@bongos/core 1.21.14 → 1.21.16

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.14",
-  "core_contract": "1.21.14",
-  "source_commit": "1ce8d85952de7169b5f672c8c3e3a8055431aaab",
+  "core_version": "1.21.16",
+  "core_contract": "1.21.16",
+  "source_commit": "abd20c4cc71e944d231ab474f59cd6aa2c66ccc8",
   "source_ref": "HEAD",
-  "built_at": "2026-10-02T19:42:26.201Z",
+  "built_at": "2026-10-02T20:09:34.296Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 579,
+    "docs_redacted": 580,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2892,
+    "functional_verbatim": 2893,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3499,
-  "tree_sha256": "87469b136b4b8c01e2b74045f76630dcad52edff25e8394663c1428642244179",
+  "file_count": 3501,
+  "tree_sha256": "59790b289cc2c7e077c0537945281043f1dbdabad4c82124fe1f4f807edf26db",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1867,7 +1867,7 @@
     {
       "path": "docs/adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md",
       "mode": "0000644",
-      "sha256": "d36d2333c07107c09d7431b4f49ceaafe51231dd4646dbb13bb081d0b2b63a33"
+      "sha256": "fb3ec0877c3b32437d93f59ca5ff92c5f970820f73ff6384a522f22aaf62e609"
     },
     {
       "path": "docs/adr/0282-a-module-that-spends-for-its-callers-declares-a-payer-and-the-core-refuses-it-without-one.md",
@@ -2279,10 +2279,15 @@
       "mode": "0000644",
       "sha256": "4feed5892da4fe2fbe148cdf56edeacd2bf7e6c3886a880a4246811e500e6973"
     },
+    {
+      "path": "docs/adr/0364-repo-access-is-asked-at-sign-in-and-held-for-the-session.md",
+      "mode": "0000644",
+      "sha256": "ed10b87275d0c3fbaa665467dfd0305274adbbc85556a5162346b3a2537a78ee"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "dca575c50aaffca8560db48e6965ecbe4b3826e11052b0d17c02b216fda49baf"
+      "sha256": "037b81d2507eba161cd12c7daafb32071e6c65bc3383d0174e4ac96aa6ab6dc4"
     },
     {
       "path": "docs/api-reference.md",
@@ -2317,12 +2322,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "396ad4725a37fe22b2a70124d1473a967184336e3b56ef9a2e9c385794590472"
+      "sha256": "12ef21f6a7c67a603fe0fe2f7a67b461aa6823b930b2119aedd0330412a4245e"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "5d824c5764939a14dc8f1da37c73e0e033def300ca73515d6672763dca352068"
+      "sha256": "a0000bd2fe2852e37582c2ff0232364b77d84a5056d80deaa713799b080ce49d"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2827,7 +2832,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "79c94a7687066e362f87810166929b406808b1f36b04b894a0e3c0a0306e7dd2"
+      "sha256": "f833fe8a3166735f427b7b8b6d22ed6ce751bc815262edf04b11572b25c680ba"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2917,7 +2922,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "4ab499442182153f1adc90b9558a389ce231d539781f57f667ca643a530caafb"
+      "sha256": "536c5bbddab40e047204586e55f23057e9a8b4ae7a3c8cb9f96926df543ad423"
     },
     {
       "path": "docs/project-context.template.md",
@@ -3082,7 +3087,7 @@
     {
       "path": "docs/recipes/upgrading-the-core.md",
       "mode": "0000644",
-      "sha256": "db22c5d184e2eccffaca9ee17af76c3c716366fede40dc445001b213a0f3df4b"
+      "sha256": "cc1253d5b13243b04d343db140c557b9c78c9345b001be71f3c7b782e9982860"
     },
     {
       "path": "docs/recipes/windows-builders.md",
@@ -5482,7 +5487,7 @@
     {
       "path": "modules/hall-ui/public/deploy.js",
       "mode": "0000644",
-      "sha256": "8819164c6be07064b83ad2da8c649a1f39fad1c5f92325be3c60b35dcc31b823"
+      "sha256": "5066ca5197fb8f01f41703911f9771c41f2dc21cdec20103614b8bc1df748ab6"
     },
     {
       "path": "modules/hall-ui/public/deploy.states.json",
@@ -8427,12 +8432,12 @@
     {
       "path": "modules/public-landing/public/account.html",
       "mode": "0000644",
-      "sha256": "1658c6410719aeaf002717d0ff10ca10695f68849f264d39df8412992c73c2b1"
+      "sha256": "c86bf7e9ca40631cc1b011a915c834a6ce1399d23c4cb7873d9276138c8e5b56"
     },
     {
       "path": "modules/public-landing/public/account.probes.json",
       "mode": "0000644",
-      "sha256": "c84df029c4daa2ec1d1745172b478e94eaf44155d0c88120de05259113568354"
+      "sha256": "d592e0f97f5415c1b42d8cb508b3bca327a2484640a7ee2aa9bef606d400bfa9"
     },
     {
       "path": "modules/public-landing/public/account.states.json",
@@ -8992,7 +8997,7 @@
     {
       "path": "modules/public-landing/public/index.html",
       "mode": "0000644",
-      "sha256": "12378dfbb3b4f24046de3cc2c1b2f7a0ef1dc1dee1b28a0bb3989712711ae037"
+      "sha256": "4a0f39a8b4ca35d64ee0a66d38c1d56ae90605678483b0e74b3618dcc1722288"
     },
     {
       "path": "modules/public-landing/public/index.probes.json",
@@ -9037,7 +9042,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "62d94e62873604169f25eee7a0bb698fc145e17956ecd758a28d130766fcf7de"
+      "sha256": "0e6ba49becc74c5a73f3e0b1babec2521d6a84a3b8c48e116c675c05005c2d1e"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -9762,12 +9767,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c24ae3bb13ec063dd4ec47e93690119c9d45bcaf1cd325ebc208809185d2245b"
+      "sha256": "84060eaa86f290bb1362b6223dbab18a5427344ae4fd40069ec8d9322d20062c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5372bf5df4e17254670021fbe8be6e7ef84fe6aa6c0051d79104f9707362635f"
+      "sha256": "d0ffbee20f0738db3b4dc2d0b3a898e33b934081b9d6dff66020589764b7f432"
     },
     {
       "path": "public-docs/index.html",
@@ -9787,7 +9792,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "6f1ec4627d1a643864c27dbd4e06125c992d1e97a69738b101f149448d36dd8e"
+      "sha256": "e8042901e3e7969c68c77ba31cced93dce76e589df6fa7ca44816e8de56c4d0b"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10792,7 +10797,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "ad4fc8a330126aa2887107bc58aab81a7d861482000717254ea1bc2b0ed3a0ef"
+      "sha256": "f872595e7333304012840de5f94a631a6c4105d2753104bfa02d5e68aae7fedc"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -11482,17 +11487,17 @@
     {
       "path": "scripts/gds/upgrade-migrate.js",
       "mode": "0000644",
-      "sha256": "1f0a8d52622328e29bd3bdbe0402f680f425480e37e29ee42ceee907368710af"
+      "sha256": "f13cdc8f5f55b76a28230b1d20ed5116159106ea66dcce8db1dcb37302a41fa7"
     },
     {
       "path": "scripts/gds/upgrade-outcome.js",
       "mode": "0000644",
-      "sha256": "7d728dee44116084f134072294ef90e25c92b9da50da8ee4b7f70b2232db4f6d"
+      "sha256": "c05a13867f1792cb6befee3bc3e8f6343c67372a32e14d769d49c8088d7035fa"
     },
     {
       "path": "scripts/gds/upgrade.js",
       "mode": "0000644",
-      "sha256": "dbf5d0114c77d4e8ff1d8f580b994112179fdd89ff5a98e56f6c336373fa0219"
+      "sha256": "5197985fef3098ca0f5ba49e84a3585815bfd24e33c889cc4708c76ef1bc1a64"
     },
     {
       "path": "scripts/gds/validate-design.js",
@@ -11522,7 +11527,7 @@
     {
       "path": "scripts/gds/wedge-remedy.js",
       "mode": "0000644",
-      "sha256": "abe6ecedc808f3f57ef2dc5e9f953792ae26f39625425952a8ce529dbf6de576"
+      "sha256": "611a04666351d8efc7ac5f32a5fef3e846bb087c3397ffd6e3c15a9d9a8dbacb"
     },
     {
       "path": "scripts/gds/worktree-claim-guard.js",
@@ -11702,7 +11707,7 @@
     {
       "path": "src/bongos/db.js",
       "mode": "0000644",
-      "sha256": "6c06c1c58cb8fc68e805eefe21ce205c1ea45ccfc3bfa7e72a2419021906cb71"
+      "sha256": "29801ce9f6f28fef024f9424ffb1903856e6c1c3a847d16f243634ae6fbb91b0"
     },
     {
       "path": "src/bongos/github-repos.js",
@@ -11877,7 +11882,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "951276d7d3bd022cd9250fe8cd7bd141278d46c4bc6bc06463867f2889e52bc3"
+      "sha256": "3ba37d575862699c9f300b67761cc88594d4a5bce256e127fa7dedd5709e5917"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -12012,7 +12017,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b1eadcb18331e93e9877413504297e502bbd495fbb8294c4864df896e16e6649"
+      "sha256": "c818a54f4b5f23114851245f6f5882fbd37a09a2692ec5cc96e252df65241911"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13007,7 +13012,7 @@
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "aacd126e1ee75e8c9bb3fab5e8a39fc419c2a905f10a4c56af1b1f7a0d240c65"
+      "sha256": "1c6e820ed45b489749f68f0cc00615fe2c4d6a4b08312316897cd1777c82b4dc"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -13619,6 +13624,11 @@
       "mode": "0000644",
       "sha256": "66fd3d349445aa00e55fa77589958d6c98980e99f3cdaf4746ff55494202333a"
     },
+    {
+      "path": "tests/github_token_session_life.mjs",
+      "mode": "0000644",
+      "sha256": "40975159ab53479398036f9253f01a37e80d41d101195962d3a9b255818b2a0f"
+    },
     {
       "path": "tests/github_token_store.mjs",
       "mode": "0000644",
@@ -14472,7 +14482,7 @@
     {
       "path": "tests/hub_account_page.mjs",
       "mode": "0000644",
-      "sha256": "774934e7540cb7ecd39bd9434c53c171f0ab4a0f34fc11b51fc688c227bc0fe6"
+      "sha256": "bf44295f77e302358bd11cc0565bc98bc5d7f35a7fbb7d53405df469caee8c09"
     },
     {
       "path": "tests/hub_cookie_host_only.mjs",
@@ -14752,7 +14762,7 @@
     {
       "path": "tests/instance_db_migrated_on_code_move.mjs",
       "mode": "0000644",
-      "sha256": "32318b6eeadd00990144857aa9b1bbffef5cd941bdeb5578b3621e62f7b0f3a7"
+      "sha256": "cf92e51be46c5b0e2edab94cd1e269f69c324bacb4f512adf5c23881ca810704"
     },
     {
       "path": "tests/instance_feedback.mjs",
@@ -14882,7 +14892,7 @@
     {
       "path": "tests/landing_page.mjs",
       "mode": "0000644",
-      "sha256": "42e1c9b9976e64c59c51284e150317678336a1b078dda688f396cd86312325bc"
+      "sha256": "cfc8139b18524e5b5a10b69aa7eeef13427cc60bd2c0df3d19ce080ccc913fe4"
     },
     {
       "path": "tests/leaderboard_roles.mjs",
@@ -15812,7 +15822,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "ffce3b78f8230bf479ec008ac895f210bf9d71731e7c5ca5235b3d5e36c369e8"
+      "sha256": "0344be486a7d4157818929c8adcdf8406f1370ca2e35722ddc2e84a1a9ba7cce"
     },
     {
       "path": "tests/projects_hub_render_connect.mjs",
@@ -17297,7 +17307,7 @@
     {
       "path": "tests/upgrade.mjs",
       "mode": "0000644",
-      "sha256": "a4cf3fc9076f07424a62e1a620e14063f51378e99850f77614ed38d6dc9d82d4"
+      "sha256": "18174c07c227e872d210cf65e0ebd52a39eb1987d05e7e0eacdb077179380712"
     },
     {
       "path": "tests/upgrade_artist_gate.mjs",
@@ -17317,7 +17327,7 @@
     {
       "path": "tests/upgrade_outcome.mjs",
       "mode": "0000644",
-      "sha256": "cec960e84573efe77003beb324c0679900f321249148418e7a04daf7a7a40215"
+      "sha256": "b09c536651f8f2305451b96c2a182bbe1dd0cc8950d13ba2570cec03be4e4ff2"
     },
     {
       "path": "tests/upgrade_persist_pin.mjs",
@@ -17427,7 +17437,7 @@
     {
       "path": "tests/wedge_remedy.mjs",
       "mode": "0000644",
-      "sha256": "9810e6b2cf5ec77fad5af12b195a3ff4919143b146ff43f106c67c4090c61c25"
+      "sha256": "dfb1683e7654269be0c92fce88954aa25146027373581d3b8bfcc6fbdf11f2b0"
     },
     {
       "path": "tests/wizard_born_first_board.mjs",
@@ -17442,7 +17452,7 @@
     {
       "path": "tests/wizard_draft_resume.mjs",
       "mode": "0000644",
-      "sha256": "1dd2f46bec0e27ff37ed67dfe605f053fbd08e0b3bc19e574985f9bf43571a3f"
+      "sha256": "2a5891107a8ad920ec3badff34ddd1ab96a7685a11884c2709747f944b0d5916"
     },
     {
       "path": "tests/wizard_front_door.mjs",
@@ -17452,7 +17462,7 @@
     {
       "path": "tests/wizard_intent_resume.mjs",
       "mode": "0000644",
-      "sha256": "b7e7d3a7dad3136551d171a1697a9f09084174c9e65e9ea24a3bff18fb0fc71c"
+      "sha256": "683dbd4b608b65977e1ebbd1fed4916ff0ed74eead0f379d2309e940779c4b1f"
     },
     {
       "path": "tests/wizard_physics.mjs",

package/docs/adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md

@@ -48,6 +48,9 @@ ADR 0128 anticipated the DB half in its own alternatives: *"Do createdb/migrate
 
 > **Amended by task 1002719 — the app user is resolved, not named.** The account whose group every instance joins (and which owns the backup dir and runs the backup timers) was the founder's own account as a literal, so a standup on any other host died `invalid user` at the backup step. `appUser()` in `provision-repo.js` now answers it: `PROVISION_APP_USER`, else the account the runner runs as — which on a plane *is* the app user, so the founder box resolves exactly what the literal said. **root is refused, not resolved**: instance accounts join this account's group, and group root is not a read grant to hand a tenant. The name is validated before it reaches a shell command or a unit file, and the refusal is a preflight: it fires before the status flip, never midway through a standup. Its **group** is the account's primary group looked up on the box (`$(id -gn …)`; the backup unit carries no `Group=`), never the account name spelled twice — an admin-made service account need not have a group of its own name. `audit-authorship.sh` now flags the founder's unix account in account position (`-o`/`-u`, `User=`, `*user = '…'`) in runtime code, because the GitHub-login grep never could.
 
+> **Amended by task 1004512 — the read-only grant is a ceiling, so an operation that WRITES the checkout cannot run as the instance account.** The partial stated above ("file-level co-tenant separation is not what this change delivers") has a sharp edge the design did not name: the instance account has *read* on the checkout and nothing more, so any operation given to it that writes there fails. `bongos upgrade` was given to it whole (task 1004128) and died at its first step — `git status` refused with `fatal: detected dubious ownership in repository`, because the repository is owned by the app user and the asking euid is not. The clean-tree pre-flight read that as a dirty tree, the self-heal chain committed a tree nobody had touched, and every core move on a project provisioned under this ADR ended in a blocker reporting dirt that did not exist. Had git been appeased with a `safe.directory` entry, `npm install`, the pin commit and the `.claude/` materialization would each have failed next, for the same reason and with less legible errors.
+>
+> **So a core move now runs as two accounts, split along what each one owns.** Everything touching the CHECKOUT (the clean-tree pre-flight, the pin, `npm install`, materialize, the pin commit) runs as the app user, which owns it — the same account `pushUpgradePin` and the wedge remedy already used for their own `git` calls. Everything touching the DATABASE (the identity pre-check, migrate, the ledger insert) runs as the instance account through `sudo -n -u`, because that is where this ADR's isolation actually lives: the role owns the database and `PUBLIC` holds no `CONNECT`, so no other account can reach it. `resolveRunAs` answers both (`runAs`, `migrateAs`) and the runner passes `--migrate-as` only when they differ, so a control plane and a project predating this ADR emit the command they always did. **Nothing in this decision is relaxed** — the `/proc` and database boundaries are untouched; what changed is that work needing write access stopped being handed to an account deliberately denied it.
 ## Alternatives considered
 
 - **A `DATABASE_URL` in `web.env` instead of discrete `PG*` vars.** `pool.js` already prefers it, so it would have needed no pool change at all. Rejected: the socket path has to ride as `?host=…` or a percent-encoded authority, and the exact parse is `pg-connection-string`'s business rather than something the test could pin — trading a stated, assertable identity for a URL whose behavior we would be trusting.

package/docs/adr/0364-repo-access-is-asked-at-sign-in-and-held-for-the-session.md

@@ -0,0 +1,30 @@
+# ADR 0364 — Repo access is asked at sign-in on the hub, and held for as long as the builder stays signed in
+
+- **Status:** Accepted.
+- **Date:** 2026-10-02
+- **Task:** [task 1004549](https://cloudbongos.com/builders#/task/1004549).
+- **Amends:** [ADR 0143](0143-onboarding-repo-picker-oauth-scope.md) (the repo token's short hold) and [ADR 0155](0155-adopt-private-repo-widen-oauth-scope.md) (where the `repo` scope is asked).
+
+## Context
+
+The owner reported that "Allow repo access" in the create wizard's review step threw them out of the flow, and never seemed to reach GitHub. Both parts were true:
+
+- GitHub already held the owner's approval of the `repo` scope, so its authorize step answered at once and bounced straight back. The round-trip looked like a reload.
+- The platform asked again because it kept its copy of the token for one hour only (`GITHUB_TOKEN_TTL_MS`). An owner who signed in from the front page, or more than an hour earlier, was sent away from the middle of the wizard to fetch a grant GitHub already held.
+- The bounce then landed on the wrong screen. With a project created earlier in the same tab, `enter()` passed every arrival to `enterCreated()`, which treats a non-deliberate arrival as "the same visit, show the watched project". So the founder landed on the earlier project's done panel instead of their draft.
+
+## Decision
+
+**D1 — Every sign-in door on the hub's own pages asks for repo access.** These are the front page, the projects hub (bar, Your-projects gate, manage gate, the wizard's own door and its 401 recoveries) and the account page. All of them carry `repos=1`. It is asked once, when the person signs in, because anyone signing in on the hub is there to create or run a project, which needs it. The builders' hall and the CLI sign-ins stay identity-only. That is ADR 0143's least-privilege default, and it is unchanged where the person may only be joining someone else's project.
+
+**D2 — The token lives as long as the session it arrived with.** The callback passes the web session's remaining life (30 days today) to `upsertGithubToken` as its TTL. The one-hour constant remains only as the fallback for when no session expiry is known. A **web** sign-out deletes the token. A CLI logout (bearer header) leaves it alone, because the browser session that granted it is still live. Offboarding and a GitHub-side revocation (401) still delete it, as before.
+
+**D3 — A GitHub round-trip never loses the founder's place.** If a draft sits at a wizard step (1–5) beside a stored create, the draft wins on any non-deliberate arrival: a reload, or a return from GitHub. The earlier project stays one click away on the resume line. A deliberate nav and the resume link still go through `enterCreated()` exactly as task 1003503 built it. The review step's "Allow repo access" offer remains as the backup for a session that predates this change.
+
+## Consequences
+
+- A first-time visitor signing in on the hub now sees GitHub's repository-access wording at sign-in, rather than at the review step. GitHub words it as full control of all their repositories. The wizard's own explanation still sits beside the review step's backup offer. The front page's sign-in pill carries none, which is the cost of asking at the door.
+- The platform holds a powerful credential for up to 30 days instead of one hour. It is still encrypted at rest with secret-box, keyed to one builder and never returned to a client, and it is never stored at all when secret-box is unconfigured. A server compromise during that window exposes more than it did. The owner accepted this explicitly (2026-10-02).
+- Tests: `tests/github_token_session_life.mjs` (D2, over the real auth router), `tests/wizard_draft_resume.mjs` slice 4 (D3), and the updated sign-in href pins in `landing_page`, `hub_account_page` and `projects_hub_pre_uat`.
+
+Rejected: keeping the ask inside the wizard and moving it to the first screen. That is still a stop in the middle of a flow, and the owner preferred sign-in. Silently refreshing the token in the background: it needs a GitHub round-trip, which is a navigation, not a background call.

package/docs/adr/README.md

@@ -482,3 +482,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0361 | [**Merges publish as candidates; Release on /deploy decides what other projects are offered** ([task 1004298](https://cloudbongos.com/builders#/task/1004298), goal 1000090). Amends ADR 0161. **D1:** merges publish under `next` when `PUBLISH_AS_CANDIDATE=1` (ships inert). **D2:** a `release` job in publish.yml moves `latest` (release-core.js: published, stable, newer than the release) over the same OIDC trusted publisher — no npm token. **D3:** /deploy's Release button (`core.pin.move`) dispatches it through the one-function `lifecycle.workflowDispatch` port. **D4:** evidence beside each button — hours on this hall, ever rolled back. **D5:** the banner and the hosted-project runner offer only released versions; the control-plane row follows candidates. Arming: roster follow → npm dist-tag permission → GitHub credential Actions: write → the variable.](0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md) | publish / release / update channel |
 | 0362 | [**The governor's docket is collected from sources each module contributes, scoped by each source's own atom** ([task 1004523](https://cloudbongos.com/builders#/task/1004523), goal 1000125). **D1:** one contribution point, `governor.docket`; each owner contributes its source on the read its own list route serves. **D2:** a source declares its list route's atom and the collector enforces it (gated out = `not_yours`, no rows; no gate = dropped). **D3:** nothing invented: `coming` / `off` / `unavailable`. **D4:** the board's needs-you is the /me summons rule. **D5:** `GET /government/docket` gates on `board.vote.cast`.](0362-the-governor-docket-is-collected-from-contributed-sources.md) | government / Governor City |
 | 0363 | [**Who decides what is a per-project table, changed only by a passed amendment** ([task 1004529](https://cloudbongos.com/builders#/task/1004529), goal 1000125). **D1:** `government_decision_rules`, one row per building: `gate` (as today), `board` (the charter only), `nobody` (vacant) or a membership predicate with decide / first / consent / majority / unanimous / sign-off. **D2:** the seeded defaults are today, and a malformed row reads as its default. **D3:** written only inside the transaction that closes a `decision_rules` amendment as passed; JS guard + SQL condition + trigger; no settings route. **D4:** eight building matters join the board's three subjects, openable only where a row names a sitting; sign-off is the author rule. **D5:** People's rank assignments defer to People's row (`checkActAlone`); a passed People matter acts. **D6:** the docket's buildings carry who decides.](0363-who-decides-what-is-a-table-changed-only-by-amendment.md) | government / Governor City |
+| 0364 | [**Repo access is asked at sign-in on the hub, and held for as long as the builder stays signed in** ([task 1004549](https://cloudbongos.com/builders#/task/1004549)). Amends ADR 0143 and 0155. **D1:** every sign-in door on the hub's own pages carries `repos=1`; the hall and CLI stay identity-only. **D2:** the repo token's TTL is the web session's remaining life; a web sign-out deletes it, a CLI logout does not. **D3:** a draft at a wizard step beside a stored create keeps its place on a reload or a GitHub round-trip.](0364-repo-access-is-asked-at-sign-in-and-held-for-the-session.md) | auth / GitHub / create wizard |