@bongos/core 1.21.79 → 1.21.80

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.79",
-  "core_contract": "1.21.79",
-  "source_commit": "8c1eba48a32817ae7e6f016ea03b444d748573b6",
+  "core_version": "1.21.80",
+  "core_contract": "1.21.80",
+  "source_commit": "b836a5577c82fe4d7594fc0a26a3e4f13076750a",
   "source_ref": "HEAD",
-  "built_at": "2026-10-08T20:19:49.733Z",
+  "built_at": "2026-10-09T00:19:50.271Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 589,
+    "docs_redacted": 590,
     "agent_docs_stubbed": 28,
     "functional_verbatim": 2992,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3610,
-  "tree_sha256": "be4357f64be8bce6cd06f2fc56d72fa5ca713823be4df7d69c1d04d5f15c5044",
+  "file_count": 3611,
+  "tree_sha256": "669bec1b067c38b5bf3b4bc4dd955774f73039820ab806892e1f5a05305813d8",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1212,7 +1212,7 @@
     {
       "path": "docs/adr/0155-adopt-private-repo-widen-oauth-scope.md",
       "mode": "0000644",
-      "sha256": "879099b9c620754489c58cd1c368b590fba0cc78baa8c744c596394a10852c6d"
+      "sha256": "81248d32dd28da671a5d006804359a43f5d373366a6704a14af906220d0ec5ec"
     },
     {
       "path": "docs/adr/0156-user-set-display-name-wins.md",
@@ -2304,10 +2304,15 @@
       "mode": "0000644",
       "sha256": "10d2509453f6ab9c511adb9ca2e01927fdfbcb5d854830c66774cd07bc340a7c"
     },
+    {
+      "path": "docs/adr/0370-a-repo-we-create-is-private.md",
+      "mode": "0000644",
+      "sha256": "d4963a203bce58f5d5f422bab582e022bf2d2b33eaa854c0ee80b6b76ccff1ee"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "84f7c062a62513d4e241b76d537708460e95da9a9caadc9c9f406632af828050"
+      "sha256": "3a58f45b80d4311b5ae5458bc7d564301978b0cf3ba5c72c6244bc1ef6356e89"
     },
     {
       "path": "docs/api-reference.md",
@@ -2342,12 +2347,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "447f3456d3fdb76ffc10d8cb7654c712a5217e854b151938d207c6e48c212ce8"
+      "sha256": "28408a7426fa0bdb7b01b17b47ce5f96ba0d7c3362f2059273405357d674370c"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "e78343e484b75b344227546ab24aca7a89beb6bdf48f7b0b35f148b284de0149"
+      "sha256": "857a6a515ddfe47e441636556714d8bc527ceab06ffefe06a368a8ead96d190d"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2857,7 +2862,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "cc5f0bb22083978e7578f9d8a86966049630e440c0e3ee65c98d34bd151e2d4a"
+      "sha256": "32d825702934aa11e29c66c61e8cc5d3b7ba8133217227656308140c05315062"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2947,7 +2952,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "c51aad49008fee572022f111c184c2edfe2f708db72905ef0feda45fcb5e8749"
+      "sha256": "1c91405fcccab79ce2b67c9c74ca7114d9c2c1f282e2547e2366f20a5acd417f"
     },
     {
       "path": "docs/project-context.template.md",
@@ -6387,7 +6392,7 @@
     {
       "path": "modules/hall-ui/public/tweak-editor-lib.js",
       "mode": "0000644",
-      "sha256": "7499f37d86c0d4cc20016505ea6a568ef3422fc64d778ccb46c4b3fdcbd596ba"
+      "sha256": "0cc42c06e988b9d54d4443023d92c56b2fef8779823560735265c1e0f1a45ab7"
     },
     {
       "path": "modules/hall-ui/public/tweak-editor.css",
@@ -6582,7 +6587,7 @@
     {
       "path": "modules/hall-ui/records/tweak-editor.md",
       "mode": "0000644",
-      "sha256": "79b27e47889e66506c7e0d7504a924773cc2b821a8fd2469daaf2bf11207f913"
+      "sha256": "6667b86da5c9e9259c047254866ee69f4b281ba3a941117eab7106a9f4aec513"
     },
     {
       "path": "modules/ideas/CLAUDE.md",
@@ -9302,7 +9307,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "4434728240fab851ae41cd0897f56f48212a8b3a9c7208641ad820a842d5049a"
+      "sha256": "a67a0fb1211176b2375e652ab570342063d9f8e5eafd715a0469a42184f98e4d"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -10082,12 +10087,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "90a08e7d6d633c8f3536eda35a07423488ef860672ad8bb509c528b4bc14633f"
+      "sha256": "12eba8a8f76736d82a5a1cf8f991f43415491163325465b2197cac227c6c3544"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "597f60f00beb912ea47fd0218cf0a1beaecb698beabf325197382924cf9888a5"
+      "sha256": "186a539924b6c2d566c4c23a84d99b3574567b41babe3eddc4e8f3406480e96e"
     },
     {
       "path": "public-docs/index.html",
@@ -10107,7 +10112,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "450686b93d7fe7e0776712d9ef727920390d71efb9061306b3d11ac0dfdfda65"
+      "sha256": "fced1b5988cd7b0496a0f28a532cec8d233d2889b4ca667f2dc0485bf62fb678"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12037,7 +12042,7 @@
     {
       "path": "src/bongos/github-repos.js",
       "mode": "0000644",
-      "sha256": "3e0087226edf1d877e56cf647b2af805430ececabf9b51ecf56df280f959b418"
+      "sha256": "af5600f22a3421c8197e91c77d422e9bca789eb458789924e8d75a00818f314a"
     },
     {
       "path": "src/bongos/goal-scope-check.js",
@@ -12357,7 +12362,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "71179fb06a397ecb72e39b1d48b7fbfde9a4b2e1204c11bd011f59e2ffd856e0"
+      "sha256": "5e3a905a711427b31f0965112e50a85872a8d45c3bcf8e2c7f4c6b436206d436"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13997,7 +14002,7 @@
     {
       "path": "tests/github_repos_helpers.mjs",
       "mode": "0000644",
-      "sha256": "66fd3d349445aa00e55fa77589958d6c98980e99f3cdaf4746ff55494202333a"
+      "sha256": "d0c12aab13423b92d3b1d1199ac75950da769f56d361853f4ab2f3eda98e6620"
     },
     {
       "path": "tests/github_token_session_life.mjs",
@@ -14852,7 +14857,7 @@
     {
       "path": "tests/hall_tweak_editor.mjs",
       "mode": "0000644",
-      "sha256": "bebfc28dd3a172e0abac8a4f7c7cb80f89689748c9218ffc60bf0d3d55916fe6"
+      "sha256": "32164a5039c5989e25ff1c6dac77a9cb2d55daa3879fb638aa9b991e9cce5a84"
     },
     {
       "path": "tests/handle_machinery.mjs",

package/docs/adr/0155-adopt-private-repo-widen-oauth-scope.md

@@ -4,6 +4,7 @@
 - **Date:** 2026-08-04
 - **Deciders:** the owner chose the credential approach after being shown the trade-off; Claude diagnosed + built.
 - **Amends:** [ADR 0143](0143-onboarding-repo-picker-oauth-scope.md) §1 (its Decision 1 — scope choice). 0143 otherwise stands unchanged: opt-in per sign-in, lazy consent, encrypted short-TTL token store, personal repos only, 503-degrade. Per 0143's own append-only rule, this is a new ADR, not an edit.
+- **Superseded in part by:** [ADR 0370](0370-a-repo-we-create-is-private.md) — Decision 3 (a repo we create stays public) is reversed: a repo we create is private.
 - **Related:** [ADR 0121](0121-greenfield-vs-brownfield-onboarding-adopt-existing-repo.md) (greenfield vs brownfield onboarding).
 
 ## Context

package/docs/adr/0370-a-repo-we-create-is-private.md

@@ -0,0 +1,29 @@
+# ADR 0370 — A repo we create for a new project is private
+
+- **Status:** accepted
+- **Date:** 2026-10-08
+- **Task:** [task 1004645](https://cloudbongos.com/builders#/task/1004645) (goal 1000106, BONGOS-V2)
+- **Supersedes:** [ADR 0155](0155-adopt-private-repo-widen-oauth-scope.md) Decision 3 ("a repo *we* create stays public"). The rest of 0155 stands.
+- **Builds on:** [ADR 0176](0176-private-repo-deploy-keys.md) (a private target repo gets its own read-only deploy key before the first pull)
+- **Decided with:** the owner, 2026-10-08: the public default is a major security issue, and the default must be private.
+
+## Context
+
+When the create wizard makes a new GitHub repository for a project, `createUserRepo` (`src/bongos/github-repos.js`) sent `private: false`. ADR 0155 kept that on purpose: a Cloud Bongos instance was meant to be open source by design, and an owner who wanted private code had to make the repo on GitHub themselves and adopt it.
+
+That put every new project's code on the public internet from its first push, without the owner ever choosing it. A first-time owner does not know to take the side door. Anything they commit by mistake, such as a key, a customer file or unreleased work, is world-readable and may already be copied before they notice.
+
+The reason the public default was once forced has gone. ADR 0155 widened the token to `repo`, which can create a private repo. ADR 0176 taught provisioning to stand up a private repo: `ensurePrivateRepoAccess` registers the project's own read-only deploy key right after the scaffold push and before the first `git pull`. The greenfield push already uses the owner's token over HTTPS. The owner creates the repo in their own account, so they are its admin, which is what registering a deploy key needs.
+
+## Decision
+
+1. **`createUserRepo` sends `private: true`.** It is still not a parameter, so nothing can flip it by accident. The unit test pins `true` exactly; a dropped field would fall back to GitHub's own public default and red the test.
+2. **The wizard says so.** The "A new repo" choice reads "Private, set up for you", and the name field's hint says the new repo is private and can be made public later.
+3. **Going public stays the owner's choice.** The manage page's repo-visibility control (`makeRepoPublic`) is unchanged.
+
+## Consequences
+
+- A new project's code is private unless its owner makes it public.
+- Every new cloud-hosted project now takes the private standup path: one extra deploy key per project, registered on the owner's repo. That path has run on adopted private repos since ADR 0176.
+- Projects created before this change keep their public repos. Nothing flips an existing repo.
+- An instance that wants to be open source now makes that choice on the manage page instead of getting it by default.

package/docs/adr/README.md

@@ -488,3 +488,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0367 | [**The Discord support bot answers from public docs only, under a monthly cap that fails closed** ([task 1002534](https://cloudbongos.com/builders#/task/1002534), goal 1000110). **D1:** one pinned channel, only when @-mentioned; the first gateway reply. **D2:** the corpus is an allowlist (`README.md`, `docs/onboarding/`, `docs/api-reference.md`) served by a new `memory.searchPublicDocs` port whose scope (doc, xenos, no owner, allowlisted ref) is fixed in SQL; the asker is never looked up. **D3:** no writes but the reply and one `audit_log` row per answer, which is also the spend ledger, so no migration. **D4:** a nonce-fenced prompt, no tools, mentions disabled. **D5:** `claude-haiku-4-5`, `DISCORD_SUPPORT_MONTHLY_CAP_USD` default $5, fail closed, with in-flight answers reserved at worst case. **D6:** off by default; its own switch and an env-only, namespaced key. **D7:** the channel's humans review wrong answers; the fix is the doc.](0367-the-support-bot-answers-from-public-docs-only.md) | discord / support / spend |
 | 0368 | [**Red and blue teams practise on a range, never on live** (goal 1000094 — *Working area 10, Security*; proposed). **D2:** the range is its own small server, rebuilt from the candidate the owner marks "stage for attack". **D3:** it shares no identity hub, secret or data with live. **D5:** red is AI plus Metic+, with one side at a time and a 30-day switch. **D6:** attacks run on subscriptions, never the metered API. **D7:** 3 runs on the newest model with 0 high+ breaks, advisory until an outside tenant exists. **D8:** points only, no credits yet. **D9:** three live signals to `#security-alerts`.](0368-red-and-blue-teams-practice-on-a-range-never-on-live.md) | security / red-team / range |
 | 0369 | [**Ship mode decides who starts a ship, not how it lands** ([task 1004628](https://cloudbongos.com/builders#/task/1004628), goal 1000106). **D1:** a `ship.mode` project setting, `auto` (the AI ships and lands a finished task with no commands) or `manual` (a person approves each ship), in `project_settings` with no migration. **D2:** Auto is the default, and the resolver reports whether anyone has chosen. **D3:** it is separate from deploy mode (`config/deploy.json`), which decides how a land happens. **D4:** any builder can read it (the AI must know), and `project.settings.manage` writes it, from the settings page or `bongos ship-mode`.](0369-ship-mode-decides-who-starts-a-ship-not-how-it-lands.md) | lifecycle / shipping / project settings |
+| 0370 | [**A repo we create for a new project is private** ([task 1004645](https://cloudbongos.com/builders#/task/1004645), goal 1000106). Supersedes ADR 0155 Decision 3: `createUserRepo` sends `private: true`, still not a parameter, and the wizard says the new repo is private. Safe because ADR 0176 already gives a private repo its own read-only deploy key before the first pull; the owner can make it public from the manage page.](0370-a-repo-we-create-is-private.md) | onboarding / security / github |

package/docs/copy-inventory.md

@@ -2334,6 +2334,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d4e9bf625ab3` | certain | Pick one of your repositories | `modules/public-landing/public/projects.html:1717` |
 | `082156998085` | certain | Private hides the page from everyone — including you: it answers “not found” to every visitor, and you read yo | `modules/public-landing/public/account.html:212` |
 | `d0c4d9ddcd71` | certain | Private individual | `modules/public-landing/public/projects.html:1647` |
+| `1a89b96a6a62` | certain | Private, set up for you | `modules/public-landing/public/projects.html:1699` |
 | `19b960fc4777` | certain | Project address | `modules/public-landing/public/guild.html:235` |
 | `92c7055aa799` | certain | Project handle | `modules/public-landing/public/projects.html:1754` |
 | `edab0ed81a40` | certain | Project name | `modules/public-landing/public/projects.html:1560` |
@@ -2344,7 +2345,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `392b3876e595` | certain | Public marketed project | `modules/public-landing/public/projects.html:1945` |
 | `c03d80ba0788` | certain | Public or private | `modules/public-landing/public/projects.html:1703` |
 | `eaece4f1b37b` | certain | Public or private both work, and we never change it. | `modules/public-landing/public/projects.html:1739` |
-| `cdd827b4fba0` | certain | Public, set up for you | `modules/public-landing/public/projects.html:1699` |
 | `fe9d120093e8` | certain | Put this guild forward for a project. It applies for nobody: each member sees it in their invitations and appl | `modules/public-landing/public/guild.html:233` |
 | `351a61f190a6` | certain | Questions go through the | `modules/public-landing/public/terms.html:131` |
 | `664f5731ddc3` | certain | Read the source. | `modules/public-landing/public/privacy.html:125` |
@@ -2631,7 +2631,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7a053a51ee5f` | certain | privacy page | `modules/public-landing/public/terms.html:131` |
 | `f8aa3ff34a10` | certain | projects you build on | `modules/public-landing/public/account.html:258` |
 | `646b1e72622d` | certain | read by a panel | `modules/public-landing/public/index.html:795` |
-| `c896ee941e3e` | certain | repo. For private code, pick “A repo I have”. | `modules/public-landing/public/projects.html:1729` |
+| `06a464e9968d` | certain | repo. You can make it public later. | `modules/public-landing/public/projects.html:1729` |
 | `a4af8410855c` | certain | resume it | `modules/public-landing/public/projects.html:1494` |
 | `56787ad7373b` | certain | save profile | `modules/public-landing/public/account.html:179` |
 | `ab02a01db9e2` | certain | set up GitHub sign-in | `modules/public-landing/public/projects.html:2009` |

package/docs/copy-registry.json

@@ -21791,6 +21791,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "1a89b96a6a62",
+      "surface": "landing",
+      "text": "Private, set up for you",
+      "file": "modules/public-landing/public/projects.html",
+      "line": 1699,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "19b960fc4777",
       "surface": "landing",
@@ -21881,15 +21890,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "cdd827b4fba0",
-      "surface": "landing",
-      "text": "Public, set up for you",
-      "file": "modules/public-landing/public/projects.html",
-      "line": 1699,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "fe9d120093e8",
       "surface": "landing",
@@ -24465,9 +24465,9 @@
       "confidence": "certain"
     },
     {
-      "id": "c896ee941e3e",
+      "id": "06a464e9968d",
       "surface": "landing",
-      "text": "repo. For private code, pick “A repo I have”.",
+      "text": "repo. You can make it public later.",
       "file": "modules/public-landing/public/projects.html",
       "line": 1729,
       "origin": "html-text",

package/docs/module-api-changelog.md

@@ -2990,5 +2990,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.77 with no explicit bump. run 37828775583. (task 1002620)
   1.21.79 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.78 with no explicit bump. run 37838546662. (task 1002620)
+  1.21.80 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.79 with no explicit bump. run 37864152237. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -3554,7 +3554,7 @@
       "surface": "builders",
       "title": "Studio",
       "states_read": ["home","out","flow","flow-pick","status","words-offer","words-edit","reviews","full","full-back","approvals","approvals-before","approvals-phone","approvals-note","approved","sent-back"],
-      "files_hash": "48c0b887a0fbadd6",
+      "files_hash": "b3e0c68d7d013d8e",
       "reading_hash": "7fc21db3071ddf23",
       "counts": {"lines":33,"placed":16,"shared":7,"unplaced":10},
       "omitted": {"data":2},
@@ -3809,7 +3809,7 @@
       "surface": "builders",
       "title": "Tweak a page",
       "states_read": ["doc","typed","chrome","submitted","picking","out"],
-      "files_hash": "639c8b678b53e232",
+      "files_hash": "db91f438f529d626",
       "reading_hash": "7d311833361923c2",
       "counts": {"lines":24,"placed":15,"shared":1,"unplaced":8},
       "omitted": {"data":34},
@@ -4579,7 +4579,7 @@
       "surface": "landing",
       "title": "{{productName}} — projects",
       "states_read": ["out-map","in-map","in-map-projects","in-map-profile","in-map-kbd","in-map-search","in-map-mine-on","in-table","in-table-by-builders","in-mine","in-manage","in-manage-address","in-manage-planet","in-manage-card","in-manage-look","in-manage-kind","in-manage-invite","in-manage-invite-handoff","in-manage-invite-guild","in-manage-app-live","in-manage-app-building","in-manage-app-failed","in-manage-app-retry","in-manage-app-offer","in-manage-app-connect","in-manage-snag","in-manage-gone","in-manage-missing","out-manage","in-new","in-new-fork-ticked","in-new-terms-refused","in-new-fork-demo","in-new-demo-what","in-new-demo-review-address","in-new-what","in-new-name-prefilled","in-new-checks","in-new-checks-filled","in-new-checks-entity","in-new-review","in-new-review-code","in-new-review-address","in-new-review-app","in-new-review-extras","in-new-review-team","in-new-review-run","in-new-review-confirmed","in-new-look","in-new-done","in-new-resume-offer","in-new-look-custom","out-new","out-map-projects","card","card-noart","card-self","in-manage-demo","in-mine-dns-pending","in-manage-dns-pending","in-mine-empty","card-floor","card-backdrop","in-new-done-live"],
-      "files_hash": "f0dd7460d4e13451",
+      "files_hash": "e2a18fac786e762c",
       "reading_hash": "333a01dfff5fa4e0",
       "counts": {"lines":910,"placed":223,"shared":21,"unplaced":666},
       "omitted": {"data":141},

package/modules/hall-ui/public/tweak-editor-lib.js

@@ -189,8 +189,27 @@
   // another host than the editor's cannot be framed: a hall page can, a landing
   // or status page cannot. For those the split view is a second window docked to
   // the bottom half of the screen.
-  function canFrame(url, loc) {
-    try { return new URL(url, loc.href || loc.origin).origin === (loc.origin || new URL(loc.href).origin); } catch (_) { return false; }
+  //
+  // The SIBLINGS (task 1004393): once the proxy answers the apex and status hosts
+  // with `frame-ancestors 'self' https://builders.<apex>` instead of SAMEORIGIN,
+  // those two pages may split in place too. Until then framing them shows the
+  // browser's refusal page, so FRAME_SIBLINGS stays false and flipping it is the
+  // step after the proxy change (the owner's steps are on task 1004393). Only the
+  // apex and status.<apex> are siblings, never another subdomain: the proxy keeps
+  // every other host unframeable, sign-in and settings included.
+  const FRAME_SIBLINGS = false;
+  function siblingOrigins(loc) {
+    const here = new URL(loc.href || loc.origin);
+    if (!/^builders\./.test(here.hostname)) return [];
+    const apex = here.host.replace(/^builders\./, '');
+    return [`${here.protocol}//${apex}`, `${here.protocol}//status.${apex}`];
+  }
+  function canFrame(url, loc, siblings = FRAME_SIBLINGS) {
+    try {
+      const origin = new URL(url, loc.href || loc.origin).origin;
+      if (origin === (loc.origin || new URL(loc.href).origin)) return true;
+      return siblings === true && siblingOrigins(loc).includes(origin);
+    } catch (_) { return false; }
   }
   function splitWindowFeatures(scr) {
     const s = scr || {};
@@ -229,7 +248,7 @@
     return null;
   }
 
-  const api = { OPEN_WORDS, openChoice, clampSplit, splitFromPointer, splitFromKey, canFrame, splitWindowFeatures, HINT, nextLineKey, confirmedCount, hintText, confirmStoreKey, parseConfirmed, NOTES, sectionsOf, isChanged, noteFor, draftBody, changedCount, counterText, initialValues, rowsFor, liveUrl, uploadedLabel, uploadRefusal, displayTitle, pageIdFrom };
+  const api = { OPEN_WORDS, openChoice, clampSplit, splitFromPointer, splitFromKey, canFrame, FRAME_SIBLINGS, splitWindowFeatures, HINT, nextLineKey, confirmedCount, hintText, confirmStoreKey, parseConfirmed, NOTES, sectionsOf, isChanged, noteFor, draftBody, changedCount, counterText, initialValues, rowsFor, liveUrl, uploadedLabel, uploadRefusal, displayTitle, pageIdFrom };
   if (typeof window !== 'undefined') window.OTBTweakEditor = api;
   if (typeof module !== 'undefined' && module.exports) module.exports = api;
 })();

package/modules/hall-ui/records/tweak-editor.md

@@ -27,7 +27,7 @@ The paper is paper and the room is the room whatever the hall's theme: the stage
 - **Boxes grow to their words** rather than the artboard's rows 1 or 2.
 - **A refused upload opens a panel** (task 1004354, `#tw-refused`): the "is in" panel's glass and scrim over the whole window, a headline per refusal (`lib.uploadRefusal`), the server's words, the lines it names, "what to do", and "download this page again" or close (Escape too). An artist uploads from the bar, often far down the page, where the paper's notice was off screen. The notice stays on the paper after the panel closes. The kit has no file-upload action, so the panel is proven in `tests/hall_tweak_editor.mjs` and by shots of a real browser at 1440 and 390, not by a states.json state.
 - **The check, the restore and Shift + Enter (task 1004385, owner-asked).** Beside each line a round restore button (only on a changed line: it puts the page's words back and takes the check off) and a round green check. A checked line takes a light green wash; the owner picked the check over a tint alone. **Shift + Enter** in a line checks it and lands in the next, and a green hint above the words says so (with "N of M checked"), because it is the quickest way through a page. Enter alone is unchanged. The checks are the artist's place-keeper and stay in the browser (`localStorage`, keyed by page and reading hash, so a page that moved never ticks the wrong words); the server has no such field and `WRITES` is unchanged. A page the caller cannot write has none of it. Rules in `tweak-editor-lib.js` (`nextLineKey`, `confirmedCount`, `parseConfirmed`, `confirmStoreKey`, `hintText`).
-- **No page title or sub text at the top of the paper, and "open the page" is a menu (task 1004386, owner-asked).** The bar already names the page, so the paper opens on its first section; the h1 stays, visually hidden, for the one-h1 floor. "open the page" is a **split button** (owner-amended mid-build): the main half repeats the artist's last choice ("open the page ↗" for a new tab, "open in split view"), and the ▾ beside it opens **open in new tab** and **open in split view**. Click, keyboard and touch; hover alone opens nothing, because a hover menu closes when the pointer wanders and does not exist on touch. Split view has a **draggable divider** (mouse, touch, or the arrow keys and Home/End on the focused divider; the live page takes 20% to 80% of the window, `lib.clampSplit`), and the frame stops taking the pointer while it is dragged. The choice, the size and whether split view was open are remembered (`hall-tweak-open-as`, `hall-tweak-split-size`, `hall-tweak-split`), so the next page opens the same way; a split that would be a second window never reopens on load, because a browser blocks a popup nobody clicked. At phone width the live page takes at most half the screen, whatever the saved size, because the two-row bar is tall there. Split view pins the live page under the words (words above, page below, both scroll; "close split view" unloads it; the frame loads only when opened). **The live site answers `X-Frame-Options: SAMEORIGIN`** (set at the proxy in front of the app, not in this repo), so only a page on the editor's own host can be framed. A landing or status page is on another host, so its split view opens the page in a second window docked to the bottom half of the screen (`lib.canFrame`, `lib.splitWindowFeatures`). Allowing framing from the builders host (a `frame-ancestors` rule at the proxy) would let those pages split in place too.
+- **No page title or sub text at the top of the paper, and "open the page" is a menu (task 1004386, owner-asked).** The bar already names the page, so the paper opens on its first section; the h1 stays, visually hidden, for the one-h1 floor. "open the page" is a **split button** (owner-amended mid-build): the main half repeats the artist's last choice ("open the page ↗" for a new tab, "open in split view"), and the ▾ beside it opens **open in new tab** and **open in split view**. Click, keyboard and touch; hover alone opens nothing, because a hover menu closes when the pointer wanders and does not exist on touch. Split view has a **draggable divider** (mouse, touch, or the arrow keys and Home/End on the focused divider; the live page takes 20% to 80% of the window, `lib.clampSplit`), and the frame stops taking the pointer while it is dragged. The choice, the size and whether split view was open are remembered (`hall-tweak-open-as`, `hall-tweak-split-size`, `hall-tweak-split`), so the next page opens the same way; a split that would be a second window never reopens on load, because a browser blocks a popup nobody clicked. At phone width the live page takes at most half the screen, whatever the saved size, because the two-row bar is tall there. Split view pins the live page under the words (words above, page below, both scroll; "close split view" unloads it; the frame loads only when opened). **The live site answers `X-Frame-Options: SAMEORIGIN`** (set at the proxy in front of the app, not in this repo), so only a page on the editor's own host can be framed. A landing or status page is on another host, so its split view opens the page in a second window docked to the bottom half of the screen (`lib.canFrame`, `lib.splitWindowFeatures`). **Letting them split in place (task 1004393)** is two steps, in this order. First the proxy answers the apex and `status.<apex>` with `<redacted>: frame-ancestors 'self' https://builders.<apex>` in place of `X-Frame-Options: SAMEORIGIN`, and every other host keeps SAMEORIGIN (sign-in and settings stay unframeable). Then `FRAME_SIBLINGS` in `tweak-editor-lib.js` flips to `true`. `lib.canFrame` then also admits exactly those two origins, same scheme and port, and only from the builders host; never another subdomain or a lookalike. Flipping it before the proxy changes would put the browser's refusal page in the split, which is why it ships off.
 - **Not on the artboard at all:** the phone layout (the bar becomes a two-row glass card, notes drop under their lines), the shell's full-screen button top right, the read-only and refusal notices on the paper, the chrome view (the switch off), and light mode.
 
 ## The proof

package/modules/public-landing/public/projects.html

@@ -1696,7 +1696,7 @@ summary{min-height:24px;padding:3px 0;}
                       <div class="choices" role="group" aria-label="Starting point">
                         <button type="button" class="choice" id="c-green" aria-pressed="true">
                           <b>A new repo</b>
-                          <p>Public, set up for you</p>
+                          <p>Private, set up for you</p>
                         </button>
                         <button type="button" class="choice" id="c-adopt" aria-pressed="false">
                           <b>A repo I have</b>
@@ -1726,7 +1726,7 @@ summary{min-height:24px;padding:3px 0;}
                         <input type="text" id="ghNewName" placeholder="moonbase" autocomplete="off" maxlength="100" aria-label="New repository name">
                         <!-- visibility is stated on EVERY repo path (task 1002721); updateFreshPreview()
                              replaces this floor with the same claim plus the resolved repo URL -->
-                        <div class="hint" id="ghFreshHint">A new <strong>public</strong> repo. For private code, pick “A repo I have”.</div>
+                        <div class="hint" id="ghFreshHint">A new <strong>private</strong> repo. You can make it public later.</div>
                       </div>
                       <div class="row2" id="manualHome">
                         <label class="wizField"><span>GitHub owner <small>(user or org)</small></span>
@@ -5291,9 +5291,9 @@ summary{min-height:24px;padding:3px 0;}
         hint.className = 'hint err'; hint.innerHTML = 'You already have a repo named <strong>' + esc(state.repo) + '</strong> — pick another name, or adopt it instead.';
       } else {
         /* Visibility stated up front (task 1002694 / idea 1000684): repos WE create are
-           public by design (github-repos.js — open-source, capture-resistant); the
-           private path is adopting a private repo the owner makes themselves. */
-        hint.className = 'hint'; hint.innerHTML = 'A new <strong>public</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code>. For private code, make the repo on GitHub and pick “A repo I have”.';
+           private by default (github-repos.js, ADR 0370); the owner can make one
+           public later from the project's manage page. */
+        hint.className = 'hint'; hint.innerHTML = 'A new <strong>private</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code>. You can make it public later.';
       }
     }
     $('ghNewName').addEventListener('input', function () { state.repo = this.value.trim(); updateFreshPreview(); saveDraft(); });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.79",
+  "version": "1.21.80",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.79",
+      "version": "1.21.80",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.79",
+  "version": "1.21.80",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9296,5 +9296,15 @@
       "id": "1004626",
       "text": "Every tab in the hall sidebar now has its own icon. Before, nineteen tabs shared just four pictures - all nine Government pages wore the same shield and every Docs page the same sheet of paper - so the collapsed sidebar was ha"
     }
+  ],
+  "1.21.80": [
+    {
+      "id": "1004645",
+      "text": "New projects now get a private GitHub repository by default. Before, the code of every new project was public on the internet from the first save. Owners can still make their repo public later from the project page, and existi"
+    },
+    {
+      "id": "1004393",
+      "text": "The tweak editor is ready to show landing and status pages side by side with the words, instead of in a separate window. It stays off until a small web-server change is made on the host; those steps are waiting in the owner's"
+    }
   ]
 }

package/src/bongos/github-repos.js

@@ -75,10 +75,11 @@ async function listUserRepos(token, { q = '', fetchImpl = fetch } = {}) {
 // no README/first commit (exactly the "leave it completely empty" the manual step
 // demanded).
 //
-// private:false is now a PRODUCT choice, not a credential limit: since ADR 0155 the
-// token holds `repo` and COULD create a private repo, but a Cloud Bongos instance is
-// open-source / capture-resistant by design, so a repo WE create defaults to public.
-// A user who wants a private instance adopts a private repo they made themselves.
+// private:true — a repo WE create is PRIVATE (ADR 0370, superseding ADR 0155 §3's
+// public default): a new owner's code must never be world-readable from the first
+// push without them choosing that. The standup already handles a private target —
+// ensurePrivateRepoAccess mints the project's own read-only deploy key before the
+// first pull (ADR 0176) — and the owner can make it public later from the manage page.
 // Deliberately not a parameter — nothing should be able to flip this implicitly.
 //
 // Returns { full_name, html_url }. A 422 (name already exists / invalid) becomes a
@@ -87,7 +88,7 @@ async function createUserRepo(token, { name, fetchImpl = fetch } = {}) {
   const res = await fetchImpl(`${GH_API}/user/repos`, {
     method: 'POST',
     headers: ghHeaders(token, { 'Content-Type': 'application/json' }),
-    body: JSON.stringify({ name, private: false, auto_init: false }),
+    body: JSON.stringify({ name, private: true, auto_init: false }),
   });
   if (res.status === 201) {
     const r = await res.json();
@@ -131,7 +132,7 @@ async function getUserRepo(token, { owner, name, fetchImpl = fetch } = {}) {
 
 // The visibility PATCH both directions share. Deliberately NOT exported: callers get
 // one named function per direction, so the name stays the contract and no caller can
-// pass a direction it did not mean (the createUserRepo private:false precedent).
+// pass a direction it did not mean (the createUserRepo fixed-visibility precedent).
 async function setRepoPrivate(token, { owner, name, fetchImpl = fetch }, isPrivate) {
   const res = await fetchImpl(`${GH_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`, {
     method: 'PATCH',

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.79'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.80'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/github_repos_helpers.mjs

@@ -92,7 +92,7 @@ test('listUserRepos: 401 → typed github_unauthorized', async () => {
   );
 });
 
-test('createUserRepo: sends auto_init:false + private:false, returns full_name/html_url', async () => {
+test('createUserRepo: sends auto_init:false + private:true, returns full_name/html_url', async () => {
   let sentBody = null;
   const fetchImpl = async (url, init) => {
     sentBody = JSON.parse(init.body);
@@ -100,10 +100,10 @@ test('createUserRepo: sends auto_init:false + private:false, returns full_name/h
   };
   const out = await gh.createUserRepo('tok', { name: 'mercury', fetchImpl });
   assert.equal(sentBody.auto_init, false, 'empty repo — no README/first commit');
-  // Still public AFTER the ADR 0155 scope widen: `repo` COULD create a private repo,
-  // but a repo Cloud Bongos creates stays public by product choice (open-source /
-  // capture-resistant by design). Guards against the widen silently changing what we make.
-  assert.equal(sentBody.private, false, 'a repo WE create is public by product choice');
+  // PRIVATE by default (ADR 0370, superseding ADR 0155 §3): a new owner's code is never
+  // world-readable from the first push unless they choose that. strictEqual on `true`, so
+  // a dropped field (GitHub's own default is public) reds here too.
+  assert.equal(sentBody.private, true, 'a repo WE create is private by default');
   assert.equal(sentBody.name, 'mercury');
   assert.deepEqual(out, { full_name: 'me/mercury', html_url: 'https://github.com/me/mercury' });
 });

package/tests/hall_tweak_editor.mjs

@@ -657,6 +657,18 @@ try {
     assert.equal(lib.canFrame('https://builders.cloudbongos.com/studio', here), true);
     assert.equal(lib.canFrame('https://cloudbongos.com/', here), false, 'the apex is another origin');
     assert.equal(lib.canFrame('not a url', { origin: '', href: '' }), false);
+    // task 1004393: the apex and status pages split in place only once the proxy allows it.
+    assert.equal(lib.FRAME_SIBLINGS, false, 'off until the proxy sends frame-ancestors for the builders host');
+    assert.equal(lib.canFrame('https://status.cloudbongos.com/', here), false, 'the default follows the switch');
+    assert.equal(lib.canFrame('https://cloudbongos.com/pricing', here, true), true, 'the apex, switched on');
+    assert.equal(lib.canFrame('https://status.cloudbongos.com/', here, true), true, 'the status host, switched on');
+    assert.equal(lib.canFrame('https://box.cloudbongos.com/', here, true), false, 'never another subdomain');
+    assert.equal(lib.canFrame('https://cloudbongos.com.evil.example/', here, true), false, 'never a lookalike host');
+    assert.equal(lib.canFrame('http://cloudbongos.com/', here, true), false, 'never the other scheme');
+    const local = { origin: 'http://builders.localhost:3000', href: 'http://builders.localhost:3000/tweak-editor' };
+    assert.equal(lib.canFrame('http://localhost:3000/', local, true), true, 'the port travels with the apex');
+    const bare = { origin: 'https://cloudbongos.com', href: 'https://cloudbongos.com/builders/tweak-editor' };
+    assert.equal(lib.canFrame('https://status.cloudbongos.com/', bare, true), false, 'only the builders host frames its siblings');
     assert.equal(lib.splitWindowFeatures({ availWidth: 1600, availHeight: 1000, availLeft: 0, availTop: 0 }), 'popup=yes,width=1600,height=500,left=0,top=500', 'the bottom half of the screen');
     assert.match(lib.splitWindowFeatures(undefined), /^popup=yes,width=\d+,height=\d+,left=0,top=\d+$/);
   });