@bongos/core 1.21.15 → 1.21.17

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.15",
-  "core_contract": "1.21.15",
-  "source_commit": "6eaaf19d1ca993da3dad86679b784335b42b4606",
+  "core_version": "1.21.17",
+  "core_contract": "1.21.17",
+  "source_commit": "82dd9252702fdebafededbe79af3526f2c03e98d",
   "source_ref": "HEAD",
-  "built_at": "2026-10-02T19:55:19.691Z",
+  "built_at": "2026-10-02T20:25:38.914Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 579,
+    "docs_redacted": 580,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2892,
+    "functional_verbatim": 2893,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3499,
-  "tree_sha256": "983086f4cbaf9e7f16d4988ac3fdc8ee9c5cbafe1334749ef080e954cc149626",
+  "file_count": 3501,
+  "tree_sha256": "b7aaf5d0dd41a727cb6b8950634f283c3ea7aa2b58a25e7f1e95eba3188c429e",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2279,10 +2279,15 @@
       "mode": "0000644",
       "sha256": "4feed5892da4fe2fbe148cdf56edeacd2bf7e6c3886a880a4246811e500e6973"
     },
+    {
+      "path": "docs/adr/0364-repo-access-is-asked-at-sign-in-and-held-for-the-session.md",
+      "mode": "0000644",
+      "sha256": "ed10b87275d0c3fbaa665467dfd0305274adbbc85556a5162346b3a2537a78ee"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "dca575c50aaffca8560db48e6965ecbe4b3826e11052b0d17c02b216fda49baf"
+      "sha256": "037b81d2507eba161cd12c7daafb32071e6c65bc3383d0174e4ac96aa6ab6dc4"
     },
     {
       "path": "docs/api-reference.md",
@@ -2317,12 +2322,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "e5e7bccc7173be6b072da99915ae674c6f4e78cead0e50c7884ed4442680c82d"
+      "sha256": "ba802364b88549796f90376281aa4983675437d938b2a275b6a9a3c3dbcae521"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "b47709bcf92cb1df96f60765c32900619b722ad01001b232863b58d1e4d9f46b"
+      "sha256": "680d713c880b52ac4891a351b2155e95788ea9a368e46f481997e170309e1e4d"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2827,7 +2832,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "bed517252e4971553bacbb9ae5e3b0e27a74f971424280e611a14f7d60e9ef8f"
+      "sha256": "b26aca84e0a1b73f1d796b2d8d4062b8df7816766e5bb77942bfd932a910a7e1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2917,7 +2922,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "8156033f7f4e8a6826b4d0f3d0130a00c9b3a888f15404a11f383b638296229a"
+      "sha256": "5e5d53d5e5c44705ace2e2df469cfb444eb534e536d152b35b91127917dc59b0"
     },
     {
       "path": "docs/project-context.template.md",
@@ -6077,12 +6082,12 @@
     {
       "path": "modules/hall-ui/public/settings.html",
       "mode": "0000644",
-      "sha256": "f3b84c412ff16b8c0f83f423b9486fddffdd66211d7057bff2f796943790bce2"
+      "sha256": "44da21a466633f96c2eca5515a679fad31421b5442adbec9fc2a5c59b152e42b"
     },
     {
       "path": "modules/hall-ui/public/settings.js",
       "mode": "0000644",
-      "sha256": "16de94af6ec2f43e8096e1b9c85826863391193539e40f4b813b240689e2aa2b"
+      "sha256": "bb282ae096d880185aeb8f0e954286743f49fb256f52a598302d43333e54c56c"
     },
     {
       "path": "modules/hall-ui/public/settings.states.json",
@@ -8427,12 +8432,12 @@
     {
       "path": "modules/public-landing/public/account.html",
       "mode": "0000644",
-      "sha256": "1658c6410719aeaf002717d0ff10ca10695f68849f264d39df8412992c73c2b1"
+      "sha256": "c86bf7e9ca40631cc1b011a915c834a6ce1399d23c4cb7873d9276138c8e5b56"
     },
     {
       "path": "modules/public-landing/public/account.probes.json",
       "mode": "0000644",
-      "sha256": "c84df029c4daa2ec1d1745172b478e94eaf44155d0c88120de05259113568354"
+      "sha256": "d592e0f97f5415c1b42d8cb508b3bca327a2484640a7ee2aa9bef606d400bfa9"
     },
     {
       "path": "modules/public-landing/public/account.states.json",
@@ -8992,7 +8997,7 @@
     {
       "path": "modules/public-landing/public/index.html",
       "mode": "0000644",
-      "sha256": "12378dfbb3b4f24046de3cc2c1b2f7a0ef1dc1dee1b28a0bb3989712711ae037"
+      "sha256": "4a0f39a8b4ca35d64ee0a66d38c1d56ae90605678483b0e74b3618dcc1722288"
     },
     {
       "path": "modules/public-landing/public/index.probes.json",
@@ -9037,7 +9042,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "62d94e62873604169f25eee7a0bb698fc145e17956ecd758a28d130766fcf7de"
+      "sha256": "0e6ba49becc74c5a73f3e0b1babec2521d6a84a3b8c48e116c675c05005c2d1e"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -9762,12 +9767,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "acd457907dfe00c893f1aa353a2ddfb2e59c87497f3fac073a21e3070cb8aa2a"
+      "sha256": "522b35ff0a0b9e426978402e01750d538e32ee626012172e235929fe6a9f747d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "795f3a45cc0ebac3cb53bcab01f6016cf2307de9e77d894fa6fb6deadefcd373"
+      "sha256": "2d295364110f1f0fe31941d493b9cff78ed294958fae9b21dda70f63b9e021e0"
     },
     {
       "path": "public-docs/index.html",
@@ -9787,7 +9792,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "4bd2c47d345382b1a325bcf0dbc112222165da23a171abf63232f6360baf09ea"
+      "sha256": "2f3123e8b496967e1c09515ec7a5325a62be62cc68bad2de41232e622fa849a5"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -11702,7 +11707,7 @@
     {
       "path": "src/bongos/db.js",
       "mode": "0000644",
-      "sha256": "6c06c1c58cb8fc68e805eefe21ce205c1ea45ccfc3bfa7e72a2419021906cb71"
+      "sha256": "29801ce9f6f28fef024f9424ffb1903856e6c1c3a847d16f243634ae6fbb91b0"
     },
     {
       "path": "src/bongos/github-repos.js",
@@ -11877,7 +11882,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "951276d7d3bd022cd9250fe8cd7bd141278d46c4bc6bc06463867f2889e52bc3"
+      "sha256": "3ba37d575862699c9f300b67761cc88594d4a5bce256e127fa7dedd5709e5917"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -12012,7 +12017,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "98f9d1e3cac0f4306b1395ad5291c14d22da7294407497251523672d415fae66"
+      "sha256": "42075e400f00814de20942f57b81cb7e63d9c31bf655e3500ce9ddf691a6c7c4"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13619,6 +13624,11 @@
       "mode": "0000644",
       "sha256": "66fd3d349445aa00e55fa77589958d6c98980e99f3cdaf4746ff55494202333a"
     },
+    {
+      "path": "tests/github_token_session_life.mjs",
+      "mode": "0000644",
+      "sha256": "40975159ab53479398036f9253f01a37e80d41d101195962d3a9b255818b2a0f"
+    },
     {
       "path": "tests/github_token_store.mjs",
       "mode": "0000644",
@@ -14472,7 +14482,7 @@
     {
       "path": "tests/hub_account_page.mjs",
       "mode": "0000644",
-      "sha256": "774934e7540cb7ecd39bd9434c53c171f0ab4a0f34fc11b51fc688c227bc0fe6"
+      "sha256": "bf44295f77e302358bd11cc0565bc98bc5d7f35a7fbb7d53405df469caee8c09"
     },
     {
       "path": "tests/hub_cookie_host_only.mjs",
@@ -14882,7 +14892,7 @@
     {
       "path": "tests/landing_page.mjs",
       "mode": "0000644",
-      "sha256": "42e1c9b9976e64c59c51284e150317678336a1b078dda688f396cd86312325bc"
+      "sha256": "cfc8139b18524e5b5a10b69aa7eeef13427cc60bd2c0df3d19ce080ccc913fe4"
     },
     {
       "path": "tests/leaderboard_roles.mjs",
@@ -15812,7 +15822,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "ffce3b78f8230bf479ec008ac895f210bf9d71731e7c5ca5235b3d5e36c369e8"
+      "sha256": "0344be486a7d4157818929c8adcdf8406f1370ca2e35722ddc2e84a1a9ba7cce"
     },
     {
       "path": "tests/projects_hub_render_connect.mjs",
@@ -16882,7 +16892,7 @@
     {
       "path": "tests/sound_player.mjs",
       "mode": "0000644",
-      "sha256": "8d65bc64902312731e6b194af5be6336bcb59882adb930299cf43cf083977ca1"
+      "sha256": "d18a3314b7780d09cd221a5791d9a9fb0243f16b2197f4c5de0777c691ae3d02"
     },
     {
       "path": "tests/sound_prefs.mjs",
@@ -17442,7 +17452,7 @@
     {
       "path": "tests/wizard_draft_resume.mjs",
       "mode": "0000644",
-      "sha256": "1dd2f46bec0e27ff37ed67dfe605f053fbd08e0b3bc19e574985f9bf43571a3f"
+      "sha256": "2a5891107a8ad920ec3badff34ddd1ab96a7685a11884c2709747f944b0d5916"
     },
     {
       "path": "tests/wizard_front_door.mjs",
@@ -17452,7 +17462,7 @@
     {
       "path": "tests/wizard_intent_resume.mjs",
       "mode": "0000644",
-      "sha256": "b7e7d3a7dad3136551d171a1697a9f09084174c9e65e9ea24a3bff18fb0fc71c"
+      "sha256": "683dbd4b608b65977e1ebbd1fed4916ff0ed74eead0f379d2309e940779c4b1f"
     },
     {
       "path": "tests/wizard_physics.mjs",

package/docs/adr/0364-repo-access-is-asked-at-sign-in-and-held-for-the-session.md

@@ -0,0 +1,30 @@
+# ADR 0364 — Repo access is asked at sign-in on the hub, and held for as long as the builder stays signed in
+
+- **Status:** Accepted.
+- **Date:** 2026-10-02
+- **Task:** [task 1004549](https://cloudbongos.com/builders#/task/1004549).
+- **Amends:** [ADR 0143](0143-onboarding-repo-picker-oauth-scope.md) (the repo token's short hold) and [ADR 0155](0155-adopt-private-repo-widen-oauth-scope.md) (where the `repo` scope is asked).
+
+## Context
+
+The owner reported that "Allow repo access" in the create wizard's review step threw them out of the flow, and never seemed to reach GitHub. Both parts were true:
+
+- GitHub already held the owner's approval of the `repo` scope, so its authorize step answered at once and bounced straight back. The round-trip looked like a reload.
+- The platform asked again because it kept its copy of the token for one hour only (`GITHUB_TOKEN_TTL_MS`). An owner who signed in from the front page, or more than an hour earlier, was sent away from the middle of the wizard to fetch a grant GitHub already held.
+- The bounce then landed on the wrong screen. With a project created earlier in the same tab, `enter()` passed every arrival to `enterCreated()`, which treats a non-deliberate arrival as "the same visit, show the watched project". So the founder landed on the earlier project's done panel instead of their draft.
+
+## Decision
+
+**D1 — Every sign-in door on the hub's own pages asks for repo access.** These are the front page, the projects hub (bar, Your-projects gate, manage gate, the wizard's own door and its 401 recoveries) and the account page. All of them carry `repos=1`. It is asked once, when the person signs in, because anyone signing in on the hub is there to create or run a project, which needs it. The builders' hall and the CLI sign-ins stay identity-only. That is ADR 0143's least-privilege default, and it is unchanged where the person may only be joining someone else's project.
+
+**D2 — The token lives as long as the session it arrived with.** The callback passes the web session's remaining life (30 days today) to `upsertGithubToken` as its TTL. The one-hour constant remains only as the fallback for when no session expiry is known. A **web** sign-out deletes the token. A CLI logout (bearer header) leaves it alone, because the browser session that granted it is still live. Offboarding and a GitHub-side revocation (401) still delete it, as before.
+
+**D3 — A GitHub round-trip never loses the founder's place.** If a draft sits at a wizard step (1–5) beside a stored create, the draft wins on any non-deliberate arrival: a reload, or a return from GitHub. The earlier project stays one click away on the resume line. A deliberate nav and the resume link still go through `enterCreated()` exactly as task 1003503 built it. The review step's "Allow repo access" offer remains as the backup for a session that predates this change.
+
+## Consequences
+
+- A first-time visitor signing in on the hub now sees GitHub's repository-access wording at sign-in, rather than at the review step. GitHub words it as full control of all their repositories. The wizard's own explanation still sits beside the review step's backup offer. The front page's sign-in pill carries none, which is the cost of asking at the door.
+- The platform holds a powerful credential for up to 30 days instead of one hour. It is still encrypted at rest with secret-box, keyed to one builder and never returned to a client, and it is never stored at all when secret-box is unconfigured. A server compromise during that window exposes more than it did. The owner accepted this explicitly (2026-10-02).
+- Tests: `tests/github_token_session_life.mjs` (D2, over the real auth router), `tests/wizard_draft_resume.mjs` slice 4 (D3), and the updated sign-in href pins in `landing_page`, `hub_account_page` and `projects_hub_pre_uat`.
+
+Rejected: keeping the ask inside the wizard and moving it to the first screen. That is still a stop in the middle of a flow, and the owner preferred sign-in. Silently refreshing the token in the background: it needs a GitHub round-trip, which is a navigation, not a background call.

package/docs/adr/README.md

@@ -482,3 +482,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0361 | [**Merges publish as candidates; Release on /deploy decides what other projects are offered** ([task 1004298](https://cloudbongos.com/builders#/task/1004298), goal 1000090). Amends ADR 0161. **D1:** merges publish under `next` when `PUBLISH_AS_CANDIDATE=1` (ships inert). **D2:** a `release` job in publish.yml moves `latest` (release-core.js: published, stable, newer than the release) over the same OIDC trusted publisher — no npm token. **D3:** /deploy's Release button (`core.pin.move`) dispatches it through the one-function `lifecycle.workflowDispatch` port. **D4:** evidence beside each button — hours on this hall, ever rolled back. **D5:** the banner and the hosted-project runner offer only released versions; the control-plane row follows candidates. Arming: roster follow → npm dist-tag permission → GitHub credential Actions: write → the variable.](0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md) | publish / release / update channel |
 | 0362 | [**The governor's docket is collected from sources each module contributes, scoped by each source's own atom** ([task 1004523](https://cloudbongos.com/builders#/task/1004523), goal 1000125). **D1:** one contribution point, `governor.docket`; each owner contributes its source on the read its own list route serves. **D2:** a source declares its list route's atom and the collector enforces it (gated out = `not_yours`, no rows; no gate = dropped). **D3:** nothing invented: `coming` / `off` / `unavailable`. **D4:** the board's needs-you is the /me summons rule. **D5:** `GET /government/docket` gates on `board.vote.cast`.](0362-the-governor-docket-is-collected-from-contributed-sources.md) | government / Governor City |
 | 0363 | [**Who decides what is a per-project table, changed only by a passed amendment** ([task 1004529](https://cloudbongos.com/builders#/task/1004529), goal 1000125). **D1:** `government_decision_rules`, one row per building: `gate` (as today), `board` (the charter only), `nobody` (vacant) or a membership predicate with decide / first / consent / majority / unanimous / sign-off. **D2:** the seeded defaults are today, and a malformed row reads as its default. **D3:** written only inside the transaction that closes a `decision_rules` amendment as passed; JS guard + SQL condition + trigger; no settings route. **D4:** eight building matters join the board's three subjects, openable only where a row names a sitting; sign-off is the author rule. **D5:** People's rank assignments defer to People's row (`checkActAlone`); a passed People matter acts. **D6:** the docket's buildings carry who decides.](0363-who-decides-what-is-a-table-changed-only-by-amendment.md) | government / Governor City |
+| 0364 | [**Repo access is asked at sign-in on the hub, and held for as long as the builder stays signed in** ([task 1004549](https://cloudbongos.com/builders#/task/1004549)). Amends ADR 0143 and 0155. **D1:** every sign-in door on the hub's own pages carries `repos=1`; the hall and CLI stay identity-only. **D2:** the repo token's TTL is the web session's remaining life; a web sign-out deletes it, a CLI logout does not. **D3:** a draft at a wizard step beside a stored create keeps its place on a reload or a GitHub round-trip.](0364-repo-access-is-asked-at-sign-in-and-held-for-the-session.md) | auth / GitHub / create wizard |