@bongos/core 1.21.5 → 1.21.6

package/scripts/gds/provision-repo.js

@@ -19,6 +19,7 @@ const { CONFIG, REPO_ROOT, coreVersionSafe, provisionerBotEmail, provisionerBotN
 // upgrade.js can reach these three without pulling provision*.js into the merge
 // resolver's executed closure; re-exported below so every existing caller is unchanged.
 const { instanceRepoRemote, parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo-auth.js');
+const { CORE_PKG, compareSemver, isStable } = require('./update-channel.js');
 
 function dbName(inst) { return inst.db_name || inst.slug; }
 
@@ -500,8 +501,49 @@ function coreCheckoutHasGit({ repoRoot = REPO_ROOT, fsImpl = fs } = {}) {
   return fsImpl.existsSync(path.join(repoRoot, '.git'));
 }
 
+// The core version THIS control plane runs — what the ladder below would vend: the
+// pinned tarball's version, else the registry-installed package's, else the checkout's
+// CORE_VERSION. fs reads only → dry-run safe.
+function runningCoreVersion({ instanceRoot, coreV }) {
+  const pinned = installedCoreTarball({ instanceRoot });
+  if (pinned) return require('./upgrade').versionFromTgzPath(path.basename(pinned)) || coreV;
+  const packSrc = installedCorePackDir({ instanceRoot });
+  return packSrc ? packSrc.version : coreV;
+}
+
+// Which core a hosted project is given (task 1004299, ADR 0361 D5). PURE. Since merges
+// publish as candidates, the platform hall runs ahead of the registry's `latest` label by
+// design — and the ladder below vends whatever the hall runs, so every new project would
+// be born on a version nobody released. When the hall is AHEAD of the release, the project
+// gets the release instead. Equal (or the hall behind it, which a release can't normally
+// produce) → the running core, byte-exact, as before.
+//
+// No readable label → the running core, deliberately (fail-open). Until candidates are
+// armed the running core IS the release; vendoring is the path that works with no
+// registry at all (ADR 0292); and refusing project creation over a registry blip is worse
+// for the person creating it than a newer-than-released core in the rare outage window.
+function projectCoreDecision({ running, released }) {
+  if (!released || !isStable(released)) return { version: running, source: 'running', reason: 'no readable released (latest) label — using the core this hall runs' };
+  if (compareSemver(running, released) > 0) return { version: released, source: 'released', reason: `this hall runs ${running}, ahead of the release` };
+  return { version: running, source: 'running', reason: `this hall runs the released core ${released}` };
+}
+
+// The I/O half: read the `latest` label through the injected exec (so a dry run and the
+// test harness's stub exec never touch the network), then decide. `npm view` is fine
+// here — provisioning is a runner script, not a request handler (ADR 0293's objection).
+function projectCoreTarget({ instanceRoot, coreV, exec, log, tag = '[core]' }) {
+  const running = runningCoreVersion({ instanceRoot, coreV });
+  const res = exec(`npm view ${CORE_PKG} dist-tags.latest`, { allowFail: true });
+  const label = String((res && res.ok !== false && res.stdout) || '').trim();
+  const decision = projectCoreDecision({ running, released: label || null });
+  log(`  ${tag} ${decision.source === 'released' ? `giving the project the RELEASED core ${decision.version}` : `giving the project core ${decision.version}`} — ${decision.reason} (task 1004299)`);
+  return decision;
+}
+
 // Resolve a vendorable @bongos/core tarball — the four-rung ladder, freshest-correct
-// first, shared by the fresh scaffold and the re-provision pin refresh (task 1003050):
+// first, shared by the fresh scaffold and the re-provision pin refresh (task 1003050).
+// A `target` from projectCoreTarget with source 'released' short-circuits it: the
+// project gets the released version packed from the registry, not this hall's core.
 //   1. a `file:`-pinned control plane reuses its own pinned tarball (task 1002275 —
 //      rebuilding via package-core.js aborts with an EMPTY core set when this runner
 //      IS a consumer instance, leaving new repos empty);
@@ -516,7 +558,16 @@ function coreCheckoutHasGit({ repoRoot = REPO_ROOT, fsImpl = fs } = {}) {
 //      rung 3's reproducible build is the better answer for the identical file set.
 // Returns { tgz, packDest } — packDest (set only on rung 2) is a temp dir the CALLER
 // must `rm -rf` once the tarball has been vendored.
-function resolveVendorableCoreTarball({ instanceRoot, repoRoot = REPO_ROOT, exec, log, coreV, tag = '[core]' }) {
+function resolveVendorableCoreTarball({ instanceRoot, repoRoot = REPO_ROOT, exec, log, coreV, tag = '[core]', target = null }) {
+  if (target && target.source === 'released') {
+    // target.version passed isStable (digits and dots only), so it is shell-safe.
+    const v = target.version;
+    const packDest = path.join(os.tmpdir(), `bongos-core-released-${v}`);
+    log(`  ${tag} packing the released core ${v} from the registry — not the candidate this hall runs (task 1004299)`);
+    exec(`mkdir -p ${packDest}`);
+    exec(`npm pack ${CORE_PKG}@${v} --pack-destination ${packDest}`);
+    return { tgz: path.join(packDest, `bongos-core-${v}.tgz`), packDest };
+  }
   const pinned = installedCoreTarball({ instanceRoot });
   if (pinned) {
     log(`  ${tag} reusing the pinned core tarball this control plane runs (${path.basename(pinned)}) — no source rebuild (task 1002275)`);
@@ -629,9 +680,12 @@ async function scaffoldStandaloneRepo(inst, deps) {
     throw new Error('cannot resolve the core version (src/module-api CORE_VERSION) — run the scaffold from the control-plane checkout.');
   }
   const remote = instanceRepoRemote(repo);
+  // The released core, not this hall's candidate (task 1004299).
+  const target = projectCoreTarget({ instanceRoot: deps.instanceRoot, coreV, exec, log, tag: '[scaffold] core:' });
+  const pinV = target.version;
   log(mode === 'adopt'
-    ? `  [scaffold] ${repo.owner}/${repo.name} → ${root} (ADOPT: clone → layer additively → pin core ${coreV} → commit → fast-forward push)`
-    : `  [scaffold] ${repo.owner}/${repo.name} → ${root} (clone → materialize → pin core ${coreV} → commit → push)`);
+    ? `  [scaffold] ${repo.owner}/${repo.name} → ${root} (ADOPT: clone → layer additively → pin core ${pinV} → commit → fast-forward push)`
+    : `  [scaffold] ${repo.owner}/${repo.name} → ${root} (clone → materialize → pin core ${pinV} → commit → push)`);
 
   // Owner login = the founding firstAdmin. Best-effort; the spec falls back to the repo owner.
   const ownerLogin = await ownerLoginOf(inst, db);
@@ -743,7 +797,7 @@ async function scaffoldStandaloneRepo(inst, deps) {
     // Vendored tarball — resolveVendorableCoreTarball's four-rung ladder (shared
     // with the re-provision pin refresh, task 1003050).
     const { tgz, packDest } = resolveVendorableCoreTarball({
-      instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[scaffold] core install:',
+      instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[scaffold] core install:', target,
     });
     exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed ${modeFlags} --vendor-core ${tgz}`);
     // init --vendor-core COPIED the tarball into the child's vendor/ — the temp pack dir is spent.
@@ -775,8 +829,8 @@ async function scaffoldStandaloneRepo(inst, deps) {
     exec(`git -C ${root} config user.email "${provisionerBotEmail()}"`);
     exec(`git -C ${root} add -A`);
     const commitMsg = mode === 'adopt'
-      ? `chore: adopt Cloud Bongos onto ${inst.slug} on a pinned @bongos/core ${coreV} (provision.js, ADR 0121)`
-      : `chore: scaffold ${inst.slug} on a pinned @bongos/core ${coreV} (provision.js, ADR 0108)`;
+      ? `chore: adopt Cloud Bongos onto ${inst.slug} on a pinned @bongos/core ${pinV} (provision.js, ADR 0121)`
+      : `chore: scaffold ${inst.slug} on a pinned @bongos/core ${pinV} (provision.js, ADR 0108)`;
     exec(`git -C ${root} commit -m "${commitMsg}"`, { allowFail: true });
 
     // Push. NO --force on either path, ever (see the function header): the ADR 0155 `repo`
@@ -1078,16 +1132,23 @@ async function refreshStandaloneCorePin(inst, deps) {
   let pkg = null;
   try { pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')); } catch { /* unreadable → skip below */ }
   const pinnedDep = pkg && ((pkg.dependencies || {})['@bongos/core'] || (pkg.devDependencies || {})['@bongos/core']);
-  const plan = planCorePinRefresh({ pinnedDep, coreVersion: coreV });
-  if (plan.action === 'skip') { log(`  [core-pin] ${plan.reason}`); return plan; }
-  if (plan.action === 'current') { log(`  [core-pin] committed pin already matches the running core (${coreV})`); return plan; }
-  log(`  [core-pin] committed pin ${safeVersionLabel(plan.pinned)} trails this control plane's core ${coreV} — refreshing so the next repo-driven deploy cannot roll the instance back (task 1003050)`);
+  if (!/^file:/.test(String(pinnedDep || '').trim())) {
+    const plan = planCorePinRefresh({ pinnedDep, coreVersion: coreV });
+    log(`  [core-pin] ${plan.reason}`); return plan;
+  }
+  // Heal toward the core a project is GIVEN — the release when this hall runs ahead of it —
+  // or the pin a brand-new project was just born on is bumped straight back to the
+  // candidate in the same provisioning run (task 1004299).
+  const target = projectCoreTarget({ instanceRoot: deps.instanceRoot, coreV, exec, log, tag: '[core-pin]' });
+  const plan = planCorePinRefresh({ pinnedDep, coreVersion: target.version });
+  if (plan.action === 'current') { log(`  [core-pin] committed pin already matches the core this project is given (${target.version})`); return plan; }
+  log(`  [core-pin] committed pin ${safeVersionLabel(plan.pinned)} differs from the core this project is given (${target.version}) — refreshing so the next repo-driven deploy cannot roll the instance back (task 1003050)`);
 
   const { tgz, packDest } = resolveVendorableCoreTarball({
-    instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[core-pin]',
+    instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[core-pin]', target,
   });
   try {
-    const targetVersion = upgrade.versionFromTgzPath(path.basename(tgz)) || coreV;
+    const targetVersion = upgrade.versionFromTgzPath(path.basename(tgz)) || target.version;
     const vendorRel = upgrade.vendorTarball({ instanceDir: root, fromTgz: tgz, targetVersion });
     // Prune superseded vendored tarballs (+ manifests) so the repo carries exactly ONE
     // core. fs.rmSync, NOT exec — a filename comes off the instance's own (lower-trust)
@@ -1176,6 +1237,9 @@ module.exports = {
   refreshStandaloneCorePin,
   resolveOwnerGithubToken,
   resolveVendorableCoreTarball,
+  projectCoreDecision,
+  projectCoreTarget,
+  runningCoreVersion,
   safeVersionLabel,
   scaffoldStandaloneRepo,
   seedFirstVersionCmd,

package/scripts/gds/ship-flow.js

@@ -31,6 +31,9 @@ const tweakHold = require('../../modules/lifecycle/page-tweak-hold.js');
 const { evaluateRegradeEligibility, evaluateResumeAction, resumeMerge, shouldConfirmWithoutGrade } = require('./ship-resume.js');
 const { fileNoArtifactEscalation, noArtifactRefusalLines } = require('./ship-escalation.js');
 const { noteServerReward } = require('./ship-state.js');
+// task 1004536: each graded round lands in the autonomous run's ledger (inert
+// without one), so ship.js can refuse a third grade at its entry point.
+const { recordGradeOutcome } = require('./autobongos-grade-cap.js');
 
 // ---------- Main flow ----------
 
@@ -695,6 +698,7 @@ async function shipMain() {
     }
 
     const g = gradePost.data.grade;
+    recordGradeOutcome({ taskId, grade: g });
     gradeObj = g;
     gradePassed = g.passed;
     advanceToMerge = gradePost.data.advanceToMerge;
@@ -1101,6 +1105,7 @@ async function regradeMain() {
   }
 
   const g = gradePost.data.grade;
+  recordGradeOutcome({ taskId, grade: g });
   const postGradeStatus = gradePost.data.taskStatus;
   printGradeOutcome(g, taskId);
   printCreditsAndAchievements({

package/scripts/gds/ship-preflight-steps.js

@@ -82,7 +82,8 @@ const TOOLING_PATHSPECS = Object.freeze([
   'scripts/gds/ship*.js',           // ship.js + every ship-*.js carved out of it
   'scripts/gds/smoke-gds.js',
   'scripts/gds/cli-lib.js',
-  'modules/grading/grader*',        // grader.js, grader-*.js, grader-rubric.json, grader-workers/
+  'scripts/gds/autobongos-grade-cap.js', // ship.js's entry refuses a capped run with it (task 1004536)
+  'modules/grading/grader*',       // grader.js, grader-*.js, grader-rubric.json, grader-workers/
   'modules/grading/grade-engine.js', // grader.js requires it (task 1002839)
 ]);
 

package/scripts/gds/ship.js

@@ -348,6 +348,16 @@ if (require.main === module) {
     console.log(require('./ship-deploy-target.js').resolveDeployMode());
     process.exit(0);
   }
+  // task 1004536: the autonomous-run grade cap — the first grade plus ONE
+  // re-grade. Checked HERE, before either flow and before any flag is read, so
+  // --regrade, a plain re-ship that resumes the grade, and --skip-grade are all
+  // refused alike. Inert unless the Autobongos supervisor set the run's ledger.
+  const { checkGradeCap, REFUSED_EXIT } = require('./autobongos-grade-cap.js');
+  const gradeCap = checkGradeCap({ taskId: Number(process.argv[2]) });
+  if (!gradeCap.ok) {
+    for (const line of gradeCap.lines) console.error(line);
+    process.exit(REFUSED_EXIT);
+  }
   // #678: --regrade re-grades a grade-failed `completed` task (no claim needed).
   // Dispatched here so it owns its own arg-parsing + session bootstrap.
   const main = process.argv.slice(2).includes('--regrade') ? regradeMain : shipMain;

package/scripts/gds/update-sweep.js

@@ -103,6 +103,9 @@ function git(dir, args, run = spawnSync) {
   return { ok, stdout: (r && r.stdout) || '', stderr: (r && r.stderr) || '', status: r ? r.status : null };
 }
 
+// The sweep's own materialize preview — the fallback for an instance core that predates it.
+function ownWillRewrite() { return require('./claude-materialize.js').materializeWillRewrite; }
+
 // The instance-relative paths THIS upgrade writes into the instance's own tree — the provenance
 // answer pinState's third bucket is sorted by.
 //
@@ -118,11 +121,21 @@ function git(dir, args, run = spawnSync) {
 //     It is the same function upgrade.js's own clean-tree pre-flight waives dirt by, so the lane and
 //     the bump it spawns agree on what "this upgrade rewrote" means.
 //
-// FAIL-SOFT, and the direction is deliberate. An instance whose core predates either export, or whose
-// materialize throws, yields nothing here: every dirty path stays in `other` and the guard is exactly
-// as strict as it was before this function existed. The failure mode is "still wedged", never
-// "committed a stranger's work".
-function laneGeneratedPaths(instDir, { resolveFrom = coreModulePathFrom, load = require } = {}) {
+// A CORE TOO OLD TO ANSWER (task 1004519). materializeWillRewrite shipped in 1.19.933, and the
+// wedge it exists for is exactly the one that strands an instance on an OLDER core: hoodify-finance
+// took one bump to 1.19.871, which materialized 33 skills and committed nothing, and its core then
+// could not say those files were its own — so the set came back empty and every sweep halted on
+// them, forever. When the instance's core ships claude-materialize.js but not the preview, the
+// preview is asked of the sweep's OWN copy instead, run over the instance's INSTALLED core. That is
+// still provenance, not a glob: the file set is walked off that core's .claude/, the very files its
+// own upgrade materializes. And the sweep's copy is no longer the stale one the paragraph above
+// warns about — it runs from the platform's installed core (task 1004307), always the newest here.
+//
+// FAIL-SOFT, and the direction is deliberate. An instance whose core ships no materialize at all,
+// whose installed core has no .claude/skills to walk, or whose materialize throws, yields nothing
+// here: every dirty path stays in `other` and the guard is exactly as strict as it was before this
+// function existed. The failure mode is "still wedged", never "committed a stranger's work".
+function laneGeneratedPaths(instDir, { resolveFrom = coreModulePathFrom, load = require, own = ownWillRewrite } = {}) {
   const out = new Set();
   try {
     const p = resolveFrom(instDir, 'scripts/gds/upgrade.js');
@@ -130,13 +143,16 @@ function laneGeneratedPaths(instDir, { resolveFrom = coreModulePathFrom, load =
   } catch (_) { /* an older core, or one that will not load here — stay strict */ }
   try {
     const p = resolveFrom(instDir, 'scripts/gds/claude-materialize.js');
-    const willRewrite = p && load(p).materializeWillRewrite;
-    if (willRewrite) {
+    if (p) {
       // coreRoot is derived from where the module RESOLVED (<core>/scripts/gds/x.js → <core>), not
       // from a package-name guess: an instance may carry the core under any of its published names,
       // and in the monolith layout the core root IS the instance root (where materialize no-ops).
       const coreRoot = path.resolve(path.dirname(p), '..', '..');
-      for (const f of willRewrite({ instanceDir: instDir, coreRoot }, () => {}) || []) out.add(f);
+      const theirs = load(p).materializeWillRewrite;
+      // Only fall back where there is a real .claude/ to walk — an empty source still "writes" the
+      // provenance manifest, and that is a guess, not an answer.
+      const willRewrite = theirs || (fs.existsSync(path.join(coreRoot, '.claude', 'skills')) ? own() : null);
+      if (willRewrite) for (const f of willRewrite({ instanceDir: instDir, coreRoot }, () => {}) || []) out.add(f);
     }
   } catch (_) { /* same — a set we could not derive is an empty one, never a guessed one */ }
   return [...out];

package/scripts/gds/upgrade-outcome.js

@@ -136,6 +136,7 @@ function runnerReason(text) {
   if (/^could not read the published core versions/.test(s)) return 'registry_unreadable';
   if (/is not published yet/.test(s)) return 'not_published';
   if (/could not read the core version installed/.test(s)) return 'installed_unreadable';
+  if (/is older than the core this project already runs/.test(s)) return 'downgrade';
   if (/update channel/.test(s)) return 'outside_channel';
   return 'unknown';
 }

package/src/bongos/auth-admission.js

@@ -132,6 +132,69 @@ async function recentShipsForRollup(builderId) {
   }));
 }
 
+// Each craft by its own work, for the hub's profile tiles (task 1004440 /
+// WA6.RP10, goal 1000095). Until now the rollup said "Roles" from the declared
+// preference alone and counted only shipped tasks, so an artist or an ideator who
+// had done real work read on the hub as an engineer with nothing shipped.
+//
+// A craft is EARNED when this builder holds credits in it — the same rule the
+// local profile uses to show a role (src/bongos/role-stats.js, task 1004433),
+// read through the same ports. This is a kernel file, so it reads those ports
+// by key rather than importing role-stats (ADR 0091 §1). For each earned craft it
+// sends that craft's headline counts; an unearned craft sends nothing at all.
+// Counts and sums only: no idea title, no page wording, no task list.
+//
+// `disciplines` becomes the earned crafts, in the builder's preferred order;
+// with nothing earned (or no economy module to ask) it falls back to the declared
+// preference, exactly as before. A port that cannot be asked leaves its numbers
+// null ("could not ask"), never 0. Never throws: a failed read drops its craft's
+// numbers, not the report.
+const ROLLUP_CRAFTS = Object.freeze(['engineer', 'artist', 'ideator']);
+const countOrNull = (v) => (Number.isInteger(v) && v >= 0 ? v : null);
+async function readCraftRollup(builderId, { shipped = 0, preferred = [] } = {}) {
+  const fallback = { counts: null, disciplines: Array.isArray(preferred) ? preferred : [] };
+  try {
+    const reward = seams.resolveOptional('reward');
+    const byCraftMap = reward && typeof reward.creditsByCraft === 'function'
+      ? await reward.creditsByCraft([builderId]) : null;
+    const byCraft = byCraftMap ? byCraftMap.get(String(builderId)) : null;
+    if (!byCraft) return fallback;
+    const prefCrafts = fallback.disciplines
+      .map((d) => (typeof reward.craftForPreference === 'function' ? reward.craftForPreference(d) : d))
+      .filter((c) => ROLLUP_CRAFTS.includes(c));
+    const earned = [...prefCrafts, ...ROLLUP_CRAFTS]
+      .filter((c, i, a) => a.indexOf(c) === i && Number(byCraft[c]) > 0);
+    if (!earned.length) return fallback;
+    const ask = async (port) => {
+      const fn = seams.resolveOptional(port);
+      if (typeof fn !== 'function') return null;
+      try { return (await fn(builderId)) || null; } catch { return null; }
+    };
+    const [artist, ideator] = await Promise.all([
+      earned.includes('artist') ? ask('copy-desk.artistStats') : null,
+      earned.includes('ideator') ? ask('ideas.ideatorStats') : null,
+    ]);
+    const credits = (c) => countOrNull(Math.round(Number(byCraft[c])));
+    const counts = {};
+    if (earned.includes('engineer')) counts.engineer = { shipped: countOrNull(shipped), credits: credits('engineer') };
+    if (earned.includes('artist')) {
+      counts.artist = { pages_approved: countOrNull(artist && artist.pages_approved), credits: credits('artist') };
+    }
+    if (earned.includes('ideator')) {
+      counts.ideator = {
+        filed: countOrNull(ideator && ideator.filed),
+        full_ideas: countOrNull(ideator && ideator.full_ideas),
+        ratified: countOrNull(ideator && ideator.ratified),
+        credits: credits('ideator'),
+      };
+    }
+    return { counts, disciplines: earned };
+  } catch (err) {
+    log.info('[auth] craft rollup read failed (non-blocking):', err.message);
+    return fallback;
+  }
+}
+
 // Best-effort cross-project activity rollup to the hub (ADR 0141 §4): report this
 // builder's descriptive talent snapshot (credits, ships, karma, rank, disciplines,
 // and since task 1002803 their last few shipped works) for the cross-project
@@ -162,26 +225,45 @@ async function reportActivityRollup({ builderId, githubId = null }) {
     const row = b.rows[0];
     const ghId = githubId ?? row.github_id;
     if (!/^\d+$/.test(String(ghId ?? ''))) return;
-    const shipped = await pool.query('SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1', [builderId]);
+    // SHIPPED works only (task 1004440): a count with no status filter also
+    // counted work that was handed back after shipping. The same predicate as the
+    // instance's own profile (lifecycle countShippedTasksForBuilder).
+    const shipped = await pool.query(
+      `SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1 AND status = 'shipped'`,
+      [builderId],
+    );
+    const shippedCount = shipped.rows[0] ? shipped.rows[0].n : 0;
     const recentShips = await recentShipsForRollup(builderId);
-    await fetch(`${idp.origin}/api/bongos/sso/activity/rollup`, {
+    const craft = await readCraftRollup(builderId, { shipped: shippedCount, preferred: row.preferred_disciplines });
+    const body = {
+      client_id: idp.clientId,
+      client_secret: idp.clientSecret,
+      github_id: ghId,
+      credits: Number(row.total_credits) || 0,
+      tasks_shipped: shippedCount,
+      karma: Number(row.karma) || 0,
+      rank: row.rank || null,
+      disciplines: craft.disciplines,
+      recent_ships: recentShips,
+    };
+    if (craft.counts) body.crafts = craft.counts;
+    const send = (payload) => fetch(`${idp.origin}/api/bongos/sso/activity/rollup`, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent(),
         'Bongos-Report-As-Of': asOf,
       },
-      body: JSON.stringify({
-        client_id: idp.clientId,
-        client_secret: idp.clientSecret,
-        github_id: ghId,
-        credits: Number(row.total_credits) || 0,
-        tasks_shipped: shipped.rows[0] ? shipped.rows[0].n : 0,
-        karma: Number(row.karma) || 0,
-        rank: row.rank || null,
-        disciplines: Array.isArray(row.preferred_disciplines) ? row.preferred_disciplines : [],
-        recent_ships: recentShips,
-      }),
+      body: JSON.stringify(payload),
     });
+    const res = await send(body);
+    // A hub older than `crafts` validates the body strictly and refuses the
+    // unknown field with a 400, which would lose the whole report. So a refused
+    // report that carried crafts goes again once without them: the totals still
+    // land, and the craft numbers arrive once that hub upgrades.
+    if (body.crafts && res && res.status === 400) {
+      const { crafts: _unsent, ...older } = body;
+      await send(older);
+    }
   } catch (err) {
     log.info('[auth] hub activity rollup failed (non-blocking):', err.message);
   }

package/src/bongos/db-kernel.js

@@ -55,7 +55,7 @@ async function getBuilderById(id) {
   // AFTER INSERT triggers on credit_log + karma_log respectively.
   const { rows } = await pool.query(
     `SELECT id, github_id, github_login, display_name, avatar_url, total_credits, karma, created_at, rank,
-            status, deactivated_at, reactivated_at, deactivated_reason, preferred_disciplines, system_role,
+            status, deactivated_at, reactivated_at, deactivated_reason, preferred_disciplines, main_discipline, system_role,
             anthropic_email, anthropic_user_id, monthly_budget_usd
        FROM builders WHERE id = $1`,
     [id]

package/src/bongos/routes/core-update.js

@@ -129,7 +129,27 @@ function contributeCoreUpdateToDocket(read = readCoreUpdate) {
   });
 }
 
+// This hall's own update rule, from the provisioning module when it runs (task 1004535):
+// the rule set on /deploy, which the runner and the sweep already follow (ADR 0357: the
+// /deploy row beats the sweep's roster file, which lives in the box's own checkout and is
+// not this server's to read). No module, no row, or a failed read → null, and the readers
+// fall back to the platform default exactly as before.
+function storedSelfChannel() {
+  const read = seams.resolveOptional('provisioning.selfUpdateChannel');
+  return typeof read === 'function' ? read() : null;
+}
+
+// { channel, source } — WHICH rule the answer was computed under, so the page can say so:
+// 'deploy' (the project's stored rule) or 'default' (none could be read). Never throws.
+async function resolveChannel(selfChannel) {
+  let channel = null;
+  try { channel = (await selfChannel()) || null; } catch { channel = null; }
+  return { channel, source: channel ? 'deploy' : 'default' };
+}
+
 function buildCoreUpdateRouter({
+  coreUpdate = readCoreUpdate,
+  selfChannel = storedSelfChannel,
   upgrades = readCoreUpgrades,
   softwareUpdate = readSoftwareUpdate,
   canUpdate = holdsCorePin,
@@ -155,7 +175,8 @@ function buildCoreUpdateRouter({
       try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
       // No `deploy_url` any more (task 1004296): the banner on a hall without a door of its
       // own links to Settings → Software update, and the hand-off lives on GET /software-update.
-      res.json({ ok: true, update: await readCoreUpdate({ running }) });
+      const { channel, source } = await resolveChannel(selfChannel);
+      res.json({ ok: true, update: { ...(await coreUpdate({ running, channel })), channel_source: source } });
     }, { errorCode: 'core_update_failed', message: false }),
   );
 
@@ -186,7 +207,11 @@ function buildCoreUpdateRouter({
     asyncHandler('GET /software-update', async (req, res) => {
       let running = null;
       try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
-      const [update, can] = await Promise.all([softwareUpdate({ running }), canUpdate(req)]);
+      // canUpdate does not depend on the rule, so it runs beside the rule read, not after it.
+      const [update, can] = await Promise.all([
+        resolveChannel(selfChannel).then(async ({ channel, source }) => ({ ...(await softwareUpdate({ running, channel })), channel_source: source })),
+        canUpdate(req),
+      ]);
       res.json({ ok: true, update, door: updateDoor(doorInputs()), can_update: can === true });
     }, { errorCode: 'software_update_failed', message: false }),
   );

package/src/bongos/serve-internal.js

@@ -941,6 +941,16 @@ function mountInternalSurfaces(app) {
   // statically, and a comment in that gap drops the regex out of the map, which
   // makes the page test as UNGATED while looking gated here. Prose goes above.
   const BOARD_ROOM_PAGE_RE = /^\/builders\/board-room(?:\.html)?\/?$/;
+  // /city — the Governor City's home (task 1004524, goal 1000125). Gated on the
+  // `board.vote.cast` atom, like the Board Room, because that is the atom its one
+  // governed read (GET /government/docket) checks: the page's reach equals the
+  // right to read what it draws, so no holder is refused a city they could read
+  // and no one else is served its shell. Its two goal reads are requireBuilder,
+  // a wider floor.
+  //
+  // NB as at PROJECT_SETTINGS_PAGE_RE: nothing between the `=` and the literal
+  // (tests/hall_page_gate_map.mjs parses this file statically). Prose goes above.
+  const CITY_PAGE_RE = /^\/builders\/city(?:\.html)?\/?$/;
   // /deploy — the owner's deploy door (task 1003159, ADR 0293). Gated on the
   // `core.pin.move` atom, the same key its preview and its move both check, so the
   // shell's reach equals the right to press the button. Archon-floor and system:true,
@@ -1023,6 +1033,10 @@ function mountInternalSurfaces(app) {
     if (BOARD_ROOM_PAGE_RE.test(norm)) {
       return gdsAuth.requireBoardVotePage(req, res, next);
     }
+    // task 1004524: the Governor City, on the docket's own atom (see CITY_PAGE_RE).
+    if (CITY_PAGE_RE.test(norm)) {
+      return gdsAuth.requireBoardVotePage(req, res, next);
+    }
     // ADR 0293: the deploy door, on the same atom its two routes check.
     if (DEPLOY_PAGE_RE.test(norm)) {
       return gdsAuth.requireCorePinPage(req, res, next);

package/src/bongos/software-update.js

@@ -18,8 +18,9 @@
 //
 // THE CHANNEL RULE IS NOT RESTATED HERE, as in core-update.js: `resolveChannelTarget` is the
 // upgrade runner's own function, so this never offers a version the runner would refuse.
-// No channel is passed, exactly as the banner passes none: an instance does not store its
-// own channel, and the runner's default is what it would get.
+// The channel is the project's own update rule when the route can read it (the rule set on
+// /deploy, via the provisioning.selfUpdateChannel seam — task 1004535), else the runner's
+// default. The banner (core-update.js) is handed the same rule, so the two cannot disagree.
 //
 // A READING, NEVER A GUESS. `reading` is 'ok' only when the registry answered; "up to date"
 // is `offered: null` on an ok reading and nothing else. Notes that could not be read say so,

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.5'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.6'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/activity_rollup_order_db.mjs

@@ -74,7 +74,9 @@ const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg
 
 try {
   for (const f of ['platform_identity_005_builder_activity.sql', 'platform_identity_012_recent_ships.sql',
-    'platform_identity_022_activity_snapshots.sql', 'platform_identity_026_activity_reported_as_of.sql']) {
+    'platform_identity_022_activity_snapshots.sql', 'platform_identity_026_activity_reported_as_of.sql',
+    // upsertActivity also writes crafts (029, task 1004440): 42703 without it.
+    'platform_identity_029_activity_crafts.sql']) {
     await q(migrationSql(f));
   }
   await q(migrationSql('platform_identity_026_activity_reported_as_of.sql')); // idempotent: replays cleanly

package/tests/activity_snapshots_db.mjs

@@ -99,6 +99,8 @@ try {
   await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
   // upsertActivity also writes reported_as_of (task 1004268) — same reason as 012 above.
   await q(migrationSql('platform_identity_026_activity_reported_as_of.sql'));
+  // ...and each craft's counts (029, task 1004440), same reason again.
+  await q(migrationSql('platform_identity_029_activity_crafts.sql'));
   await cleanup();
 
   // 1 — the writer snapshots the LIVE row, and only when it changed.