@bongos/core 1.23.22 → 1.24.1

package/src/bongos/routes/auth-google.js

@@ -0,0 +1,246 @@
+// src/bongos/routes/auth-google.js — the Google sign-in routes, and the browser
+// page that approves a command-line sign-in (task 1004993, ADR 0396).
+//
+// WHY ITS OWN FILE. routes/auth.js is the front door for GitHub and sits near the
+// file-size ratchet; these routes reuse its cookie and redirect helpers (all
+// exported from there) rather than copying them, so both ways in keep one
+// definition of "host-only session cookie", "safe return target" and "handoff to
+// builders./status.".
+//
+//   GET  /auth/google/start     → Google's account picker (state + nonce cookie)
+//   GET  /auth/google/callback  → checks the state, trades the code, signs in
+//   GET  /auth/device           → the page a terminal sends the person to
+//   POST /auth/device/approve   → the signed-in person approves or cancels it
+//
+// Every route answers only where googleConfigured() — the owner's Google app AND
+// the hub that keeps who signs in with it (auth-google.js).
+'use strict';
+
+const express = require('express');
+const crypto = require('node:crypto');
+
+const auth = require('../auth');
+const db = require('../db');
+const seams = require('../../module-seams');
+const { pool } = require('../pool');
+const { parseCookie, validateOrRespond } = require('./_helpers');
+const { googleConfigured, buildGoogleAuthorizeUrl, exchangeGoogleCode, completeGoogleFlow } = require('../auth-google');
+const { pendingFlow, decideDeviceFlow, normalizeUserCode } = require('../device-approval');
+const { renderDeviceApprovalPage } = require('../sign-in-pages');
+const authRoutes = require('./auth');
+const log = require('../logger').logger.child({ src: 'auth-google' });
+
+// state.nonce for one Google sign-in, host-only, alive as long as GitHub's handshake.
+const GOOGLE_STATE_COOKIE = 'bongos_google_state';
+// The redirect URI the owner registers in Google Cloud. Pinned to the canonical
+// origin (the same rule as GitHub's, task #734): never derived from the request host.
+const GOOGLE_CALLBACK_PATH = '/api/bongos/auth/google/callback';
+
+function googleRedirectUri() {
+  return `${authRoutes.webRedirectOrigin().replace(/\/+$/, '')}${GOOGLE_CALLBACK_PATH}`;
+}
+
+function isSecure(req) {
+  return !!(req.secure || req.headers['x-forwarded-proto'] === 'https');
+}
+
+function handshakeCookie(req, res, name, value) {
+  res.cookie(name, value, {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: isSecure(req),
+    maxAge: authRoutes.HANDSHAKE_COOKIE_MS,
+  });
+}
+
+function sendNotOffered(res) {
+  return res.status(404).type('text/html').send(authRoutes.renderAuthErrorPage(
+    'Google sign-in isn’t offered here',
+    'This site signs people in with GitHub only.',
+    { subtitle: 'Sign in with GitHub instead.' },
+  ));
+}
+
+// The approval page's own address for a code (relative, so it is a safe return target).
+function devicePagePath(req, userCode) {
+  const base = authRoutes.apiBase(req);
+  return userCode ? `${base}/auth/device?code=${encodeURIComponent(userCode)}` : `${base}/auth/device`;
+}
+
+// A same-site form post only. The session cookie is SameSite=Lax (a cross-site
+// POST never carries it), and this refuses a cross-site request outright too.
+function sameSitePost(req) {
+  const site = req.headers['sec-fetch-site'];
+  if (site && site !== 'same-origin') return false;
+  const origin = req.headers.origin;
+  if (!origin) return true;
+  try { return new URL(origin).hostname.toLowerCase() === authRoutes.reqHost(req); } catch { return false; }
+}
+
+module.exports = function buildAuthGoogleRouter() {
+  const router = express.Router();
+
+  // rank: public — entry into the Google OAuth handshake; identity establishment only.
+  router.get('/auth/google/start', (req, res) => {
+    if (!googleConfigured()) return sendNotOffered(res);
+    // Begun on builders./status.? Restart on the canonical host, where the
+    // callback lands and can read the host-only state cookie back.
+    const host = authRoutes.reqHost(req);
+    if (authRoutes.isSatelliteHubHost(host)) {
+      const raw = authRoutes.safeReturnTo(req.query.return) || authRoutes.safeReturnTo(req.headers.referer) || '/';
+      const back = raw.startsWith('/') ? `https://${host}${raw}` : raw;
+      return res.redirect(`${authRoutes.webRedirectOrigin().replace(/\/+$/, '')}${authRoutes.apiBase(req)}/auth/google/start?${new URLSearchParams({ return: back })}`);
+    }
+    const state = crypto.randomBytes(16).toString('hex');
+    const nonce = crypto.randomBytes(16).toString('hex');
+    handshakeCookie(req, res, GOOGLE_STATE_COOKIE, `${state}.${nonce}`);
+    const returnTo = authRoutes.safeReturnTo(req.query.return) || authRoutes.safeReturnTo(req.headers.referer);
+    if (returnTo) handshakeCookie(req, res, authRoutes.RETURN_COOKIE, returnTo);
+    res.redirect(buildGoogleAuthorizeUrl({ state, nonce, redirectUri: googleRedirectUri() }));
+  });
+
+  // rank: public — OAuth callback; the state cookie + code are the bearer.
+  router.get('/auth/google/callback', async (req, res) => {
+    if (!googleConfigured()) return sendNotOffered(res);
+    const startHref = `${authRoutes.apiBase(req)}/auth/google/start`;
+    const [expectedState, nonce] = String(parseCookie(req, GOOGLE_STATE_COOKIE) || '').split('.');
+    const { state, code, error } = req.query;
+    res.clearCookie(GOOGLE_STATE_COOKIE);
+    if (error) {
+      // access_denied is the person pressing Cancel at Google: not a fault.
+      return res.status(400).type('text/html').send(authRoutes.renderAuthErrorPage(
+        error === 'access_denied' ? 'You cancelled the Google sign-in' : 'Google refused the sign-in',
+        error === 'access_denied' ? 'Nothing was changed. You can try again whenever you like.' : `Google answered "${error}". Try again; if it keeps happening, ask the ${authRoutes.admitterLabel()} to check the Google sign-in app.`,
+        { startHref, note: 'Your account is unchanged.' },
+      ));
+    }
+    if (!code || !state || !expectedState || !nonce || state !== expectedState) {
+      return res.status(400).type('text/html').send(authRoutes.renderAuthErrorPage(
+        'The sign-in took too long',
+        'This sign-in started too long ago or in another browser. Start it again.',
+        { startHref, note: 'Your account is unchanged.' },
+      ));
+    }
+    try {
+      const identity = await exchangeGoogleCode({ code, redirectUri: googleRedirectUri(), nonce });
+      const { token, expiresAt, created } = await completeGoogleFlow({ identity, userAgent: req.headers['user-agent'] });
+      authRoutes.setSessionCookie(req, res, token, expiresAt);
+      const returnTo = authRoutes.safeReturnTo(parseCookie(req, authRoutes.RETURN_COOKIE));
+      res.clearCookie(authRoutes.RETURN_COOKIE);
+      // A brand-new person chooses the name people see first (owner, 2026-10-29) —
+      // unless they were mid-way through approving a terminal sign-in.
+      const toDevicePage = returnTo && returnTo.startsWith(`${authRoutes.apiBase(req)}/auth/device`);
+      if (created && !toDevicePage) return res.redirect('/account?welcome=google');
+      const handoff = returnTo && !returnTo.startsWith('/') && authRoutes.handoffUrlFor(req, returnTo, token, expiresAt);
+      return res.redirect(handoff || returnTo || authRoutes.postLoginLanding());
+    } catch (err) {
+      if (err && err.code === 'NOT_APPROVED') {
+        return res.status(403).type('text/html').send(authRoutes.renderAuthErrorPage(
+          'This site takes invited builders only',
+          `New accounts here need an invite from the ${authRoutes.admitterLabel()}, and invites are sent to GitHub names. Ask the ${authRoutes.admitterLabel()} to let you in, then sign in again.`,
+          { subtitle: 'Sign-in is for approved builders.', cta: { href: '/builders', label: 'Go to the hall' } },
+        ));
+      }
+      if (err && err.code === 'BUILDER_INACTIVE') {
+        return res.status(403).type('text/html').send(authRoutes.renderAuthErrorPage(
+          'This account has been switched off',
+          `This Google account belongs to a builder whose account has been switched off, so it can no longer sign in. If that is a mistake, ask the ${authRoutes.admitterLabel()} to switch it back on.`,
+          { subtitle: 'A switched-off account cannot sign in.', cta: { href: '/builders', label: 'Go to the hall' } },
+        ));
+      }
+      log.error({ err: err && err.message }, '[auth] google/callback');
+      return res.status(500).type('text/html').send(authRoutes.renderAuthErrorPage(
+        'The Google sign-in didn’t finish',
+        `Something went wrong signing you in with Google. Try again; if it keeps happening, ask the ${authRoutes.admitterLabel()} to look at the server logs.`,
+        { startHref, note: 'Your account is unchanged.' },
+      ));
+    }
+  });
+
+  // rank: public — shows a terminal's pending sign-in; approving it is the POST below.
+  router.get('/auth/device', async (req, res) => {
+    res.set('Cache-Control', 'no-store');
+    const enterAction = devicePagePath(req);
+    if (!req.query.code) return res.type('text/html').send(renderDeviceApprovalPage({ state: 'enter', action: enterAction }));
+    const pending = pendingFlow(req.query.code);
+    if (!pending) {
+      return res.status(404).type('text/html').send(renderDeviceApprovalPage({
+        state: 'enter', action: enterAction,
+        problem: 'That code has run out, was already used, or was mistyped. Check it, or start the sign-in again in your terminal.',
+      }));
+    }
+    let session = null;
+    try { session = await auth.resolveSession(req); } catch (err) { log.error({ err: err && err.message }, '[auth] device page session'); }
+    const here = devicePagePath(req, pending.userCode);
+    if (!session || session.status === 'inactive') {
+      const base = authRoutes.apiBase(req);
+      return res.type('text/html').send(renderDeviceApprovalPage({
+        state: 'signin',
+        userCode: pending.userCode,
+        githubHref: `${base}/auth/web/start?via=github&return=${encodeURIComponent(here)}`,
+        googleHref: `${base}/auth/google/start?return=${encodeURIComponent(here)}`,
+      }));
+    }
+    return res.type('text/html').send(renderDeviceApprovalPage({
+      state: 'confirm',
+      userCode: pending.userCode,
+      name: session.display_name || session.github_login || 'you',
+      action: `${authRoutes.apiBase(req)}/auth/device/approve`,
+    }));
+  });
+
+  // rank: any-builder (own identity only) — mints a CLI session for the signed-in
+  //   person themselves, from their browser cookie, never from a bearer (the
+  //   /auth/cli-token/issue rule: a leaked CLI token must not mint more).
+  router.post('/auth/device/approve', express.urlencoded({ extended: false, limit: '2kb' }), auth.requireBuilder, async (req, res) => {
+    res.set('Cache-Control', 'no-store');
+    if (!authRoutes.sessionCookieToken(req) || !sameSitePost(req)) {
+      return res.status(403).type('text/html').send(authRoutes.renderAuthErrorPage(
+        'Approve from the sign-in page',
+        'A command-line sign-in can only be approved from its own page in your browser.',
+        { cta: { href: devicePagePath(req), label: 'Open the sign-in page' }, note: 'Nothing was signed in.' },
+      ));
+    }
+    // Only the page's own two fields; anything else is not this form.
+    if (validateOrRespond(req, res, {
+      user_code: { required: true, type: 'string', maxLength: 16 },
+      decision: { required: true, type: 'string', enum: ['approve', 'deny'] },
+    }, { strict: true })) return;
+    const userCode = req.body.user_code;
+    const approve = req.body.decision === 'approve';
+    const builder = req.builder;
+    try {
+      const decided = await decideDeviceFlow({
+        userCode,
+        approve,
+        mint: async () => {
+          const token = crypto.randomBytes(32).toString('hex');
+          // A CLI bearer has no expiry and is revoked from Settings (ADR 0294).
+          await db.createSession({ builderId: builder.id, token, source: 'cli', userAgent: req.headers['user-agent'] ?? null, expiresAt: null });
+          await seams.resolveOptional('onboarding')?.safeMarkStage(pool, builder.id, 'auth_complete', builder);
+          return {
+            token,
+            builder: { id: builder.id, github_id: builder.github_id, github_login: builder.github_login, display_name: builder.display_name, rank: builder.rank },
+          };
+        },
+      });
+      if (!decided) {
+        return res.status(404).type('text/html').send(renderDeviceApprovalPage({
+          state: 'enter', action: devicePagePath(req),
+          problem: 'That code has run out or was already used. Start the sign-in again in your terminal.',
+        }));
+      }
+      return res.type('text/html').send(renderDeviceApprovalPage({ state: 'done', approved: approve }));
+    } catch (err) {
+      log.error({ err: err && err.message }, '[auth] device/approve');
+      return res.status(500).type('text/html').send(authRoutes.renderAuthErrorPage(
+        'The approval didn’t go through',
+        'Something went wrong. Go back to the sign-in page and press Approve again.',
+        { cta: { href: devicePagePath(req, normalizeUserCode(userCode)), label: 'Back to the sign-in page' } },
+      ));
+    }
+  });
+
+  return router;
+};
+

package/src/bongos/routes/auth.js

@@ -45,6 +45,11 @@ const seams = require('../../module-seams');
 const log = require('../logger').logger.child({ src: 'auth' });
 
 const { escapeHtml } = require('../../html-escape'); // the one server escaper (task 1004876)
+// Google sign-in (task 1004993, ADR 0396): the chooser /auth/web/start shows, and
+// the browser-approved device flow the CLI gets when Google is offered.
+const { googleConfigured } = require('../auth-google');
+const { startBrowserDeviceFlow, isBrowserDeviceCode, pollBrowserDeviceFlow } = require('../device-approval');
+const { renderSignInChooser } = require('../sign-in-pages');
 
 // Render a small standalone HTML page in the builders' hall palette. Used for
 // OAuth error branches so the visitor sees something coherent rather than a
@@ -597,10 +602,17 @@ module.exports = function buildAuthRouter() {
 
   // /auth/device — CLI flow
   // rank: public — auth flow itself; identity establishment, not authorization.
-  router.post('/auth/device/start', async (_req, res) => {
+  router.post('/auth/device/start', async (req, res) => {
     if (!auth.authConfigured()) {
       return res.fail('auth_not_configured', { status: 503, message: 'GitHub OAuth App credentials missing on the server. See blockers/blockers.md#github-oauth-app.' });
     }
+    // Google offered here: the terminal is sent to this instance's own approval
+    // page, where the person signs in with GitHub or Google (device-approval.js).
+    if (googleConfigured()) {
+      return res.json(startBrowserDeviceFlow({
+        pageUrl: `${WEB_REDIRECT_ORIGIN.replace(/\/+$/, '')}${apiBase(req)}/auth/device`,
+      }));
+    }
     try {
       const out = await auth.startDeviceFlow();
       res.json(out);
@@ -629,6 +641,7 @@ module.exports = function buildAuthRouter() {
     })) return;
     const { device_code: deviceCode } = req.body || {};
     if (!deviceCode) return res.fail('device_code_required', 400);
+    if (isBrowserDeviceCode(deviceCode)) return res.json(pollBrowserDeviceFlow(deviceCode));
     try {
       const out = await auth.pollDeviceFlow(deviceCode, req.headers['user-agent']);
       res.json(out);
@@ -711,6 +724,7 @@ module.exports = function buildAuthRouter() {
       const params = new URLSearchParams({ return: back });
       if (wantsRepos) params.set('repos', '1');
       if (wantsSwitch) params.set('switch', '1');
+      if (req.query.via === 'github') params.set('via', 'github');
       return res.redirect(`${WEB_REDIRECT_ORIGIN.replace(/\/+$/, '')}${apiBase(req)}/auth/web/start?${params}`);
     }
     // Already signed in on the canonical host and headed for a satellite hub
@@ -730,6 +744,22 @@ module.exports = function buildAuthRouter() {
         }
       }
     }
+    // Google offered here (task 1004993, ADR 0396): every sign-in link on the site
+    // lands on one chooser — Continue with GitHub or Continue with Google — so no
+    // page needs its own pair of buttons. `via=github` is the GitHub button (and
+    // any door that needs GitHub itself); "New account" names a GitHub account.
+    if (req.query.via !== 'github' && !wantsSwitch && googleConfigured()) {
+      const ret = safeReturnTo(req.query.return) || safeReturnTo(req.headers.referer);
+      const gh = new URLSearchParams({ via: 'github' });
+      if (ret) gh.set('return', ret);
+      if (wantsRepos) gh.set('repos', '1');
+      const goo = new URLSearchParams(ret ? { return: ret } : {});
+      res.set('Cache-Control', 'no-store');
+      return res.type('text/html').send(renderSignInChooser({
+        githubHref: `${apiBase(req)}/auth/web/start?${gh}`,
+        googleHref: `${apiBase(req)}/auth/google/start${goo.toString() ? `?${goo}` : ''}`,
+      }));
+    }
     const state = crypto.randomBytes(16).toString('hex');
     // redirect_uri is PINNED to the canonical origin (#734) — never derived from
     // the request host. GitHub only knows the apex callback, so a sign-in begun
@@ -1406,6 +1436,13 @@ module.exports.redeemHandoffCode = redeemHandoffCode;
 module.exports.handoffUrlFor = handoffUrlFor;
 module.exports.HANDOFF_TTL_MS = HANDOFF_TTL_MS;
 module.exports.reqHost = reqHost;
+// The helpers the Google sign-in routes reuse (routes/auth-google.js, task 1004993),
+// so both ways in share one cookie, host and return-target rule.
+module.exports.isSatelliteHubHost = isSatelliteHubHost;
+module.exports.sessionCookieToken = sessionCookieToken;
+module.exports.apiBase = apiBase;
+module.exports.RETURN_COOKIE = RETURN_COOKIE;
+module.exports.webRedirectOrigin = () => WEB_REDIRECT_ORIGIN;
 // The auth-error page renderer (task 1439): pure over the branding pack, so a
 // test can prove every visible string is brand-owned (no OTB lore baked in).
 module.exports.renderAuthErrorPage = renderAuthErrorPage;

package/src/bongos/routes/backup.js

@@ -13,6 +13,11 @@
 //     in the background. The builder polls status to see it land.
 //   - concurrent triggers: a simple in-memory flag prevents two dumps from
 //     running simultaneously (one droplet, one disk, no need for DB state).
+//   - trigger vs the nightly timer: the timer runs db-backup-nightly.sh outside
+//     this process, so the flag cannot see it. The SCRIPT takes a per-database
+//     flock under the backup dir (task 1004966), and both paths run that one
+//     script, so they share the lock. A run that finds it held exits 0 with a
+//     `gds-db-backup: SKIPPED` line, which the trigger logs as a skip.
 //   - the backup dir and script paths default to the on-droplet locations but
 //     can be overridden via env vars for local tests.
 
@@ -42,6 +47,9 @@ const DB_NAME = resolveEnv('BACKUP_DB')
 const BACKUP_SCRIPT = resolveEnv('BACKUP_SCRIPT')
   || path.join(REPO_ROOT, 'scripts', 'bongos', 'db-backup-nightly.sh');
 
+// The line db-backup-nightly.sh prints when its flock is already held (task 1004966).
+const SKIPPED_MARK = 'gds-db-backup: SKIPPED';
+
 // In-memory guard: true while a trigger-initiated dump is running.
 let triggerRunning = false;
 
@@ -130,7 +138,10 @@ function backupDeskRows(dump, running) {
   return [{ id: 'now', name: 'Back up now', fact, facts: dump && dump.stale ? ['the last one is stale'] : [], tool: true, ref: { type: 'backup', id: 'now' }, acts: running ? [] : [{ key: 'backup' }] }];
 }
 
-module.exports = function buildBackupRouter() {
+// `deps.execFile` is the test seam (task 1004924): the single-flight lock below
+// is pinned by tests/backup_trigger_lock.mjs without spawning a real dump.
+module.exports = function buildBackupRouter(deps = {}) {
+  const runFile = deps.execFile || execFile;
   seams.contribute('governor.docket', { desk: 'treasury.backup', gate: { permission: 'backup.manage' }, read: async () => backupDeskRows(await newestDumpAge(), triggerRunning) });
   const router = express.Router();
 
@@ -165,15 +176,26 @@ module.exports = function buildBackupRouter() {
       const builderId = req.builder && req.builder.id;
       log.info(`[gds] backup triggered by builder ${builderId} at ${startedAt}`);
 
-      execFile('bash', [BACKUP_SCRIPT], { cwd: REPO_ROOT, timeout: 120_000 }, (err, stdout, stderr) => {
+      // A spawn that throws synchronously never reaches the callback, so it must
+      // release the lock itself — or every later trigger 409s until a restart
+      // (task 1004924).
+      try {
+        runFile('bash', [BACKUP_SCRIPT], { cwd: REPO_ROOT, timeout: 120_000 }, (err, stdout, stderr) => {
+          triggerRunning = false;
+          if (err) {
+            log.error(`[gds] backup trigger failed (builder ${builderId}):`, err.message);
+            if (stderr) log.error('[gds] backup stderr:', stderr.toString().trim());
+          } else if (String(stdout || '').includes(SKIPPED_MARK)) {
+            log.info(`[gds] backup trigger skipped: another backup already holds the lock (builder ${builderId})`);
+          } else {
+            log.info(`[gds] backup trigger completed (builder ${builderId})`);
+          }
+        });
+      } catch (e) {
         triggerRunning = false;
-        if (err) {
-          log.error(`[gds] backup trigger failed (builder ${builderId}):`, err.message);
-          if (stderr) log.error('[gds] backup stderr:', stderr.toString().trim());
-        } else {
-          log.info(`[gds] backup trigger completed (builder ${builderId})`);
-        }
-      });
+        log.error(`[gds] backup trigger could not start (builder ${builderId}):`, e && e.message);
+        return res.fail('backup_start_failed', { status: 500, message: 'The backup could not be started — see the server log.' });
+      }
 
       res.status(202).json({
         ok: true,
@@ -192,5 +214,7 @@ module.exports.parseDumpTimestamp = parseDumpTimestamp;
 module.exports.dumpAgeHours = dumpAgeHours;
 module.exports.isStaleDump = isStaleDump;
 module.exports.STALE_AFTER_HOURS = STALE_AFTER_HOURS;
+module.exports.SKIPPED_MARK = SKIPPED_MARK;
+module.exports.BACKUP_SCRIPT = BACKUP_SCRIPT;
 
 module.exports.backupDeskRows = backupDeskRows;

package/src/bongos/routes/builders.js

@@ -22,8 +22,6 @@
 // lifecycle module (BV1.R86) and are resolved through the `lifecycle` kernel port
 // (`lc()`), never a direct module require — the core↔module boundary rule.
 
-const path = require('node:path');
-const { execFile } = require('node:child_process');
 const express = require('express');
 const auth = require('../auth');
 // WHO DECIDES AT TREASURY (task 1004657; ADR 0363 D5): the budget write refuses a
@@ -31,6 +29,7 @@ const auth = require('../auth');
 // matter sets the limit through setMonthlyBudget directly (the governor.matterAct
 // below), never through the route, so the sitting is never refused by its own gate.
 const { requireActAlone } = require('../act-alone');
+const { setCapabilityGrants } = require('../task-needs');
 const db = require('../db');
 const { validateOrRespond, LIMITS, parseId } = require('./_helpers');
 // The onboarding state machine carved into modules/onboarding/ (BV1.R81 / ADR
@@ -109,10 +108,6 @@ const discordIsLinked = (builderId) =>
 // picks up the latest credit_log row via GET /me/pending-rank-change). Audit
 // log proper lands later (R36).
 
-// Resolve the repo root from this file. Used to invoke scripts/discord/post.js
-// regardless of where the node process was started from.
-const REPO_ROOT = path.resolve(__dirname, '..', '..', '..');
-
 // Map a rank id (db enum string) to its display form used in the Discord
 // broadcast — capitalized, no surprises. Centralized here so the wording is
 // consistent everywhere ceremony surfaces the rank.
@@ -143,34 +138,37 @@ function buildRankChangeBroadcast({ displayName, direction, newRank }) {
 }
 
 // Fire the rank-change broadcast in the background. Best-effort: a post
-// failure must never undo a successful rank change. We detach (no callback
-// wait) and let stderr surface in server logs if the post script errors.
-// Outbound moved from Google Chat to Discord #ship-news per ADR 0032 / #607
-// (scripts/chat/ is inbound-only now). The CHAT_DRY_RUN env var short-circuits
-// to a "[broadcast dry-run]" log line — used by the smoke path so a test rank
-// flip doesn't actually hit Discord. The name is a legacy artifact; it gates
-// all broadcast transports, not just Chat.
+// failure must never undo a successful rank change, so the route never awaits
+// this and every failure is swallowed into a log line.
+//
+// IN-PROCESS, THROUGH THE PORT (task 1004962). This used to spawn a whole
+// `node scripts/discord/post.js` per rank change — 50-100 MB and ~300 ms of CPU
+// each, with nothing bounding a burst. It now calls the discord module's
+// `discord.post` port, resolved per call (the module registers it at mount and
+// may mount after this router). Never a require into modules/ — the core→module
+// edge ADR 0083 forbids. No discord module, or no #ship-news webhook configured
+// (the port answers posted:false), and nothing is posted; the rank change is
+// untouched either way.
+//
+// CHAT_DRY_RUN=1 short-circuits to a "[broadcast dry-run]" log line — the smoke
+// path's guard so a test rank flip doesn't actually hit Discord. The name is a
+// legacy artifact; it gates all broadcast transports, not just Chat.
+//
+// Returns the post's promise (always resolves) so tests can await the outcome.
 function fireDiscordBroadcast(text) {
-  if (!text) return;
+  if (!text) return Promise.resolve({ posted: false, reason: 'no_text' });
   if (process.env.CHAT_DRY_RUN === '1') {
     log.info(`[gds] [broadcast dry-run] would post: ${text}`);
-    return;
-  }
-  try {
-    execFile(
-      'node',
-      ['scripts/discord/post.js', text],
-      { cwd: REPO_ROOT, timeout: 10_000 },
-      (err, _stdout, stderr) => {
-        if (err) {
-          log.info('[gds] rank-change broadcast failed (non-blocking):', err.message);
-          if (stderr) log.info('[gds] discord stderr:', stderr.toString().trim());
-        }
-      }
-    );
-  } catch (e) {
-    log.info('[gds] rank-change broadcast spawn failed (non-blocking):', e && e.message);
+    return Promise.resolve({ posted: false, reason: 'dry_run' });
   }
+  const post = seams.resolveOptional('discord.post', null);
+  if (typeof post !== 'function') return Promise.resolve({ posted: false, reason: 'no_discord' });
+  return Promise.resolve()
+    .then(() => post({ channel: 'ship_news', text }))
+    .catch((e) => {
+      log.info(`[gds] rank-change broadcast failed (non-blocking): ${e && e.message}`);
+      return { posted: false, reason: 'post_failed' };
+    });
 }
 
 // The People desk's builder rows (task 1004559): one row per active builder the
@@ -422,6 +420,34 @@ module.exports = function buildBuildersRouter() {
     }
   });
 
+  // PATCH /builders/:id/capabilities — the owner gives or takes a builder's server
+  // access (task 1004950, ADR 0395). Body: { server: boolean }. A task that needs
+  // the server is shown to and claimable by a builder only while this is on.
+  // Default off. Only the person in the owner seat may set it (403 not_project_owner),
+  // read fresh per request like rank — an Archon who is not the owner cannot.
+  // rank: archon — changes what another builder may claim. Gate:
+  // requirePermission('builder.status.set') AND the owner seat (in-handler).
+  router.patch('/builders/:id/capabilities', auth.requireBuilder, auth.requirePermission('builder.status.set'), async (req, res) => {
+    if (validateOrRespond(req, res, { server: { required: true, type: 'boolean' } })) return;
+    const targetId = parseId(req, res, { code: 'bad_builder_id', positiveInt: true });
+    if (targetId === null) return;
+    try {
+      // The owner-seat check runs inside setCapabilityGrants, at the write.
+      const builder = await setCapabilityGrants({
+        actorBuilderId: req.builder.id, builderId: targetId, grants: req.body.server ? ['server'] : [],
+      });
+      if (!builder) return res.fail('builder_not_found', 404);
+      res.json({ builder });
+    } catch (err) {
+      if (err && err.code === 'NOT_PROJECT_OWNER') {
+        return res.fail('not_project_owner', { status: 403, message: 'Only the project owner can give or take server access.' });
+      }
+      if (err && err.code === 'TARGET_IS_SYSTEM_PRINCIPAL') return res.fail('target_is_system_principal', 403);
+      log.error('[gds] PATCH /builders/:id/capabilities', err);
+      res.fail('capability_change_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // PATCH /builders/:id/budget — set or clear a builder's monthly spend ceiling
   // (V3.R84 #302, criterion C3). Archon-only. Body: { monthly_budget_usd: <num> }
   // sets the per-builder override — the manual emergency brake; a positive value
@@ -834,4 +860,5 @@ module.exports = function buildBuildersRouter() {
 };
 
 module.exports.builderDeskRows = builderDeskRows;
+module.exports.fireDiscordBroadcast = fireDiscordBroadcast;
 module.exports.budgetDeskRows = budgetDeskRows;

package/src/bongos/routes/github.js

@@ -25,6 +25,7 @@ const { listUserRepos, createUserRepo, listUserOrgs, getOrgAccess, createOrgRepo
 // pin to the real implementations.
 const githubRepos = require('../github-repos');
 const { validateOrRespond } = require('./_helpers');
+const prelaunch = require('../prelaunch-gate');
 const log = require('../logger').logger.child({ src: 'github' });
 
 // GitHub repo names: 1–100 chars of [A-Za-z0-9._-]. We validate strictly for a clean
@@ -228,6 +229,14 @@ module.exports = function buildGithubRouter() {
         message: 'Make a repository private from its project’s manage page — the platform has to give the project its own deploy key first, or its next deploy would break.',
       });
     }
+    // Pre-launch (stealth) keeps every project's code private (task 1004998): while
+    // the instance's password gate is on, nothing here flips a repo public.
+    if (prelaunch.enabled()) {
+      return res.fail('public_repo_prelaunch', {
+        status: 409,
+        message: 'While we are in pre-launch, every project’s code stays private, so a repository can’t be made public yet.',
+      });
+    }
     const token = await resolveRepoToken(req, res);
     if (!token) return;
     try {

package/src/bongos/routes/me.js

@@ -208,6 +208,12 @@ module.exports = function buildMeRouter() {
     // task 1004777: stuck page tweaks this builder should be told about, through
     // the copy-desk PORT (core never imports the module, ADR 0093). Started here so
     // it runs beside the fan-out below; [] when copy-desk is off or the read fails.
+    // task 1004914 (N10): open holds on this builder's pay. Pay is never withheld
+    // silently (ADR 0385 D8), so each open hold is a need on every surface /me
+    // feeds. Fail-open to none: a money read must never break a profile.
+    const openPayoutHoldsP = (async () => {
+      try { return await require('../payout-gates').openHoldsFor(req.builder.id); } catch (_) { return null; }
+    })();
     const stuckPageTweaksP = (async () => {
       try {
         const port = seams.resolveOptional('copy-desk.stuckPageTweaksFor');
@@ -421,6 +427,16 @@ module.exports = function buildMeRouter() {
     const activeClaimsWithPreview = await claimsWithStreakPreview(
       reward, req.builder.id, activeClaims, streakInfo, craftModes
     );
+    // task 1004948: a gentle "this page is being updated" line per code claim, so the
+    // Conductor can tell the session. Information only; a failed read is no line.
+    // One read for all the claims; an artist's own page claim (no worktree) is not code work.
+    const codeClaims = activeClaimsWithPreview.filter((c) => c.worktree_name != null);
+    let notices = new Map();
+    try {
+      const l = lc();
+      if (l && l.noticesForClaims) notices = await l.noticesForClaims(codeClaims);
+    } catch (_) { /* heads-up only */ }
+    for (const c of activeClaimsWithPreview) c.page_notice = notices.get(String(c.task_id)) || [];
     const payload = {
       builder,
       active_claims: activeClaimsWithPreview,
@@ -622,6 +638,8 @@ module.exports = function buildMeRouter() {
         openMingleIntroductions: mingleIntroductionCount,
         // task 1004777: one Needs-attention line per stuck page tweak.
         stuckPageTweaks: await stuckPageTweaksP,
+        // task 1004914: { count, first_id } of open holds on this builder's pay.
+        openPayoutHolds: await openPayoutHoldsP,
       }) : [],
     };
     // Module→core contribution seam (BV1.R42, ADR 0083). Let each enabled module