@bongos/core 1.21.46 → 1.21.48

package/modules/hall-ui/public/commands-lib.js

@@ -24,7 +24,7 @@
     {
       key: 'find', label: 'Finding things out and working with others',
       blurb: 'Looking up what the project already knows, asking for help, and passing work on.',
-      names: ['status', 'recall', 'ask-for-help', 'collab-review', 'session-handoff', 'read-session-export', 'feedback'],
+      names: ['status', 'recall', 'ask-for-help', 'collab-review', 'session-handoff', 'read-session-export'],
     },
     {
       key: 'owner', label: 'Owner routines',

package/modules/hall-ui/public/street-card.css

@@ -108,8 +108,10 @@ body[data-page="street"] {
 
 .mcard-btn:focus-visible, .mcard-textbtn:focus-visible, .mcard-form__text:focus-visible, .mcard-form__select:focus-visible, .mcard-chip:focus-visible, .mcard-chips__field:focus-visible { outline: 2px solid var(--accent); outline-offset: 3px; }
 
-/* the toast: one short line over the street */
-.street-toast { position: absolute; left: 50%; top: 192px; transform: translateX(-50%); max-width: calc(100% - 32px); box-sizing: border-box; font-size: 15px; line-height: 1.35; color: var(--ink); padding: 11px 20px; border-radius: 999px; background: var(--bg-card); border: 1px solid var(--street-rule-strong); z-index: 10; pointer-events: none; text-align: center; }
+/* the toast: one short line over the street. Centred with translate, not
+   transform: the enter animation ends on transform none, which put the toast
+   half its width right of centre (task 1004562) */
+.street-toast { position: absolute; left: 50%; top: 192px; translate: -50% 0; max-width: calc(100% - 32px); box-sizing: border-box; font-size: 15px; line-height: 1.35; color: var(--ink); padding: 11px 20px; border-radius: 999px; background: var(--bg-card); border: 1px solid var(--street-rule-strong); z-index: 10; pointer-events: none; text-align: center; }
 .street-toast[hidden] { display: none; }
 
 /* the city answers: a building rises (the prototype's rise) or lights, a pin settles */
@@ -128,6 +130,10 @@ body[data-page="street"] {
 @media (max-width: 560px) {
   .street-toast { top: 96px; border-radius: 16px; }
 }
+/* the desk's toast after an act (Desks.dc.html, task 1004562): an ink pill with
+   the orange dot, low over the desk, just above the six readings */
+.street-toast--desk { top: auto; bottom: 150px; display: flex; align-items: center; gap: 10px; width: max-content; font-size: 14px; background: var(--ink); color: var(--bg); border: 0; border-radius: 999px; text-align: left; }
+.street-toast--desk::before { content: ''; flex: none; width: 8px; height: 8px; border-radius: 999px; background: var(--accent); }
 
 /* The Kill Switch: under reduced motion nothing moves; the street still
    answers, at rest (the toast, the new pins, the lit windows). */

package/modules/hall-ui/public/street-desk.js

@@ -96,6 +96,50 @@
     if (d < 14) return d + ' days';
     return Math.round(d / 7) + ' weeks';
   }
+  // The record line's age, in the board's short words: 'today', '3d', '2w', '1mo'
+  // (task 1004562: the long age was cut off the end of nearly every record item).
+  function shortAge(at, now) {
+    const t = at ? Date.parse(at) : NaN;
+    if (!isFinite(t) || !now) return '';
+    const d = Math.floor(Math.max(0, now - t) / 86400000);
+    if (d < 1) return 'today';
+    if (d < 14) return d + 'd';
+    if (d < 60) return Math.round(d / 7) + 'w';
+    return Math.round(d / 30) + 'mo';
+  }
+  // One record item: the title, then what came of it and when, in 30
+  // characters. The age always shows; the outcome only when the title fits
+  // beside it whole ('Lea → metic · 2w' on the board).
+  function recordText(h, now) {
+    const title = str(h && h.title).replace(/\s+/g, ' ').trim();
+    const age = shortAge(h && h.at, now);
+    const out = str(h && h.outcome).trim();
+    const tail = (parts) => parts.filter(Boolean).join(' · ');
+    const full = tail([title, out, age]);
+    if (full.length <= LIMITS.recordLen) return full;
+    const room = LIMITS.recordLen - (age ? age.length + 3 : 0);
+    return fit(tail([fit(title, room), age]), LIMITS.recordLen);
+  }
+  // A quiet floor's tile says what its number counts, in two words that read as
+  // a label: the floor line's own words when they follow that same number and
+  // are short ('5 seats'), else the floor's name ('3 testers', '2 signed off'),
+  // else the line's last two words ('1 went live'). Never the first two words of
+  // a longer line, which read 'Lu, Bo' or 'piece of' (task 1004562).
+  function floorLabel(count, line, name) {
+    const first = str(line).split(' · ')[0].replace(/\s+/g, ' ').trim();
+    const m = /^([$]?[0-9][0-9,.%]*)\s+(.+)$/.exec(first);
+    const same = !!m && m[1] === str(count).trim();
+    const w = (s) => s.split(' ').filter(Boolean);
+    if (same && w(m[2]).length <= LIMITS.tileWords) return m[2];
+    const nm = str(name).replace(/\s+/g, ' ').trim().toLowerCase();
+    if (nm && !/^§/.test(nm) && w(nm).length <= LIMITS.tileWords) return nm;
+    if (same) return w(m[2]).slice(-LIMITS.tileWords).join(' ');
+    return 'here';
+  }
+  // A count agrees with its noun: '1 rank', '2 open votes' (task 1004562).
+  const SINGULAR = Object.freeze({ ranks: 'rank', runners: 'runner', builders: 'builder', invites: 'invite', settings: 'setting', modules: 'module', backups: 'backup', updates: 'update' });
+  const PLURAL = Object.freeze({ 'open vote': 'open votes', update: 'updates' });
+  function agree(n, noun) { return Number(n) === 1 ? (SINGULAR[noun] || noun) : (PLURAL[noun] || noun); }
 
   // The words a floor counts its rows in, and says when it is cleared.
   const NOUNS = Object.freeze({
@@ -105,6 +149,10 @@
   const CLEAR = Object.freeze({
     access_requests: 'Everyone is in', goal_join_requests: 'No one is asking', override_requests: 'No overrides asked',
     gate_approvals: 'Everything ready is live', blockers: 'Nothing blocked on you', board: 'Every vote is in', idea: 'No ideas waiting',
+    // every other floor that holds matters says its own line too (task 1004562)
+    redteam_reports: 'No reports open', removal_proposals: 'No removals asked', grade_appeals: 'No appeals open',
+    module_rechecks: 'Every module checked', criteria_uat: 'Nothing waits for a tester', core_update: 'Core is up to date',
+    autobongos_fence: 'The switch is set', standing_rules: 'No rules proposed', treasury_spending: 'No spending asked',
   });
   // The card's acts under the desk's words (the board's button labels).
   const ACT_WORDS = Object.freeze({
@@ -246,7 +294,12 @@
     if (card && card.subject) card.subject.council = councilOf(ctx.docket, card.building) ? card.building : null;
     const actions = [];
     const choices = {};
+    // 'open' leaves for an older page: a row that can act here keeps its detail
+    // in place (tap the name) and drops the link; only a row with no act of its
+    // own may link out (owner standard, task 1004562)
+    const inPlace = acts.some((a) => a && a.key !== 'open' && a.key !== 'record');
     acts.forEach((a) => {
+      if (a.key === 'open' && inPlace) return;
       // the core's 'take' is its own word ('take it'), not the rank's 'take back'
       const word = a.key === 'take' && card.subject && card.subject.kind === 'core_pin' ? 'take_core' : a.key;
       if (actions.length >= LIMITS.actions || !ACT_WORDS[word]) return;
@@ -311,7 +364,18 @@
     // a desk row that stands in for a source (the core update's check-then-take)
     // replaces that source's matter rows on this floor
     const over = desked.map((r) => r.over).filter(Boolean);
-    return floorMatters(key, floor, docket).filter((m) => !done[str(m.id)] && over.indexOf(m.source) < 0).map((m) => rowOf(m, c))
+    const here = floorMatters(key, floor, docket).filter((m) => !done[str(m.id)]);
+    // the stand-in keeps what it stands for: a matter that needs you still
+    // needs you on the desk (orange status, its age), as on the floor's sign
+    // and the street's count (task 1004562)
+    desked.forEach((r) => {
+      if (!r.over) return;
+      const stood = here.filter((m) => m.source === r.over && stateOf(m) === 'needs');
+      if (!stood.length) return;
+      r.needs = true;
+      if (!r.opened) r.opened = stood.reduce((a, m) => (m.opened_at && (!a || Date.parse(m.opened_at) < Date.parse(a)) ? m.opened_at : a), null);
+    });
+    return here.filter((m) => over.indexOf(m.source) < 0).map((m) => rowOf(m, c))
       .concat(desked)
       .sort((a, b) => (b.needs - a.needs) || ((Date.parse(a.opened || 0) || 0) - (Date.parse(b.opened || 0) || 0)));
   }
@@ -400,9 +464,11 @@
     const quiet = rows.length === 0;
     let status, hot = false;
     if (!docket) status = 'the docket could not be read';
-    else if (needs.length) { hot = true; const age = ageWord(oldestOf(needs), o.now); status = needs.length + ' ' + noun + (age ? ' · oldest ' + age : ''); }
-    else if (counted.length) { const age = ageWord(oldestOf(counted), o.now); status = counted.length + ' ' + moving + (age ? ' · oldest ' + age : ''); }
-    else if (rows.length) status = fl.line;
+    else if (needs.length) { hot = true; const age = ageWord(oldestOf(needs), o.now); status = needs.length + ' ' + agree(needs.length, noun) + (age ? ' · oldest ' + age : ''); }
+    else if (counted.length) { const age = ageWord(oldestOf(counted), o.now); status = counted.length + ' ' + agree(counted.length, moving) + (age ? ' · oldest ' + age : ''); }
+    // only tools left (an invite, a setting): the floor's line, unless that line
+    // still counts what you just did ('1 needs you' after you let them in)
+    else if (rows.length) status = /needs? you/.test(str(fl.line)) ? 'nothing needs you' : fl.line;
     else if (cleared) status = 'floor clear';
     else status = 'nothing needs you · ' + fl.line;
     const history = docket && Array.isArray(docket.history) ? docket.history.filter((h) => h && h.building === o.key) : [];
@@ -419,13 +485,16 @@
       // the order's one number: the share of its goals' promises kept
       const on = ordered.reduce((a, r) => a + (r.pips || []).filter((p) => p.on).length, 0);
       const of = ordered.reduce((a, r) => a + (r.pips || []).length, 0);
-      tile(needs.length, noun);
+      tile(needs.length, agree(needs.length, noun));
       if (of) tile(Math.round((100 * on) / of) + '%', 'promises kept');
-    } else if (rows.length) { tile(needs.length, noun); tile(counted.length - needs.length, moving); }
-    else if (fl.count) tile(fl.count, str(fl.line).replace(/^[$]?[0-9][0-9,.%]*\s*/, '') || 'on this floor');
+    } else if (rows.length) { tile(needs.length, agree(needs.length, noun)); tile(counted.length - needs.length, agree(counted.length - needs.length, moving)); }
+    // a quiet floor's own number; never on a floor you just cleared, and never a
+    // 'needs you' count on a floor where nothing does (task 1004562)
+    else if (fl.count && !cleared && !/needs? you/.test(str(fl.line))) tile(fl.count, floorLabel(fl.count, fl.line, spec[0]));
     tile(history.length, 'on record');
-    const record = (o.mine || []).map((t, i) => ({ key: 'm' + i, text: fit(t + ' · now', LIMITS.recordLen), mine: true }))
-      .concat(history.map((h, i) => ({ key: 'h' + i, text: fit([h.title, h.outcome, ageWord(h.at, o.now)].filter(Boolean).join(' · '), LIMITS.recordLen), mine: false })))
+    // what you did keeps its ' · now'; a closed item keeps its age (task 1004562)
+    const record = (o.mine || []).map((t, i) => ({ key: 'm' + i, text: fit(t, LIMITS.recordLen - 6) + ' · now', mine: true }))
+      .concat(history.map((h, i) => ({ key: 'h' + i, text: recordText(h, o.now), mine: false })))
       .slice(0, LIMITS.record);
     return {
       key: o.key + ':' + floor, building: o.key, floor: floor, name: spec[0], sym: o.sym || { d: '', f: '' },

package/modules/hall-ui/public/street.css

@@ -344,7 +344,10 @@ html[data-fullscreen="on"] .street-top { padding-right: 184px; }
 .desk-quiet--cleared .desk-quiet__tick { stroke: var(--street-accent-text); }
 .desk-quiet__line { font-size: 20px; font-weight: 300; }
 .desk-quiet__sub { font-size: 13.5px; color: var(--ink-faint); }
-.desk-record { display: flex; align-items: baseline; flex-wrap: wrap; gap: 8px 22px; border-top: 1px solid var(--street-rule); margin-top: 18px; padding-top: 14px; }
+/* the record is ONE line, as on the board: items that do not fit wrap onto a
+   second line that is clipped away, so the newest stay and none is cut in half
+   (task 1004562) */
+.desk-record { display: flex; align-items: baseline; flex-wrap: wrap; gap: 0 22px; border-top: 1px solid var(--street-rule); margin-top: 18px; padding-top: 14px; box-sizing: border-box; line-height: 20px; max-height: 35px; overflow: hidden; }
 .desk-record__label { font-size: 11.5px; letter-spacing: 0.12em; text-transform: uppercase; color: var(--ink-faint); }
 .desk-record__item { font-size: 13px; color: var(--ink-faint); white-space: nowrap; }
 .desk-record__item--mine { color: var(--ink); }

package/modules/hall-ui/public/street.js

@@ -707,11 +707,11 @@
     draw();
     return send(req).then(function (out) {
       desk.busy = false;
-      if (!out.ok) { say(C.refusal(out.status, out.body)); draw(); return false; }
+      if (!out.ok) { say(C.refusal(out.status, out.body), true); draw(); return false; }
       desk.order[k] = null;
       desk.mine[k] = [dm.save.council ? 'order sent to council' : 'order set'].concat(desk.mine[k] || []);
       bumpToday();
-      say(dm.save.said);
+      say(dm.save.said, true);
       draw();
       return load().then(function () { return true; });
     });
@@ -760,7 +760,7 @@
     var C = window.GovMatterCard, st = view.inside;
     if (!C || !st || !r.card || desk.busy) return Promise.resolve(false);
     var refused = C.check(r.card, key, input);
-    if (refused) { say(refused); return Promise.resolve(false); }
+    if (refused) { say(refused, true); return Promise.resolve(false); }
     var k = st.key + ':' + (view.insideModel ? view.insideModel.selFloor : 0);
     var req = C.request(r.card, key, input);
     var settle = function (body) {
@@ -774,14 +774,14 @@
       if (st.floor == null && view.insideModel) st.floor = view.insideModel.selFloor;
       bumpToday();
       if (a.building && a.kind) card.answer = { building: a.building, matter: r.matter, kind: a.kind, at: Date.now() };
-      say(a.toast || 'Done.');
+      say(a.toast || 'Done.', true);
     };
     if (!req) return new Promise(function (res) { clearRow(r.key, function () { settle({}); draw(); res(true); }); });
     desk.busy = true;
     draw();
     return send(req).then(function (out) {
       desk.busy = false;
-      if (!out.ok) { say(C.refusal(out.status, out.body)); draw(); return false; }
+      if (!out.ok) { say(C.refusal(out.status, out.body), true); draw(); return false; }
       return new Promise(function (res) {
         clearRow(r.key, function () {
           settle(out.body);
@@ -1230,9 +1230,12 @@
     for (var j = 0; j < pins.length; j++) if (String(pins[j].getAttribute('data-matters') || pins[j].getAttribute('data-matter')).split(' ').indexOf(a.matter) >= 0) pins[j].className += ' street-pin--answer';
   }
   var toastTimer = null;
-  function say(text) {
+  // desk: the Desks board's toast after an act on a floor (an ink pill with the
+  // orange dot, low over the desk); the street's own toast otherwise (task 1004562)
+  function say(text, desk) {
     var t = $('streetToast');
     if (!t || !text) return;
+    t.className = 'street-toast' + (desk ? ' street-toast--desk' : '');
     t.textContent = text;
     t.hidden = false;
     if (typeof setTimeout !== 'function') return;

package/modules/hall-ui/records/governor-street.md

@@ -33,3 +33,17 @@ Files: `street-inside.js` (`window.GovInside`, node-require-safe, pure): the pro
 - **Narrow.** Under 900 px the board becomes a column: the drawing in its own sideways strip (never scaled under 0.6, so a floor stays a 24 px target), then the panel.
 
 Tests: `tests/hall_street_inside.mjs` runs the prototype's own `Component` beside `street-inside.js` on the prototype's sample floors and holds every building's section, panel bindings and every district equal to it in both modes, then the docket rules (no invented numbers) and the page in a vm (the persistent lift, the flip, the drawers, the amendment note, the card from a table row, back to the street, a district's tasks). The states file renders every building, a floor pick, the amendment note and a district.
+
+## The floor desks, walked (task 1004562)
+
+Every building and every floor desk was walked in light, dark and at phone width (375 px) against `Desks.dc.html` and the line rule of `Ground.dc.html`. The live site is behind its password gate, so the walk ran on the real pages in the hall preview harness with its fixtures. What it settled:
+
+- **A quiet floor's tile says what it counts.** Two words that read as a label: the floor line's own noun when it follows the same number ("5 seats"), else the floor's name ("3 testers", "2 signed off"), else the line's last two words ("1 went live"). Never the first two words of a longer line ("3 Lu, Bo", "1 piece of"). `floorLabel()` in `street-desk.js`.
+- **A cleared floor shows no count of the work just done.** The docket's floor count lags the act, so a cleared floor draws no floor-count tile, and a floor left with only a tool (the invite) does not repeat a stale "1 needs you" as its status. Floors that hold matters each say their own clear line ("No removals asked").
+- **Counts agree with their nouns**: "2 open votes", "1 rank".
+- **The record is one line.** Each item keeps its age in the board's short words ("· 3d", "· 2w"); the outcome shows only when the title fits beside it; what you did keeps its "· now". Items that do not fit wrap onto a clipped second line, so none is cut in half.
+- **A stand-in row keeps the need it stands for.** The Release desk's core row replaces the core-update matter; it now carries that matter's need, so the status is orange where the floor sign and the street count already said "needs you".
+- **No link out beside an act.** A row that can act in place drops the server's `open` act; its detail opens in place by its name. A row with no act of its own (a Full Idea that needs its page to finish, Work categories) still links, as the standard allows.
+- **The desk's toast is the board's**: an ink pill with the orange dot, low over the desk. The street's own toast is centred again (its enter animation had undone the centring).
+
+Left as found, on purpose: the six readings stay under a building (task 1004526 marks the building's own reading), the old month drawers stay under the desk, and the recording sign-off still goes to its page (an open owner choice).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.46",
+  "version": "1.21.48",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.46",
+      "version": "1.21.48",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.46",
+  "version": "1.21.48",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9040,5 +9040,21 @@
       "id": "1004572",
       "text": "Setting up GitHub sign-in for a new project now says what is really happening at each step, and always leaves a way forward if it gets stuck."
     }
+  ],
+  "1.21.47": [
+    {
+      "id": "1004562",
+      "text": "Walked every building and floor desk of the Governor City in light, dark and on a phone, and fixed what did not match the design: number tiles now say what they count, a cleared floor no longer shows a stale count, counts read"
+    }
+  ],
+  "1.21.48": [
+    {
+      "id": "1004576",
+      "text": "Saying \"Bongos feedback: …\" or suggesting how Bongos should behave now reliably sends it to the Bongos team; an unused leftover skill that confused this was removed."
+    },
+    {
+      "id": "1004573",
+      "text": "A project brought in from an existing repo now always picks up the sign-in and settings the platform gives it, instead of silently ignoring them."
+    }
   ]
 }

package/scripts/gds/pack-env-prefix.js

@@ -0,0 +1,73 @@
+'use strict';
+
+// scripts/gds/pack-env-prefix.js — which env-var names a hosted project reads, and
+// whether its own pack agrees with what the provisioning runner writes (task 1004573).
+//
+// WHY. The runner writes every hosted project's /etc/<slug>/web.env under ONE prefix
+// (provisionedEnvPrefix). A project ADOPTED from an existing repo brings its own
+// config/branding.json, and mercury's said envPrefix CLOUDBONGOS while web.env carried
+// BONGOS_* — so the project read none of its sign-in credentials, its address or any
+// setting, and the only symptom anyone saw was "did not report sign-in ready".
+//
+// Its own file because both provision-units.js (web.env) and provision-repo.js (the
+// adopt scaffold) need it, and provision-units already requires provision-repo — a
+// helper living in either would make a require cycle. Requires only provision-config.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { REPO_ROOT } = require('./provision-config.js');
+
+// The pack whose envPrefix a provisioned instance inherits unless its own pack says
+// otherwise (see the long note on ENV_PREFIX_PACK's history in provision-units.js).
+const ENV_PREFIX_PACK = 'config/branding.neutral.json';
+
+// The env-var prefix a provisioned instance actually RESOLVES — i.e. the envPrefix
+// of the pack it loads (ENV_PREFIX_PACK). src/instance-config.resolveEnv
+// reads <envPrefix>_<SUFFIX>, and src/branding.resolveBranding applies
+// <envPrefix>_{PUBLIC,BUILDERS,…}_ORIGIN overrides — so a web.env var only takes
+// effect under THIS prefix. Read from the pack (fail-soft to the vanilla default)
+// so it stays in lockstep instead of a magic string. (The prior slug-based prefix
+// was a latent bug: it never matched the neutral pack's CLOUDBONGOS envPrefix, so
+// the OAuth creds were silently unreadable — task 1972.)
+function provisionedEnvPrefix() {
+  const { FALLBACK_ENV_PREFIX } = require('../../src/instance-config'); // eslint-disable-line global-require
+  try {
+    const pack = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, ENV_PREFIX_PACK), 'utf8'));
+    return pack.envPrefix || FALLBACK_ENV_PREFIX;
+  } catch { return FALLBACK_ENV_PREFIX; }
+}
+
+// The envPrefix a pack's text names, or null (no pack, not JSON, no envPrefix).
+function packEnvPrefix(packText) {
+  try {
+    const pack = JSON.parse(String(packText || ''));
+    return pack && typeof pack.envPrefix === 'string' ? pack.envPrefix : null;
+  } catch { return null; }
+}
+
+// Does the instance's OWN pack read the names this runner writes? PURE: give it the
+// pack's text (or null when it could not be read) and the prefix written; it returns
+// a sentence naming the mismatch, or null when the names agree or the pack says nothing.
+function envPrefixMismatch(packText, written = provisionedEnvPrefix()) {
+  const own = packEnvPrefix(packText);
+  if (!own || own === written) return null;
+  return `the project's config/branding.json reads settings named ${own}_*, but the platform wrote ${written}_* — set its envPrefix to "${written}"`;
+}
+
+// The adopt scaffold's half of the fix: rewrite ONLY the envPrefix value in an adopted
+// repo's config/branding.json so the project reads the names this runner writes,
+// leaving every other byte of the owner's file as they wrote it (a JSON round-trip
+// would reflow it). PURE. Returns { text, from } when it changed something, or null
+// when the names already agree, the pack names no prefix, or it is not JSON.
+function normalizePackEnvPrefix(packText, written = provisionedEnvPrefix()) {
+  const raw = String(packText || '');
+  const own = packEnvPrefix(raw);
+  if (!own || own === written) return null;
+  const re = /("envPrefix"\s*:\s*)"[^"]*"/;
+  if (!re.test(raw)) return null;
+  const text = raw.replace(re, (_m, key) => `${key}"${written}"`);
+  if (packEnvPrefix(text) !== written) return null;
+  return { text, from: own };
+}
+
+module.exports = { ENV_PREFIX_PACK, provisionedEnvPrefix, envPrefixMismatch, normalizePackEnvPrefix };

package/scripts/gds/provision-repo.js

@@ -19,6 +19,7 @@ const { CONFIG, REPO_ROOT, coreVersionSafe, provisionerBotEmail, provisionerBotN
 // upgrade.js can reach these three without pulling provision*.js into the merge
 // resolver's executed closure; re-exported below so every existing caller is unchanged.
 const { instanceRepoRemote, parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo-auth.js');
+const { normalizePackEnvPrefix } = require('./pack-env-prefix.js');   // an adopted pack's envPrefix (task 1004573)
 const { CORE_PKG, compareSemver, isStable } = require('./update-channel.js');
 
 function dbName(inst) { return inst.db_name || inst.slug; }
@@ -832,6 +833,18 @@ async function scaffoldStandaloneRepo(inst, deps) {
     } else {
       writeFile(giPath, INSTANCE_GITIGNORE);
     }
+    // Adopt layers config only where ABSENT, so an owner's existing config/branding.json
+    // keeps whatever envPrefix it carried — and web.env is written under the platform's.
+    // Mercury's said CLOUDBONGOS: it read none of its credentials or settings (task 1004573).
+    // Rewrite just that one value, in this same commit, so the repo and web.env agree.
+    const packPath = path.join(root, 'config', 'branding.json');
+    if (mode === 'adopt' && fs.existsSync(packPath)) {
+      const fixed = normalizePackEnvPrefix(fs.readFileSync(packPath, 'utf8'));
+      if (fixed) {
+        writeFile(packPath, fixed.text);
+        log(`  [scaffold] config/branding.json envPrefix ${fixed.from} → the platform's, so the project reads the settings it is given`);
+      }
+    }
     exec(`git -C ${root} config user.name "${provisionerBotName()}"`);
     exec(`git -C ${root} config user.email "${provisionerBotEmail()}"`);
     exec(`git -C ${root} add -A`);

package/scripts/gds/provision-units.js

@@ -162,23 +162,10 @@ WantedBy=timers.target
 // branding-file env line is written at all. Reading the neutral pack HERE is still correct: it is
 // the prefix floor an instance inherits unless its own pack overrides envPrefix, and every live
 // co-tenant pack pins `envPrefix: "CLOUDBONGOS"` explicitly.
-const ENV_PREFIX_PACK = 'config/branding.neutral.json';
-
-// The env-var prefix a provisioned instance actually RESOLVES — i.e. the envPrefix
-// of the pack it loads (ENV_PREFIX_PACK). src/instance-config.resolveEnv
-// reads <envPrefix>_<SUFFIX>, and src/branding.resolveBranding applies
-// <envPrefix>_{PUBLIC,BUILDERS,…}_ORIGIN overrides — so a web.env var only takes
-// effect under THIS prefix. Read from the pack (fail-soft to the vanilla default)
-// so it stays in lockstep instead of a magic string. (The prior slug-based prefix
-// was a latent bug: it never matched the neutral pack's CLOUDBONGOS envPrefix, so
-// the OAuth creds were silently unreadable — task 1972.)
-function provisionedEnvPrefix() {
-  const { FALLBACK_ENV_PREFIX } = require('../../src/instance-config');
-  try {
-    const pack = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, ENV_PREFIX_PACK), 'utf8'));
-    return pack.envPrefix || FALLBACK_ENV_PREFIX;
-  } catch { return FALLBACK_ENV_PREFIX; }
-}
+// ENV_PREFIX_PACK + provisionedEnvPrefix (and the task-1004573 pack checks) live in
+// pack-env-prefix.js — provision-repo.js needs them too, and it cannot require this file
+// (this file requires it). Re-exported below so every existing caller is unchanged.
+const { ENV_PREFIX_PACK, provisionedEnvPrefix, envPrefixMismatch, normalizePackEnvPrefix } = require('./pack-env-prefix.js');
 
 // The per-instance secrets file body (the standup runbook's /etc/<inst>/web.env).
 // The OAuth client id/secret are GUIDED/manual inputs (no GitHub create-API) — the
@@ -430,6 +417,8 @@ function renamedEnvCarry(body) {
 
 module.exports = {
   ENV_PREFIX_PACK,
+  envPrefixMismatch,
+  normalizePackEnvPrefix,
   backupScriptPath,
   backupService,
   backupServicePath,

package/scripts/gds/provision.js

@@ -50,7 +50,7 @@ const crypto = require('node:crypto');
 const retry = require('./intent-retry.js'); // when a failed intent is tried again (task 1004447)
 const { CONFIG, MANIFEST_UA, softFailResult, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { accountPreflight, appUser, alreadyScaffolded, buildCorePinRefreshCommit, coreCheckoutHasGit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
-const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, renamedEnvCarry, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
+const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, envPrefixMismatch, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, renamedEnvCarry, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, ingressPlaneGap, ingressPreflight, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { resolveProcessManager } = require('./provision-process.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
@@ -1097,7 +1097,13 @@ async function placeManifestCreds(inst, mrow, deps) {
     if (!authConfigured) {
       // The App now EXISTS on the owner's account — keep its id + slug on the row so
       // the wizard can name it and say why "try again" makes a second one (task 1004572).
-      return { ok: false, codeSpent: true, appId: creds.appId, appSlug: creds.appSlug, error: 'the credentials are placed, but the project did not report sign-in ready in time' };
+      // Say WHY when we can see it: an adopted repo's own pack may read other names (task 1004573).
+      // A cloud-host checkout lives on the control plane (the scaffold reads it the same way), so
+      // this is a plain file read — no shell. An unreadable or non-JSON pack names nothing.
+      let packText = null;
+      if (standalone) { try { packText = (deps.readFile || fs.readFileSync)(path.join(standaloneRoot(inst), 'config', 'branding.json'), 'utf8'); } catch { packText = null; } }
+      const why = envPrefixMismatch(packText);
+      return { ok: false, codeSpent: true, appId: creds.appId, appSlug: creds.appSlug, error: `the credentials are placed, but the project did not report sign-in ready in time${why ? ` — ${why}` : ''}` };
     }
     log('  [oauth-manifest] ✓ /healthz auth_configured=true — sign-in is live');
   } else {

package/src/instance-config.js

@@ -190,7 +190,7 @@ function readConfigFileSync(name, { encoding = 'utf8', b = safeBrand() } = {}) {
 // per process naming the old spelling, the new one, and the release the old
 // stops working in; see warnLegacyEnv below. `warn` is injectable so a test can
 // assert the warning fires rather than only that the value resolves.
-function resolveEnv(suffix, { env = process.env, prefix = envPrefix(), legacy = LEGACY_ENV_PREFIXES, warn = warnLegacyEnv } = {}) {
+function resolveEnv(suffix, { env = process.env, prefix = envPrefix(), legacy = LEGACY_ENV_PREFIXES, warn = warnLegacyEnv, warnPack = warnPackPrefix } = {}) {
   const canonical = `${prefix}_${suffix}`;
   const canonicalValue = prefix ? env[canonical] : undefined;
   const canonicalSet = canonicalValue !== undefined && canonicalValue !== '';
@@ -200,6 +200,22 @@ function resolveEnv(suffix, { env = process.env, prefix = envPrefix(), legacy =
   // on the winner would leave the "both set" operator with no notice at all.
   const seen = new Set([prefix].filter(Boolean));
   let winner = canonicalSet ? canonicalValue : undefined;
+  // THE PLATFORM'S SPELLING IS ALWAYS HEARD (task 1004573). The platform writes
+  // every hosted project's web.env as BONGOS_* whatever that project's own pack
+  // says. A project adopted from a repo whose config/branding.json still carried
+  // envPrefix CLOUDBONGOS read none of it — not its sign-in credentials, not its
+  // address, not one setting its owner chose — and nothing said so (mercury,
+  // 2026-10-04). So when the pack names another prefix, BONGOS_* is read right
+  // after it, ahead of the legacy list. The pack's own spelling still wins.
+  if (prefix && prefix !== FALLBACK_ENV_PREFIX) {
+    seen.add(FALLBACK_ENV_PREFIX);
+    const name = `${FALLBACK_ENV_PREFIX}_${suffix}`;
+    const v = env[name];
+    if (!canonicalSet && v !== undefined && v !== '') {
+      winner = v;
+      warnPack({ prefix, name });
+    }
+  }
   for (const pfx of legacy) {
     if (!pfx || seen.has(pfx)) continue;
     seen.add(pfx);
@@ -229,6 +245,17 @@ function warnLegacyEnv({ legacyName, canonicalName, shadowed, differs, log = con
   return true;
 }
 
+// One line per process when a value had to come from the platform's BONGOS_*
+// spelling because this project's pack names another prefix. Not a deprecation —
+// BONGOS_ is the canonical name — so it says what to change instead: the pack.
+let _packPrefixWarned = false;
+function warnPackPrefix({ prefix, name, log = console } = {}) {
+  if (_packPrefixWarned) return false;
+  _packPrefixWarned = true;
+  log.warn(`[bongos] config/branding.json sets envPrefix "${prefix}", but ${name} (the platform's spelling) is what is set — reading it. Set envPrefix to "${FALLBACK_ENV_PREFIX}" to match.`);
+  return true;
+}
+
 // NOT exported, deliberately: warnLegacyEnv, LEGACY_ENV_SUNSET_RELEASE and the
 // ledger are internals. resolveEnv's injectable `warn` is the whole test seam a
 // caller needs, and a test of the DEFAULT path captures console.warn — which

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.46'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.48'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');