a directory read the pure engine may not run. This is the resolution, and ADR 0251 is why it looks like this. rank: any authenticated builder, own resource — `instanceAccessDenied`, the same gate and the same 404 as the manage read above. That is deliberate and not a new authorization idea: REACHING this route IS the ownership answer (ADR 0249 §4), so the surface never re-derives \"is this theirs\" and can never become a weaker second copy of a server rule (ADR 0016). It also 404s rather than 403s, so it leaks no more instance existence than the read beside it. `seeking: null` COSTS NOTHING AND ASKS NOBODY. A solo owner is suggested nobody on purpose (ADR 0239 §6), which is a different statement from an empty list nobody filled — so that answer returns its own reason and never touches the directory at all.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "── Who is worth inviting (BV1.R28, task 1002347, goal 1000046 C6) ──────── GET /provisioning/instances/:id/invite-suggestions — turn the engine's `invites.seeking` into NAMES. ADR 0239 §6 left `invites.suggested` empty on purpose: ranking builders is a directory read the pure engine may not run. This is the resolution, and ADR 0251 is why it looks like this. rank: any authenticated builder, own resource — `requireProjectOwner`, the same gate and the same 404 as the manage read above. That is deliberate and not a new authorization idea: REACHING this route IS the ownership answer (ADR 0249 §4), so the surface never re-derives \"is this theirs\" and can never become a weaker second copy of a server rule (ADR 0016). It also 404s rather than 403s, so it leaks no more instance existence than the read beside it. `seeking: null` COSTS NOTHING AND ASKS NOBODY. A solo owner is suggested nobody on purpose (ADR 0239 §6), which is a different statement from an empty list nobody filled — so that answer returns its own reason and never touches the directory at all.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "parameters": [
@@ -18913,7 +18913,7 @@
           "provisioning"
         ],
         "summary": "POST /provisioning/instances/:id/teardown",
-        "description": "POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. rank: any authenticated builder (own resource). Enqueues a 'teardown' intent; the runner executes it (web tier holds no tokens). 404 when the id isn't the caller's; 409 when the instance isn't in a teardownable state.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. rank: any authenticated builder (own resource; archon may tear down any — the override is audited via the actor). Enqueues a 'teardown' intent; the runner executes it (web tier holds no tokens). 404 when the id isn't the caller's; 409 when the instance isn't in a teardownable state.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "parameters": [