@bongos/core 1.21.28 → 1.21.30

package/modules/hall-ui/public/work.html

@@ -171,9 +171,9 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell-trail.js?v=2026-10-02-craft"></script>
-<script src="/builders/craft-mode.js?v=2026-10-02-craft"></script>
-<script src="/builders/shell.js?v=2026-10-02-craft"></script>
+<script src="/builders/shell-trail.js?v=2026-10-03-nav"></script>
+<script src="/builders/craft-mode.js?v=2026-10-03-nav"></script>
+<script src="/builders/shell.js?v=2026-10-03-nav"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/hall-ui/records/craft-mode.md

@@ -20,3 +20,10 @@ Covers: every shelled hall page (`craft-mode.js`, `shell.js`, `style.css`), and
 ## The carve
 
 `shell.js` sat at exactly 1,500 lines, the fitness ratchet, so the Back link + trail section (tasks 1004430/1004476/1004477) moved verbatim into `shell-trail.js` (`window.OTBShellTrail.make({ esc, nav })`). Behaviour is unchanged; `tests/hall_fullscreen.mjs` loads it before the shell and still drives the trail through the real top bar.
+
+## The nav follows the mode (task 1004493)
+
+- **Each craft has a named tab list**, `MODE_TABS` in `craft-mode.js`, by NAV id. `ALWAYS_TABS` is the owner's list of tabs no mode may hide (2026-10-01: Builders, NAV id `roster`, first), and every mode's list is `ALWAYS_TABS` plus its own. Legacy and no mode have no entry, so they show every tab, as before.
+- **Government shows only in Governing**, and outside that group Governing is the shortest list (Blockers, Board Room). Building is every tab except Government and the Board Room; Artistry is Studio, Goals, Your thinking; Ideating is Sky, Your thinking, Goals. The prototype names rooms that do not exist yet (Store, Page reviews, Treasury); a list names only real NAV items, and `tests/craft_mode_nav.mjs` requires every NAV item to sit in some mode.
+- **The mode only ever takes away, and never through `hidden`.** The access gate owns `hidden`; `applyNav()` marks what the mode leaves out with `[data-craft-off]`, which `style.css` hides. So a mode can never show a tab the gate hid, and switching mode just moves the attribute. A group head goes too once nothing under it shows.
+- **Two callers.** `apply()` runs it on every mode change (live, no reload), and `shell.js` `applyAccess` runs it right after its gate loop, so a later `/me` answer (a promotion, a permission) brings a head back with its tabs. Hidden tabs still open by their URL; nothing is enforced (ADR 0016).

package/modules/provisioning/routes/callback-page.js

@@ -15,7 +15,7 @@
 //
 // Shape: no DB, no network, no request object — given a plain options bag it returns
 // a string. `esc` and `callbackPage` are the whole surface; PAGE_STYLE and
-// CALLBACK_SCRIPT stay private because they are only ever this page's own body.
+// HANDBACK_SCRIPT stay private because they are only ever this page's own body.
 'use strict';
 
 const api = require('../../../src/module-api');
@@ -53,73 +53,44 @@ h1{font-family:"Baloo 2",system-ui,sans-serif;font-weight:700;font-size:1.5rem;l
 .sub p{margin:.6rem 0}
 code{font-family:"Fira Code",ui-monospace,SFMono-Regular,monospace;background:rgba(56,189,248,.14);color:var(--sky600);padding:.12em .45em;border-radius:6px;font-size:.9em;overflow-wrap:anywhere}
 @media (prefers-color-scheme:dark){code{color:var(--sky)}}
-.steps{display:flex;align-items:flex-start;justify-content:center;margin:1.9rem 0 1.1rem}
-.step{flex:1 1 0;max-width:9rem;position:relative}
-.step::before{content:"";position:absolute;top:16px;left:-50%;width:100%;height:3px;background:var(--line);z-index:0;transition:background .4s ease}
-.step:first-child::before{display:none}
-.dot{width:34px;height:34px;border-radius:50%;margin:0 auto;display:grid;place-items:center;background:var(--bg3);border:2px solid var(--line);color:var(--inkSoft);font-weight:700;font-size:.95rem;position:relative;z-index:1;transition:all .4s ease}
-.lbl{margin-top:.55rem;font-size:.78rem;color:var(--inkSoft);font-weight:600;line-height:1.25;padding:0 .2rem}
-.step.done .dot{background:var(--ok);border-color:var(--ok);color:#fff}
-.step.done::before{background:var(--ok)}
-.step.active .dot{border-color:var(--sun);color:var(--sun600);animation:pulse 1.5s ease-in-out infinite}
-.step.active .lbl{color:var(--ink)}
-.step.active .dot::after{content:"";position:absolute;inset:-3px;border-radius:50%;border:2px solid transparent;border-top-color:var(--sun);animation:spin .8s linear infinite}
-@keyframes spin{to{transform:rotate(360deg)}}
-@keyframes pulse{0%,100%{box-shadow:0 0 0 4px rgba(249,115,22,.15)}50%{box-shadow:0 0 0 9px rgba(249,115,22,.04)}}
-@media (prefers-reduced-motion:reduce){.step.active .dot,.step.active .dot::after{animation:none}}
-.status-line{min-height:1.4em;color:var(--inkSoft);font-size:.94rem;margin:.4rem auto 0;max-width:24rem;line-height:1.45}
 .cta{margin-top:1.4rem}
 .btn{display:inline-block;background:var(--sun);color:var(--sunInk);text-decoration:none;font-weight:700;font-family:"Baloo 2",system-ui,sans-serif;padding:.72rem 1.5rem;border-radius:999px;font-size:1.02rem;box-shadow:0 10px 22px -8px rgba(249,115,22,.7);transition:transform .15s ease,box-shadow .15s ease}
 .btn:hover{transform:translateY(-1px);box-shadow:0 14px 28px -8px rgba(249,115,22,.8)}
 .muted{color:var(--inkSoft);opacity:.9;font-size:.85rem;margin:1.1rem auto 0;max-width:24rem;line-height:1.45}
-.hidden{display:none!important}
 `;
 
-// Client script for the PROGRESS variant only (task 2096): poll the public status
-// endpoint, advance the stepper, and auto-open the instance the moment its credentials
-// land. Deliberately contains NO backticks and NO ${...} so it survives the outer
-// template literal verbatim; the only server data it reads is the JSON config block
-// written just above it. Fails soft — a poll hiccup just retries; a long wait reveals a
-// manual "open" button rather than ever falsely erroring. The auto-open countdown runs
-// ONLY when this page is the wizard's pop-up; a same-tab return (pop-up blocked) keeps
-// the founder here with the door and a way back to the checklist (task 1003236).
-const CALLBACK_SCRIPT = `
+// Client script for the HAND-BACK variant (task 1004548; replaces the task 2096 progress
+// stepper). Placing the credentials takes minutes, and the founder used to wait for it
+// HERE, in a second tab, away from the checklist that still had steps for them. Now the
+// page hands them straight back: as the wizard's pop-up it closes itself so the checklist
+// tab is in front again (that tab is already polling the same status and shows the wait);
+// if the browser refuses the close, or this was a same-tab return (pop-up blocked), this
+// tab becomes the checklist. The one-time state rides the URL FRAGMENT — never sent to a
+// server — so a checklist opened here can keep watching the same attempt.
+// Deliberately contains NO backticks and NO ${...} so it survives the outer template
+// literal verbatim; the only server data it reads is the JSON config block above it.
+const HANDBACK_SCRIPT = `
 (function(){
   var cfg=window.__CB_SETUP__||{};
-  var state=cfg.state||'',domain=cfg.domain||'';
-  if(!state||!domain)return;
-  var target='https://'+domain;
-  var pollUrl=location.pathname.replace('/callback','/status')+'?state='+encodeURIComponent(state);
-  var steps=document.getElementById('steps'),statusEl=document.getElementById('status');
-  var cta=document.getElementById('cta'),go=document.getElementById('go'),foot=document.getElementById('foot'),back=document.getElementById('back');
-  /* Opened from the wizard as a pop-up (window.opener alive, or the tab still carries the name the wizard gave it):
-     the checklist is in the other tab, so this one may auto-open the instance. Same-tab fallback (pop-up blocked,
-     form target=_self): this IS the founder's checklist tab — never navigate it away; offer both doors (task 1003236). */
-  var popup=!!window.opener||window.name==='ghAppSetup';
-  var finished=false,tries=0,manual=false;
-  function dot(n){return steps.querySelector('[data-step="'+n+'"]');}
-  function setActive(n){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active','done');if(i<n){el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}else if(i===n){el.classList.add('active');}}}
-  function allDone(){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active');el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}}
-  function ready(){if(finished)return;finished=true;allDone();statusEl.textContent='Your instance is ready \\u2014 sign in with GitHub to claim it as owner.';cta.classList.remove('hidden');
-    if(!popup){go.textContent='Open '+domain+' \\u2192';if(back)back.classList.remove('hidden');if(foot)foot.textContent='Your setup checklist is waiting where you left it \\u2014 finish it first, or open your instance now.';return;}
-    var n=4;(function tick(){if(n<=0){location.href=target;return;}go.textContent='Opening '+domain+' in '+n+'\\u2026';n--;setTimeout(tick,1000);})();}
-  function failed(){if(finished)return;finished=true;statusEl.textContent='Setup didn\\u2019t finish. Open your instance page and start the GitHub sign-in setup again.';cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';}
-  function revealManual(){if(manual||finished)return;manual=true;cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';if(foot)foot.textContent='This is taking a little longer than usual \\u2014 you can open your instance now, or keep waiting.';}
-  function schedule(){if(!finished)setTimeout(poll,3000);}
-  function poll(){tries++;fetch(pollUrl,{headers:{accept:'application/json'},cache:'no-store'}).then(function(r){return r.ok?r.json():null;}).then(function(j){if(!j){schedule();return;}if(j.ready||j.status==='done'){ready();return;}if(j.status==='error'||j.status==='expired'){failed();return;}setActive(2);if(tries===40)revealManual();schedule();}).catch(function(){schedule();});}
-  setActive(2);poll();
+  var back=cfg.back||'/projects?view=new';
+  if(cfg.state)back+='#ghstate='+encodeURIComponent(cfg.state);
+  var link=document.getElementById('back');if(link)link.href=back;
+  var popup=false;
+  try{popup=!!window.opener&&!window.opener.closed;}catch(e){}
+  if(popup){try{window.opener.focus();}catch(e){}try{window.close();}catch(e){}}
+  setTimeout(function(){location.replace(back);},popup?700:300);
 })();
 `;
 
 // The standalone landing page for the public GitHub redirect (the mothership serves it;
 // it is NOT the hall shell). Two variants share the Cloud Bongos brand shell (task 2096):
-//   • progress — ok + state + domain: an animated stepper that polls the status endpoint
-//     and auto-opens the instance when its credentials are placed.
+//   • hand-back — ok + state + domain: a brief "GitHub app created" that returns the
+//     founder to their setup checklist, where the wait is shown (task 1004548).
 //   • message — everything else (errors + the no-domain success fallback): a calm badge
 //     + `body` (server-authored, trusted HTML).
 function callbackPage({ ok, title, body, state, domain }) {
-  const progress = !!(ok && state && domain);
-  const cfgJson = JSON.stringify({ state: state || '', domain: domain || '' }).replace(/</g, '\\u003c');
+  const handback = !!(ok && state && domain);
+  const cfgJson = JSON.stringify({ state: state || '', domain: domain || '', back: '/projects?view=new' }).replace(/</g, '\\u003c');
   const head = `<!doctype html><html lang="en"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="color-scheme" content="light dark">
@@ -127,24 +98,16 @@ function callbackPage({ ok, title, body, state, domain }) {
 <link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
 <link href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@600;700;800&family=Quicksand:wght@400;500;600;700&family=Fira+Code&display=swap" rel="stylesheet">
 <style>${PAGE_STYLE}</style></head><body>`;
-  if (progress) {
+  if (handback) {
     return `${head}
 <main class="card">
+  <div class="badge-warn">✓</div>
   <h1>${esc(title)}</h1>
-  <p class="sub">Finishing sign-in setup for <code>${esc(domain)}</code>.</p>
-  <div class="steps" id="steps" aria-label="Setup progress">
-    <div class="step done" data-step="1"><div class="dot">✓</div><div class="lbl">GitHub app created</div></div>
-    <div class="step active" data-step="2"><div class="dot">2</div><div class="lbl">Placing credentials</div></div>
-    <div class="step" data-step="3"><div class="dot">3</div><div class="lbl">Ready to sign in</div></div>
-  </div>
-  <p class="status-line" id="status">Hang tight — keep this tab open while we finish.</p>
-  <div class="cta hidden" id="cta"><a class="btn" id="go" href="https://${esc(domain)}">Open ${esc(domain)} →</a></div>
-  <p class="muted hidden" id="back"><a href="/projects?view=new">Finish your remaining setup steps →</a></p>
-  <p class="muted" id="foot">This page opens <code>${esc(domain)}</code> for you the moment it’s ready.</p>
-  <noscript><p class="muted">When setup finishes, open <a href="https://${esc(domain)}">${esc(domain)}</a> and sign in with GitHub — that first sign-in makes you the owner.</p></noscript>
+  <p class="sub">Taking you back to your setup checklist — it finishes setting up <code>${esc(domain)}</code> there.</p>
+  <div class="cta"><a class="btn" id="back" href="/projects?view=new">Back to my checklist →</a></div>
 </main>
 <script>window.__CB_SETUP__=${cfgJson};</script>
-<script>${CALLBACK_SCRIPT}</script>
+<script>${HANDBACK_SCRIPT}</script>
 </body></html>`;
   }
   return `${head}

package/modules/provisioning/routes/provisioning.js

@@ -1391,12 +1391,12 @@ module.exports = function provisioningRoutes() {
   });
 
   // GET /provisioning/github-app/status?state=<> — the PUBLIC progress read the onboarding
-  // callback page polls (task 2096) to know when setup is done + where to send the owner.
+  // setup checklist polls (task 1004548) to know when setup is done + where to send the owner.
   // Same public-by-state model as the callback: the unguessable, single-use `state` token
   // is the only key, and the response reveals only the manifest lifecycle status + the
   // instance's own (already-public) domain — never a secret. Per-IP rate-limited because
   // the page polls it every ~3s. `ready` is true iff the manifest reached 'done' (creds
-  // placed + /healthz verified) — the page then auto-redirects to https://<domain>.
+  // placed + /healthz verified) — the setup checklist then opens https://<domain>.
   // rank: public — no session, no mutation, no secret; an unknown state is a 404 no-op.
   router.get('/provisioning/github-app/status', statusRateLimit, async (req, res) => {
     try {
@@ -1461,11 +1461,11 @@ module.exports = function provisioningRoutes() {
       }).catch(() => {});
       const inst = await provisioning.getInstanceById(pool, row.instance_id).catch(() => null);
       const domain = inst && inst.domain ? inst.domain : null;
-      // Progress variant (task 2096): the page polls …/github-app/status?state= and
-      // auto-opens the instance the moment its credentials are placed — no "come back
-      // later" dead-end. Falls back to a static success if we have no domain to poll.
+      // Hand-back variant (task 1004548): the page returns the founder to their setup
+      // checklist, which shows the wait for the credentials and opens the instance when
+      // it's ready. Falls back to a static success if we have no domain to point at.
       return sendPage(200, domain
-        ? callbackPage({ ok: true, title: 'Setting up your instance', state, domain })
+        ? callbackPage({ ok: true, title: 'GitHub app created', state, domain })
         : callbackPage({ ok: true, title: 'GitHub app created',
           body: '<p>Nice — GitHub created the app. We’re placing its credentials on your instance now; this finishes on its own within a few minutes.</p><p class="muted">You can close this tab.</p>' }));
     } catch (err) {

package/modules/public-landing/public/projects.html

@@ -423,6 +423,10 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
 .samePath{font-size:13px;font-weight:400;color:var(--ink-faint);margin-top:18px;}
 .samePath a{display:inline-block;padding:3px 0;min-height:24px;line-height:18px;}
 #liveProgress{margin-top:4px;}
+/* the sign-in wait inside its step + the "open it when ready" tick (task 1004548) */
+.humanSteps .prog{margin-top:14px;}
+.autoOpen{display:flex;align-items:flex-start;gap:10px;margin-top:14px;font-size:14px;line-height:1.45;color:var(--ink-soft);cursor:pointer;min-height:24px;}
+.autoOpen input{width:18px;height:18px;margin:1px 0 0;flex:0 0 auto;accent-color:var(--accent);cursor:pointer;}
 
 /* ── the standup strip (task 2083), drawn as the lifecycle rail (DESIGN.md):
    three hairlines, a 7px dot, one lit step — no plate, no connector, no
@@ -6557,6 +6561,35 @@ summary{min-height:24px;padding:3px 0;}
         '<p>The platform team places the generated credentials; this step ticks itself once they land.</p></details>';
     }
 
+    /* "Open it when it's ready" (task 1004548). The founder now waits for sign-in on
+       this checklist instead of on the callback page, so the auto-open lives here: a
+       tick, on unless they untick it (remembered per browser), that opens the project
+       the moment it answers AND sign-in is wired. Armed only by a wait this page has
+       actually watched, so revisiting a long-finished checklist never jumps away. */
+    var AUTO_OPEN_KEY = 'cb-open-when-ready';
+    var autoOpenArmed = false;
+    var autoOpened = false;
+    function autoOpenPref() {
+      try { return localStorage.getItem(AUTO_OPEN_KEY) !== '0'; } catch (e) { return true; }
+    }
+    function autoOpenTick() {
+      return '<label class="autoOpen"><input type="checkbox" data-action="auto-open"' + (autoOpenPref() ? ' checked' : '') + '>' +
+        '<span>Open my project automatically when it’s ready</span></label>';
+    }
+    function maybeAutoOpen() {
+      var domain = resolvedDomain();
+      if (autoOpened || !autoOpenArmed || !domain || !autoOpenPref()) return;
+      if (live.manifest !== 'done' || live.instStatus !== 'active' || !live.addrReady) return;
+      autoOpened = true;
+      var url = 'https://' + domain;
+      /* a new tab keeps this checklist (two steps follow sign-in); a browser that
+         blocks an unprompted tab gets this one sent instead — the founder asked */
+      var w = null;
+      try { w = window.open(url, '_blank'); } catch (e) {}
+      if (w) { try { w.opener = null; } catch (e) {} }
+      else window.location.assign(url);
+    }
+
     /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow is the primary path
        (gap 3 / idea 1000676); locked until a domain exists (the App needs the real
        callback host — the server refuses domainless with domain_required). */
@@ -6572,7 +6605,12 @@ summary{min-height:24px;padding:3px 0;}
         return '<li class="slocked" data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>This platform is running on a local address, and GitHub refuses app setups it can’t reach over the public internet — so the one-click flow can’t complete here. On a publicly-addressed platform this is one click.</p>' + manualOauthDetails() + '</li>';
       }
       if (live.manifest === 'done') {
-        return '<li class="sdone" data-onboard-step="oauth-app"><b>GitHub sign-in is wired</b><p>Credentials placed and verified — sign-in on <code style="font-family:var(--font-mono)">' + esc(domain) + '</code> is live.</p></li>';
+        /* the wait ends HERE now, not on the callback page (task 1004548): once the
+           project answers too, the step carries the door itself */
+        var open = live.instStatus === 'active' && live.addrReady;
+        return '<li class="sdone" data-onboard-step="oauth-app"><b>GitHub sign-in is wired</b><p>Credentials placed and verified — sign-in on <code style="font-family:var(--font-mono)">' + esc(domain) + '</code> is live.' +
+          (open ? '' : ' The door below opens once your project is answering.') + '</p>' +
+          (open ? '<a class="ghbtn" href="https://' + esc(domain) + '" target="_blank" rel="noopener">Open ' + esc(domain) + ' →</a>' : '') + '</li>';
       }
       if (live.manifest === 'error' || live.manifest === 'expired') {
         /* a plain sentence first; the raw route text folds under Technical
@@ -6589,10 +6627,14 @@ summary{min-height:24px;padding:3px 0;}
       if (live.manifest === 'code_received') {
         /* GitHub's half is done — say so, rather than keep telling the founder
            to approve an app they just approved */
-        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>GitHub’s part is done. The platform is placing the credentials on your project now — this step ticks itself.</p></li>';
+        autoOpenArmed = true;
+        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>GitHub’s part is done. The platform is placing the credentials on your project now — this usually takes a few minutes, and this step ticks itself.</p>' +
+          progressMarkup(1, 1, 'Placing credentials and checking sign-in works…', '', 'signin') + autoOpenTick() + '</li>';
       }
       if (live.manifest) {   /* pending — GitHub holds the manifest, nobody has approved it yet */
+        autoOpenArmed = true;
         return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p>' +
+          progressMarkup(0, 0, 'Waiting for your approval on GitHub…', '', 'signin') + autoOpenTick() +
           (manifestStale ? '<button type="button" class="linklike" data-action="manifest-start">Didn’t get to GitHub? Start the setup again</button>' : '') + '</li>';
       }
       return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in — one click</b><p>Approve a pre-filled GitHub App and the platform wires sign-in by itself: no keys to copy, and the secret never leaves the server side.</p>' +
@@ -6678,6 +6720,7 @@ summary{min-height:24px;padding:3px 0;}
         if (html === lastStepsHtml) return;   /* change-only re-render — polls never clobber open UI */
         lastStepsHtml = html;
         $('humanSteps').innerHTML = html;
+        maybeAutoOpen();
       });
     }
 
@@ -6730,6 +6773,12 @@ summary{min-height:24px;padding:3px 0;}
       });
     });
 
+    $('humanSteps').addEventListener('change', function (ev) {
+      var box = ev.target.closest && ev.target.closest('[data-action="auto-open"]');
+      if (!box) return;
+      try { localStorage.setItem(AUTO_OPEN_KEY, box.checked ? '1' : '0'); } catch (e) {}
+    });
+
     /* ── C8: the wizard's polls run only on stage, exactly like the sky.
        Off-view or hidden-tab, a due tick parks itself instead of fetching;
        enter() and the visibility flip resume whatever was parked. ── */
@@ -6754,6 +6803,13 @@ summary{min-height:24px;padding:3px 0;}
     var manifestPending = false;
     var manifestStartedAt = 0;     /* when the founder was sent to GitHub */
     var manifestStale = false;     /* ~90s with no approval → offer to start again */
+    /* the GitHub hand-back (task 1004548): the callback page returns the founder here
+       with the attempt's one-time state in the fragment (#ghstate=…), so a checklist
+       that page opened — not only the tab that started the setup — keeps watching the
+       same attempt. Read once at load, before the router's replaceState drops it. */
+    var handbackState = (function () {
+      try { var m = /[#&]ghstate=([0-9a-f]{16,128})/i.exec(location.hash || ''); return m ? m[1] : null; } catch (e) { return null; }
+    })();
     /* the manifest leg survives a reload: token + last status ride the CREATED
        record, so enter() re-seeds the step instead of re-offering "Set up
        GitHub sign-in" for an app the founder already approved (task 1003232) */
@@ -6846,7 +6902,9 @@ summary{min-height:24px;padding:3px 0;}
       standup: { names: ['Request filed', 'Standing it up', 'Live'], cls: '' },
       revive: { names: ['Revive queued', 'Standing it up', 'Back live'], cls: '' },
       teardown: { names: ['Teardown queued', 'Winding down', 'Torn down'], cls: 'flowDown' },
-      settings: { names: ['Change saved', 'Restarting to apply it', 'Applied'], cls: '' }
+      settings: { names: ['Change saved', 'Restarting to apply it', 'Applied'], cls: '' },
+      /* the GitHub sign-in wait, drawn inside its checklist step (task 1004548) */
+      signin: { names: ['Approve on GitHub', 'Placing credentials', 'Ready to sign in'], cls: '' }
     };
     /* No live-region attributes here: this strip is destroyed and rebuilt on
        every 5s tick, and a live region that is itself replaced never announces.
@@ -7171,6 +7229,13 @@ summary{min-height:24px;padding:3px 0;}
       /* restore the opt-out too — without it resolvedDomain() re-derives the
          assigned address and the done panel promises one that doesn't exist */
       state.noAddress = !!created.noaddr;
+      /* a hand-back from the callback page names the attempt GitHub just approved */
+      if (handbackState) {
+        created.manifest_state = handbackState;
+        if (created.manifest !== 'done') created.manifest = 'code_received';
+        rememberManifest(handbackState, created.manifest);
+        handbackState = null;
+      }
       /* the manifest leg's last known truth, kept across a reload */
       if (created.manifest) { live.manifest = created.manifest; live.appSlug = created.app_slug || null; }
       if (created.manifest_state && created.manifest !== 'done' && created.manifest !== 'error' && created.manifest !== 'expired') {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.28",
+  "version": "1.21.30",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.28",
+      "version": "1.21.30",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.28",
+  "version": "1.21.30",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8924,5 +8924,17 @@
       "id": "1004492",
       "text": "The Builders Hall now asks what you are doing when you arrive: Building, Artistry, Ideating or Governing, or Legacy mode for the hall exactly as it was. It asks once per session (or never again, if you untick the box), artists"
     }
+  ],
+  "1.21.29": [
+    {
+      "id": "1004548",
+      "text": "After approving GitHub sign-in, founders go straight back to their setup checklist to wait, and can tick a box to have their project open automatically when it's ready."
+    }
+  ],
+  "1.21.30": [
+    {
+      "id": "1004493",
+      "text": "The hall's sidebar now follows the mode you pick. Building shows the everyday tabs, Artistry shows Studio, Goals and Your thinking, Ideating shows the Sky, Your thinking and Goals, and Governing is the shortest list: Blockers,"
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.28'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.30'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/craft_mode_nav.mjs

@@ -0,0 +1,202 @@
+// tests/craft_mode_nav.mjs — the hall nav follows the craft mode (task 1004493,
+// goal 1000095 WA6).
+//
+// Each craft mode shows only the tabs its craft needs; Legacy mode and no mode
+// show every tab, exactly as before. The owner's rule (2026-10-01): some tabs
+// stay in EVERY mode, Builders first among them, written down as ONE shared list
+// that each mode's list adds to. These cases boot the REAL shell-trail.js +
+// craft-mode.js + shell.js and read the sidebar the shell actually rendered, so a
+// tab id that drifts from NAV, or a gate pass that runs after the mode and
+// re-shows a tab, reds here.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
+const SHELL = read('shell.js');
+const TRAIL = read('shell-trail.js');
+const CRAFT = read('craft-mode.js');
+
+// Every NAV id, and the Government group's, read from shell.js itself.
+const NAV_IDS = [...SHELL.matchAll(/\{ id: '([a-z-]+)', label:/g)].map((m) => m[1]);
+const GOV_BLOCK = SHELL.slice(SHELL.indexOf("{ group: 'Government'"));
+const GOV_IDS = [...GOV_BLOCK.slice(0, GOV_BLOCK.indexOf('] }')).matchAll(/\{ id: '([a-z-]+)'/g)].map((m) => m[1]);
+
+// A small element. Elements parsed from the sidebar's markup are built ONCE, so
+// what the gate loop writes (hidden) is what the mode pass reads back.
+function makeEl(tag) {
+  const attrs = {};
+  return {
+    tagName: tag, id: '', dataset: {}, style: {}, hidden: false, children: [], _html: '',
+    classList: { _s: new Set(), add(c) { this._s.add(c); }, remove(c) { this._s.delete(c); }, toggle(c, on) { if (on === undefined) on = !this._s.has(c); if (on) this._s.add(c); else this._s.delete(c); return on; }, contains(c) { return this._s.has(c); } },
+    setAttribute(k, v) { attrs[k] = String(v); }, getAttribute(k) { return k in attrs ? attrs[k] : null; },
+    hasAttribute(k) { return k in attrs; }, removeAttribute(k) { delete attrs[k]; },
+    addEventListener() {}, appendChild(c) { this.children.push(c); return c; }, removeChild() {}, insertBefore(c) { return c; },
+    focus() {}, closest() { return null; }, querySelector() { return null; }, querySelectorAll() { return []; },
+  };
+}
+// The rendered sidebar as groups of { head, items }.
+function parseSidebar(html) {
+  return html.split('<div class="nav-group').slice(1).map((chunk) => {
+    const group = makeEl('DIV');
+    const tag = (m, t) => {
+      const el = makeEl(t);
+      for (const a of m.matchAll(/([a-z-]+)="([^"]*)"/g)) {
+        if (a[1] === 'id') el.id = a[2];
+        else if (a[1].startsWith('data-')) el.dataset[a[1].slice(5)] = a[2];
+      }
+      el.hidden = /\shidden[\s>]/.test(m);
+      return el;
+    };
+    const headM = chunk.match(/<button type="button" class="nav-group__head"[^>]*>/);
+    const head = headM ? tag(headM[0], 'BUTTON') : null;
+    const items = [...chunk.matchAll(/<a class="nav-item"[^>]*>/g)].map((m) => tag(m[0], 'A'));
+    group.querySelector = (sel) => (sel === '.nav-group__head' ? head : null);
+    group.querySelectorAll = (sel) => (sel === '.nav-item' ? items : []);
+    return { el: group, head, items };
+  });
+}
+
+function boot({ session = {}, perms = { 'board.vote.cast': true } } = {}) {
+  const root = makeEl('HTML');
+  const topbar = makeEl('DIV');
+  const sidebar = makeEl('NAV');
+  const body = makeEl('BODY');
+  body.dataset.page = 'work';
+  let groups = null;
+  const parsed = () => (groups ||= parseSidebar(sidebar._html));
+  Object.defineProperty(sidebar, 'innerHTML', { set(v) { sidebar._html = String(v); groups = null; }, get() { return sidebar._html; } });
+  sidebar.querySelectorAll = (sel) => {
+    if (sel === '.nav-item') return parsed().flatMap((g) => g.items);
+    if (sel === '.nav-group') return parsed().map((g) => g.el);
+    return [];
+  };
+  const gated = () => parsed().flatMap((g) => (g.head ? [g.head, ...g.items] : g.items));
+  const els = { 'app-topbar': topbar, 'app-sidebar': sidebar };
+  const documentObj = {
+    body, referrer: '', documentElement: root, activeElement: null,
+    getElementById: (id) => els[id] || null,
+    querySelector: () => null,
+    querySelectorAll: (sel) => (sel === '#app-sidebar [data-gate]' ? gated() : []),
+    createElement: (t) => makeEl(t.toUpperCase()),
+    addEventListener() {}, removeEventListener() {}, dispatchEvent() { return true; },
+    get cookie() { return ''; }, set cookie(_v) {},
+  };
+  const location = { hostname: 'h', origin: 'https://h', href: 'https://h/work', pathname: '/work', hash: '', search: '', assign() {}, replace() {}, reload() {} };
+  const mk = (obj) => ({ getItem: (k) => (k in obj ? obj[k] : null), setItem: (k, v) => { obj[k] = String(v); }, removeItem: (k) => { delete obj[k]; } });
+  const windowObj = {
+    __BRANDING__: {}, __MODULES__: { enabled: { provisioning: true } },
+    BongosClient: { createClient: () => ({ request: () => new Promise(() => {}) }) },
+    matchMedia: () => ({ matches: false, addEventListener() {} }),
+    localStorage: mk({}), sessionStorage: mk(session), location,
+    clearTimeout() {}, setTimeout() { return 0; }, requestAnimationFrame() {}, scrollTo() {},
+    addEventListener() {}, dispatchEvent() { return true; },
+  };
+  const sandbox = {
+    window: windowObj, document: documentObj, location, console, URL, URLSearchParams, queueMicrotask,
+    setTimeout() { return 0; }, clearTimeout() {},
+    Event: class { constructor(t) { this.type = t; } },
+    CustomEvent: class { constructor(t, i) { this.type = t; Object.assign(this, i); } },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(TRAIL, sandbox, { filename: 'shell-trail.js' });
+  vm.runInContext(CRAFT, sandbox, { filename: 'craft-mode.js' });
+  vm.runInContext(SHELL, sandbox, { filename: 'shell.js' });
+  const shell = windowObj.OTBShell;
+  const craft = windowObj.OTBCraftMode;
+  const byId = (id) => parsed().flatMap((g) => g.items).find((a) => a.id === 'nav-' + id);
+  return {
+    craft, root,
+    signIn: (rank = 'archon') => shell.applyAccess({ authed: true, rank, permissions: perms, builder: { id: 7, rank } }),
+    // The tabs a reader can see: the gate let them through AND the mode kept them.
+    showing: () => parsed().flatMap((g) => g.items).filter((a) => !a.hidden && !a.hasAttribute('data-craft-off')).map((a) => a.id.slice(4)),
+    headShowing: (group) => {
+      const g = parsed().find((x) => x.head && x.head.dataset.group === group);
+      return !!g && !g.head.hidden && !g.head.hasAttribute('data-craft-off');
+    },
+    byId,
+  };
+}
+
+const CRAFTS = ['building', 'artistry', 'ideating', 'governing'];
+
+test('THE ALWAYS-PRESENT LIST: one shared list, Builders first, inside every mode', () => {
+  const { craft } = boot();
+  assert.equal(craft.ALWAYS_TABS[0], 'roster', 'Builders (NAV id roster) heads the list (owner, 2026-10-01)');
+  for (const m of CRAFTS) {
+    const tabs = craft.tabsFor(m);
+    assert.ok(Array.isArray(tabs), `${m} has a named tab list`);
+    for (const id of craft.ALWAYS_TABS) assert.ok(tabs.includes(id), `${m} keeps ${id}`);
+  }
+  assert.match(CRAFT, /return own \? ALWAYS_TABS\.concat\(own\) : null;/, 'each list is ALWAYS_TABS plus its own, not a copy of it');
+});
+
+test('every tab a mode names is a real NAV item, and every NAV item lives in some mode', () => {
+  const { craft } = boot();
+  assert.ok(NAV_IDS.length >= 25, `read ${NAV_IDS.length} NAV ids from shell.js`);
+  const named = new Set(CRAFTS.flatMap((m) => craft.tabsFor(m)));
+  for (const id of named) assert.ok(NAV_IDS.includes(id), `${id} is a NAV id`);
+  for (const id of NAV_IDS) assert.ok(named.has(id), `${id} is reachable from some mode's nav`);
+});
+
+test('Government shows only in Governing, and Governing is the shortest list', () => {
+  const { craft } = boot();
+  assert.ok(GOV_IDS.length >= 5, `read ${GOV_IDS.length} Government ids`);
+  for (const m of CRAFTS) {
+    for (const id of GOV_IDS) assert.equal(craft.tabsFor(m).includes(id), m === 'governing', `${id} in ${m}`);
+  }
+  const lengths = CRAFTS.map((m) => craft.tabsFor(m).filter((id) => !GOV_IDS.includes(id)).length);
+  assert.equal(Math.min(...lengths), lengths[CRAFTS.indexOf('governing')], 'outside its own Government group, Governing shows the fewest tabs');
+});
+
+test('NO MODE AND LEGACY ARE TODAY\'S NAV: every tab the gate allows, nothing marked', () => {
+  const none = boot();
+  none.signIn();
+  const all = none.showing();
+  assert.deepEqual(all, NAV_IDS, 'an archon with no mode sees every tab');
+  const legacy = boot({ session: { 'hall-craft': 'legacy' } });
+  legacy.signIn();
+  assert.deepEqual(legacy.showing(), all, 'Legacy mode shows exactly the same');
+  assert.equal(legacy.craft.tabsFor('legacy'), null);
+});
+
+test('each mode shows its own tabs, and switching updates the nav live', () => {
+  const p = boot();
+  p.signIn();
+  for (const m of CRAFTS) {
+    p.craft.choose(m);
+    assert.equal(p.root.dataset.craft, m);
+    assert.deepEqual(new Set(p.showing()), new Set(p.craft.tabsFor(m)), `${m} shows exactly its list`);
+    assert.ok(p.showing().includes('roster'), `Builders stays in ${m}`);
+    assert.equal(p.headShowing('government'), m === 'governing', `the Government head shows only where its tabs do (${m})`);
+  }
+  p.craft.choose('legacy');
+  assert.deepEqual(p.showing(), NAV_IDS, 'back to Legacy, every tab returns without a reload');
+});
+
+test('a mode never shows a tab the gate hid, and a later gate pass keeps the mode', () => {
+  const p = boot({ session: { 'hall-craft': 'governing' } });
+  p.signIn('thetes');
+  assert.ok(!p.showing().includes('watch'), 'a thetes in Governing does not get the metic-floored Watch tab');
+  assert.ok(!p.headShowing('government'), 'nor its group head');
+  assert.deepEqual(p.showing(), ['blockers', 'board-room', 'roster'], 'what a thetes board member in Governing sees');
+  p.signIn('archon');
+  assert.ok(p.showing().includes('watch'), 'promoted, the gate lets it through and the mode keeps it');
+  assert.ok(p.headShowing('government'), 'and its group head comes back with it, which only a mode pass after the gate can know');
+  assert.ok(!p.showing().includes('work'), 'and the gate pass did not bring back a tab the mode left out');
+});
+
+test('shell.js applies the mode AFTER its gate loop, and style.css hides what the mode leaves out', () => {
+  const body = SHELL.slice(SHELL.indexOf('function applyAccess('));
+  const gate = body.indexOf('el.hidden = !ok;');
+  const mode = body.indexOf('CRAFT.applyNav()');
+  assert.ok(gate > 0 && mode > gate, 'applyNav runs after the gate loop settles `hidden`');
+  assert.match(read('style.css'), /#app-sidebar \[data-craft-off\] \{ display: none !important; \}/);
+  assert.doesNotMatch(CRAFT, /\.hidden\s*=/, 'the mode never writes `hidden`, which the gate owns');
+});

package/tests/hall_tweak_editor.mjs

@@ -635,7 +635,7 @@ try {
     assert.match(HTML, /<body data-page="tweak-editor"[^>]*data-fullscreen-switch/);
     assert.equal((HTML.match(/<h1\b/g) || []).length, 1);
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
-    assert.match(HTML, /shell\.js\?v=2026-10-02-craft/);
+    assert.match(HTML, /shell\.js\?v=2026-10-03-nav/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
     for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-open-more', 'tw-divider', 'tw-openwrap', 'tw-open-menu', 'tw-open-tab', 'tw-open-split', 'tw-frame', 'tw-frame-view', 'tw-split-close', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = '8932abeda77f250a';
+const SHELL_SHA = 'af1c61ca87767b44';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);