@bongos/core 1.24.4 → 1.24.6

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.4",
+  "version": "1.24.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.4",
+      "version": "1.24.6",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.4",
+  "version": "1.24.6",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10812,7 +10812,27 @@
       "text": "The payments decision record now carries the owner's answers: credits can be tuned but not switched off, pay rules live on the settings page, and Verro is Verro Labs."
     }
   ],
-  "1.24.4": [
+  "1.24.5": [
+    {
+      "id": "1004973",
+      "text": "A page tweak whose apply stopped partway, with nobody holding it any more, now goes back in the queue by itself with a note saying the apply stopped, instead of sitting stuck forever."
+    },
+    {
+      "id": "1005004",
+      "text": "Fixed a check that could wrongly stop a builder from handing back or finishing their own task when their ID arrived written as a number instead of text."
+    },
+    {
+      "id": "1005015",
+      "text": "AI agents now reliably flag when they need you (HUMAN TASK / HUMAN DECISION) and own up when a doc or tool misled them, on every machine, even ones running out-of-date copies."
+    },
+    {
+      "id": "1004972",
+      "text": "A page tweak someone opened but never wrote in now shows as \"Opened, nothing written yet\" instead of \"Needs to be reviewed\", and closes itself after one day with a note saying nothing was written."
+    },
+    {
+      "id": "1004978",
+      "text": "Deleted an old, out-of-date manifest file from the repository root that nothing used, so old scripts it listed no longer look like they are still in use."
+    },
     {
       "id": "1004968",
       "text": "The setting that sizes credit rewards is now called a cost scale instead of a dollar peg, so it no longer reads like an exchange rate; old project settings keep working and nobody's rewards change."
@@ -10833,5 +10853,23 @@
       "id": "1005006",
       "text": "The Treasury screen now counts builder rewards in credits instead of dollars, and no longer says one credit is a dollar."
     }
+  ],
+  "1.24.6": [
+    {
+      "id": "1004976",
+      "text": "A page tweak draft nobody has touched for a day now closes by itself, as the owner asked, and the words written so far stay saved on the task."
+    },
+    {
+      "id": "1005005",
+      "text": "Claiming several tasks at once now follows the same rule as claiming one: a work session that already has a task in progress in a folder cannot pile more tasks into that same folder."
+    },
+    {
+      "id": "1004988",
+      "text": "The database itself now refuses any credit entry that spends, redeems or transfers credits; only an undo of an earlier entry may take credits away, and existing records are untouched."
+    },
+    {
+      "id": "1004995",
+      "text": "On the account page, people can now link GitHub and Google to one account, both ways, so either one opens the same account with the same credits, ranks and history. They can remove one too, but never their last way in. Two exi"
+    }
   ]
 }

package/scripts/bongos/codemod-rename-scripts-gds.js

@@ -52,8 +52,7 @@
 //   - files that deliberately name BOTH spellings or the old one: this codemod, forwarder.js,
 //     the forwarder test, modules/lifecycle/executed-closure.js (lists both on purpose),
 //     rename-ledger-prose.js (masks `scripts/gds` as a protected identifier in ledger prose),
-//     the task-2004 codemod (a historical tool), and .bongos-core.json (the manifest of a
-//     core build cut from an older commit — its paths describe THAT build).
+//     and the task-2004 codemod (a historical tool).
 //
 // Usage:
 //   node scripts/bongos/codemod-rename-scripts-gds.js           # apply
@@ -81,7 +80,6 @@ const EXCLUDE = new Set([
   'tests/scripts_gds_forwarders.mjs',
   'modules/lifecycle/executed-closure.js',
   'scripts/bongos/rename-ledger-prose.js',
-  '.bongos-core.json',
 ]);
 
 const FROZEN_PATHS = [

package/scripts/bongos/dev-box-guard.js

@@ -85,7 +85,6 @@ const DEV_BOX_EXEMPT = new Map([
   // Captured data and seed history that name real records.
   ['scripts/bongos/seed-', 'one-shot task seeders: their subject is the historical tasks they filed'],
   ['scripts/hall-preview/fixtures/', 'captured API responses: the ledger still holds these task and goal rows'],
-  ['.bongos-core.json', 'a 1.0.0 seed manifest from July (commit b6ee5d29) that this repo never regenerates'],
 ]);
 
 const TEXT_EXT = /\.(js|mjs|cjs|json|md|sql|sh|html|css|yml|yaml|txt|toml)$/;

package/scripts/bongos/publish-manifest.js

@@ -316,7 +316,7 @@ const INSTANCE_EXCLUDE = [
   // the instance-recipe / game-design carve-outs above. (The portable ADRs + the README index still publish.)
   // The instance's OWN name + trademark decision. Its prose redacts cleanly, but the FILENAME
   // carries the brand and the publish manifest lists every path — so the literal shipped in
-  // .bongos-core.json no matter how well the body was redacted. It also genericizes to nothing:
+  // the tarball's inner .bongos-core.json no matter how well the body was redacted. It also genericizes to nothing:
   // "accepting trademark risk on <our name>" is not a decision another instance inherits.
   // (task 1003869 — the last literal in the artifact.)
   'docs/adr/0004-amazonprimea-name-and-trademark-acceptance.md',

package/scripts/bongos/run-unit-tests.js

@@ -259,6 +259,10 @@ const INTEGRATION = new Set([
   // task 1004914 (ADR 0385 D8): the payout gate tables from the real migration —
   // append-only, no silent hold, who may appeal, decide and co-sign, the gate end to end.
   'payout_gates_db',
+  // task 1004988 (ADR 0385 D2): credit_log from the real migration — Postgres
+  // refuses a spend, redemption or transfer row; only a reversal of an existing
+  // row may be negative, and core_194's clawback still books.
+  'credit_log_no_spend_db',
   // task 1004408: migration platform_identity_028 deletes the old hub invite's
   // pending rows before a cutoff it reads from the core_upgrades ledger. Only a real
   // engine runs the DO block, the numeric version compare and the one-shot guard.

package/src/bongos/agent-standing-rules.js

@@ -0,0 +1,44 @@
+'use strict';
+// src/bongos/agent-standing-rules.js — the rules every AI session obeys whoever the
+// builder is, served by the SERVER so a stale checkout still hears them (task 1005015).
+//
+// WHY THE SERVER. The human signal (task 1004922) lived only in the local Conductor
+// hook, told once on a session's first prompt. A hook runs from whatever checkout the
+// machine has, and on the owner's box that was 823 commits behind, so the markers never
+// appeared at all. Slop detection lived only as a CLAUDE.md table row nothing ever
+// triggered. GET /me's interaction contract is relayed verbatim by EVERY Conductor
+// since task 2010, stale ones included, so appending these rules to it reaches every
+// active user the moment the instance serving them runs this code.
+//
+// The wording is the rule's home for sessions; docs/voice.md is its home for people.
+// conductor.js and stop-slopcheck.js carry their own copies (they must work on a
+// checkout whose core cannot load), and tests/agent_standing_rules.mjs holds every
+// copy equal to the contract this file serves. Only withStandingRules is exported:
+// the hooks' dynamic core resolve is invisible to the dead-code scan.
+
+const HUMAN_SIGNAL_TEXT = 'When you need the person, start that line with `🙋 **HUMAN TASK:**` if they must DO something '
+  + 'only a person can do (try it on the live site, add a key, sign in, approve), or `🔀 **HUMAN DECISION:**` if they must '
+  + 'CHOOSE (list the options and mark your pick). Put the same marker at the start of a question-box question. Never use them for anything else.';
+
+const SLOP_TEXT = 'The moment you find you were wrong because something told you so (a doc, a hook\'s output, a script\'s message, '
+  + 'a stale file) — or the person corrects you — say `🐛 Bongo Slop Detected!!, Filing Bug 🐛`, name the source that misled you, '
+  + 'and file it: `node scripts/bongos/capture.js "<file>: says X, truth is Y" --kind bug`. The misleading source is the bug. '
+  + 'Your own plain mistake, with nothing misleading behind it, is not slop.';
+
+const HEADER = 'Standing rules for every session:';
+
+function standingRulesBlock() {
+  return `${HEADER}\n- ${HUMAN_SIGNAL_TEXT}\n- ${SLOP_TEXT}`;
+}
+
+// The interaction slice of GET /me with the standing rules appended. `interaction` is
+// describeInteraction's object or null (builder-settings module off); either way the
+// result injects, because these rules do not depend on any preference. Idempotent.
+function withStandingRules(interaction) {
+  const base = interaction && typeof interaction === 'object' ? interaction : {};
+  const contract = typeof base.contract === 'string' ? base.contract : '';
+  if (contract.includes(HEADER)) return { ...base, inject: true };
+  return { ...base, contract: contract ? `${contract}\n${standingRulesBlock()}` : standingRulesBlock(), inject: true };
+}
+
+module.exports = { withStandingRules };

package/src/bongos/auth-github.js

@@ -189,7 +189,8 @@ async function pollDeviceFlow(deviceCode, userAgent) {
     // admitted only if open enrollment is on OR an Archon marked their
     // access_request 'invited'. An EXISTING builder ALWAYS passes, so an approved
     // builder can never be locked out of CLI enrollment. See ADR 0050.
-    const existing = await getBuilderByGithubId(ghUser.id);
+    const personKey = await githubPersonKey(ghUser);
+    const existing = await getBuilderByGithubId(personKey);
     // Only consult the access_request table for a genuine first-timer (and only
     // when open enrollment is off) — an existing builder short-circuits to
     // ALWAYS-pass, matching completeWebFlow's `if (!existing)` lookup.
@@ -202,7 +203,7 @@ async function pollDeviceFlow(deviceCode, userAgent) {
       }
     }
     let builder = await upsertBuilder({
-      githubId: ghUser.id,
+      githubId: personKey,
       githubLogin: ghUser.login,
       displayName: ghUser.name || ghUser.login,
       avatarUrl: ghUser.avatar_url,
@@ -243,12 +244,26 @@ async function pollDeviceFlow(deviceCode, userAgent) {
 // hub provides the function, so every other instance skips it. The identity is
 // GitHub's answer for the exchanged code, never a request field. Best-effort: a
 // failed stamp must not cost the sign-in, and the next sign-in writes it.
-async function recordHubSignin(ghUser) {
+// Who a GitHub sign-in reaches (task 1004995, the ADR 0393 carry-over). On the
+// hub a GitHub account may be linked to someone who joined with Google, whose
+// builder row is keyed on their minted person key, not the GitHub id — so the
+// hub is asked first, or the sign-in would make that person a second account.
+// Off the hub there is no port and the GitHub id is the key, as it always was.
+// Not best-effort: if the hub cannot answer, the sign-in fails rather than guess.
+async function githubPersonKey(ghUser) {
+  const hub = seams.resolveOptional('platform-identity.hub');
+  if (!hub || typeof hub.personKeyForGithub !== 'function') return String(ghUser.id);
+  return (await hub.personKeyForGithub(String(ghUser.id))) || String(ghUser.id);
+}
+
+async function recordHubSignin(ghUser, personKey) {
   try {
     const hub = seams.resolveOptional('platform-identity.hub');
     if (!hub || typeof hub.recordHubSignin !== 'function') return;
     await hub.recordHubSignin({
-      githubId: String(ghUser.id),
+      githubId: String(personKey || ghUser.id),
+      githubUserId: String(ghUser.id),
+      email: typeof ghUser.email === 'string' ? ghUser.email : null,
       githubLogin: ghUser.login,
       displayName: ghUser.name || ghUser.login,
       avatarUrl: ghUser.avatar_url,
@@ -293,7 +308,8 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
   // so they cannot drift. An owner who wants fully-open self-enrollment sets
   // OTB_OPEN_XENOS_ENROLLMENT truthy (no code change); default = invite required.
   // See ADR 0050.
-  const existing = await getBuilderByGithubId(ghUser.id);
+  const personKey = await githubPersonKey(ghUser);
+  const existing = await getBuilderByGithubId(personKey);
   if (!existing && !openEnrollmentEnabled()) {
     const approved = await hasInvitedAccessRequest(ghUser.login);
     // Pass `login` so the configured-firstAdmin bypass (firstTimeAdmissionBlocked
@@ -315,7 +331,7 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
     }
   }
   let builder = await upsertBuilder({
-    githubId: ghUser.id,
+    githubId: personKey,
     githubLogin: ghUser.login,
     displayName: ghUser.name || ghUser.login,
     avatarUrl: ghUser.avatar_url,
@@ -345,7 +361,7 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
   });
   // V3.R75 (#294): tick the onboarding state machine. Best-effort.
   await seams.resolveOptional('onboarding')?.safeMarkStage(pool, builder.id, 'auth_complete', builder);
-  await recordHubSignin(ghUser);
+  await recordHubSignin(ghUser, personKey);
   // Wizard opt-in only (task 1002099 / ADR 0143): when the caller asked to capture
   // repo access, hand the GitHub access token + granted scope back so the web
   // callback can persist it (encrypted, short-TTL) for the repo picker/creator.
@@ -372,6 +388,7 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
 module.exports = {
   buildAuthorizeUrl,
   completeWebFlow,
+  exchangeCodeForToken,
   fetchGithubUser,
   newSessionToken,
   pollDeviceFlow,

package/src/bongos/module-scope-map.js

@@ -615,8 +615,9 @@ const SHARED_GLOBS = Object.freeze(
 // Assigning nineteen roots in one pass is the one-at-a-time churn task 1004132 was
 // filed to avoid; freezing the set and naming the arguable ones is the cheap half.
 const UNOWNED_ROOTS = Object.freeze({
-  // Generated packaging manifests — written by package-core.js, never hand-edited.
-  '.bongos-core.json': 'generated package manifest (scripts/bongos/package-core.js)',
+  // Generated packaging manifest — written by package-core.js, never hand-edited.
+  // (The repo-root .bongos-core.json, a stale July 1.0.0 seed, was deleted in task 1004978;
+  // the live one is the INNER manifest package-core writes into the tarball.)
   '.cloudbongos-core.json': 'generated package manifest (scripts/bongos/package-core.js)',
   // Governance + legal. Deliberately not methodology: methodology owns docs/, and
   // these are the project's constitutional documents rather than its handbook.

package/src/bongos/routes/auth-google.js

@@ -26,8 +26,9 @@ const { pool } = require('../pool');
 const { parseCookie, validateOrRespond } = require('./_helpers');
 const { googleConfigured, buildGoogleAuthorizeUrl, exchangeGoogleCode, completeGoogleFlow } = require('../auth-google');
 const { pendingFlow, decideDeviceFlow, normalizeUserCode } = require('../device-approval');
-const { renderDeviceApprovalPage } = require('../sign-in-pages');
+const { renderDeviceApprovalPage, renderExistingAccountHint } = require('../sign-in-pages');
 const authRoutes = require('./auth');
+const authLink = require('./auth-link');
 const log = require('../logger').logger.child({ src: 'auth-google' });
 
 // state.nonce for one Google sign-in, host-only, alive as long as GitHub's handshake.
@@ -77,11 +78,52 @@ function sameSitePost(req) {
   try { return new URL(origin).hostname.toLowerCase() === authRoutes.reqHost(req); } catch { return false; }
 }
 
+// Is this a first Google sign-in whose verified address an account that signs in
+// with GitHub also shows? Then the person is offered that account before a second
+// one is made (task 1004995). A suggestion only: an unverified address never
+// counts, and a failed read shows no hint rather than blocking the sign-in.
+async function suggestsExistingGithub(identity) {
+  if (!identity || !identity.emailVerified || !identity.email) return false;
+  const hub = seams.resolveOptional('platform-identity.hub');
+  if (!hub || typeof hub.googleSignInHint !== 'function') return false;
+  try {
+    const hint = await hub.googleSignInHint({ subject: identity.subject, email: identity.email });
+    return Array.isArray(hint) && hint.includes('github');
+  } catch (err) {
+    log.error({ err: err && err.message }, '[auth] google sign-in hint');
+    return false;
+  }
+}
+
+// The second half of Link Google (task 1004995): the Google account the person
+// just picked becomes another way into the account they are signed in to, or the
+// account page says why not. Never a sign-in, and never a merge.
+async function finishGoogleLink(req, res, { expectedState, nonce, state, code, error }) {
+  if (!authLink.hubLinker()) return sendNotOffered(res);
+  if (error || !code || !state || !expectedState || !nonce || state !== expectedState) {
+    return res.redirect(authLink.linkLanding('google', { refused: error === 'access_denied' ? 'cancelled' : 'expired' }));
+  }
+  let session = null;
+  try { session = await auth.resolveSession(req); } catch (err) { log.error({ err: err && err.message }, '[auth] google link session'); }
+  if (!session || session.status === 'inactive') return res.redirect('/account');
+  try {
+    const identity = await exchangeGoogleCode({ code, redirectUri: googleRedirectUri(), nonce });
+    const out = await authLink.linkToSession({
+      session, provider: 'google', subject: identity.subject,
+      email: identity.emailVerified ? identity.email : null,
+    });
+    return res.redirect(authLink.linkLanding('google', out));
+  } catch (err) {
+    log.error({ err: err && err.message }, '[auth] google link');
+    return res.redirect(authLink.linkLanding('google', { refused: 'failed' }));
+  }
+}
+
 module.exports = function buildAuthGoogleRouter() {
   const router = express.Router();
 
   // rank: public — entry into the Google OAuth handshake; identity establishment only.
-  router.get('/auth/google/start', (req, res) => {
+  router.get('/auth/google/start', async (req, res) => {
     if (!googleConfigured()) return sendNotOffered(res);
     // Begun on builders./status.? Restart on the canonical host, where the
     // callback lands and can read the host-only state cookie back.
@@ -93,8 +135,24 @@ module.exports = function buildAuthGoogleRouter() {
     }
     const state = crypto.randomBytes(16).toString('hex');
     const nonce = crypto.randomBytes(16).toString('hex');
-    handshakeCookie(req, res, GOOGLE_STATE_COOKIE, `${state}.${nonce}`);
-    const returnTo = authRoutes.safeReturnTo(req.query.return) || authRoutes.safeReturnTo(req.headers.referer);
+    // Link Google to the signed-in person (task 1004995). Google matches redirect
+    // URIs exactly, so a link shares this handshake and the callback reads the
+    // flag back from the host-only state cookie, never from the query.
+    if (req.query.link === '1') {
+      if (!authLink.hubLinker()) return sendNotOffered(res);
+      let session = null;
+      try { session = await auth.resolveSession(req); } catch (err) { log.error({ err: err && err.message }, '[auth] google link start session'); }
+      if (!session || session.status === 'inactive') return res.redirect('/account');
+      handshakeCookie(req, res, GOOGLE_STATE_COOKIE, `${state}.${nonce}.link`);
+      return res.redirect(buildGoogleAuthorizeUrl({ state, nonce, redirectUri: googleRedirectUri() }));
+    }
+    // `fresh=1` is "Make a new account with Google" on the existing-account hint
+    // (task 1004995): the person has seen the hint, so it is not shown again, and
+    // the return target set by the first attempt is kept (the referrer is now
+    // the callback, which is no place to land).
+    const fresh = req.query.fresh === '1';
+    handshakeCookie(req, res, GOOGLE_STATE_COOKIE, fresh ? `${state}.${nonce}.fresh` : `${state}.${nonce}`);
+    const returnTo = !fresh && (authRoutes.safeReturnTo(req.query.return) || authRoutes.safeReturnTo(req.headers.referer));
     if (returnTo) handshakeCookie(req, res, authRoutes.RETURN_COOKIE, returnTo);
     res.redirect(buildGoogleAuthorizeUrl({ state, nonce, redirectUri: googleRedirectUri() }));
   });
@@ -103,9 +161,10 @@ module.exports = function buildAuthGoogleRouter() {
   router.get('/auth/google/callback', async (req, res) => {
     if (!googleConfigured()) return sendNotOffered(res);
     const startHref = `${authRoutes.apiBase(req)}/auth/google/start`;
-    const [expectedState, nonce] = String(parseCookie(req, GOOGLE_STATE_COOKIE) || '').split('.');
+    const [expectedState, nonce, mode] = String(parseCookie(req, GOOGLE_STATE_COOKIE) || '').split('.');
     const { state, code, error } = req.query;
     res.clearCookie(GOOGLE_STATE_COOKIE);
+    if (mode === 'link') return finishGoogleLink(req, res, { expectedState, nonce, state, code, error });
     if (error) {
       // access_denied is the person pressing Cancel at Google: not a fault.
       return res.status(400).type('text/html').send(authRoutes.renderAuthErrorPage(
@@ -123,6 +182,13 @@ module.exports = function buildAuthGoogleRouter() {
     }
     try {
       const identity = await exchangeGoogleCode({ code, redirectUri: googleRedirectUri(), nonce });
+      if (mode !== 'fresh' && await suggestsExistingGithub(identity)) {
+        const base = authRoutes.apiBase(req);
+        return res.type('text/html').send(renderExistingAccountHint({
+          githubHref: `${base}/auth/web/start?via=github&return=${encodeURIComponent('/account#aWaysIn')}`,
+          newAccountHref: `${base}/auth/google/start?fresh=1`,
+        }));
+      }
       const { token, expiresAt, created } = await completeGoogleFlow({ identity, userAgent: req.headers['user-agent'] });
       authRoutes.setSessionCookie(req, res, token, expiresAt);
       const returnTo = authRoutes.safeReturnTo(parseCookie(req, authRoutes.RETURN_COOKIE));

package/src/bongos/routes/auth-link.js

@@ -0,0 +1,132 @@
+// src/bongos/routes/auth-link.js — linking a second way in to the signed-in
+// person: Link GitHub here, Link Google through the Google routes (task 1004995).
+//
+// A link is a sign-in with the other account, made while already signed in. It
+// never merges: a way in that already reaches another person is refused, and the
+// account page says so plainly (owner, 2026-10-29). Both answers land on
+// /account, which owns the words:
+//
+//   GET /auth/link/github/start       → GitHub's account picker (state cookie)
+//   GET /auth/web/callback/link       → checks the state, trades the code, links
+//
+// The GitHub callback is a SUBDIRECTORY of the sign-in callback on purpose:
+// GitHub accepts any redirect_uri below the registered one, so linking needs no
+// change to the owner's GitHub app. (Google matches redirect URIs exactly, so its
+// link rides the sign-in callback with a flag — routes/auth-google.js.)
+//
+// Linking needs the hub (the platform-identity.hub port's linkLogin). Off the hub
+// every route here answers "not offered".
+'use strict';
+
+const express = require('express');
+const crypto = require('node:crypto');
+
+const auth = require('../auth');
+const db = require('../db');
+const seams = require('../../module-seams');
+const { parseCookie } = require('./_helpers');
+const { buildAuthorizeUrl, exchangeCodeForToken, fetchGithubUser } = require('../auth-github');
+const authRoutes = require('./auth');
+const log = require('../logger').logger.child({ src: 'auth-link' });
+
+const LINK_STATE_COOKIE = 'bongos_link_state';
+const LINK_CALLBACK_PATH = '/api/bongos/auth/web/callback/link';
+
+function linkRedirectUri() {
+  return `${authRoutes.webRedirectOrigin().replace(/\/+$/, '')}${LINK_CALLBACK_PATH}`;
+}
+
+// The hub's linkLogin, or null where linking is not offered.
+function hubLinker() {
+  const hub = seams.resolveOptional('platform-identity.hub');
+  return hub && typeof hub.linkLogin === 'function' ? hub : null;
+}
+
+// Where the account page shows a link's answer. Pure; exported for the test.
+// `out` is linkLogin's answer, or { refused: 'taken' } decided here.
+function linkLanding(provider, out) {
+  const q = out && out.linked ? `linked=${provider}` : `link_refused=${(out && out.refused) || 'failed'}&provider=${provider}`;
+  return `/account?${q}#aWaysIn`;
+}
+
+// Link a way in to the signed-in person, then keep their builder row's login in
+// step for GitHub (the hub shows the real login once GitHub is linked, ADR 0396).
+async function linkToSession({ session, provider, subject, email, githubLogin }) {
+  const out = await hubLinker().linkLogin({ personKey: String(session.github_id), provider, subject, email, githubLogin });
+  if (out.linked && provider === 'github' && githubLogin) {
+    await db.upsertBuilder({
+      githubId: String(session.github_id),
+      githubLogin,
+      displayName: session.display_name || githubLogin,
+      avatarUrl: session.avatar_url || null,
+    });
+  }
+  return out;
+}
+
+function notOffered(res) {
+  return res.status(404).type('text/html').send(authRoutes.renderAuthErrorPage(
+    'Linking isn’t offered here',
+    'This site does not keep more than one way in per account.',
+  ));
+}
+
+function isSecure(req) {
+  return !!(req.secure || req.headers['x-forwarded-proto'] === 'https');
+}
+
+module.exports = function buildAuthLinkRouter() {
+  const router = express.Router();
+
+  // rank: public — an OAuth entry point that gates itself: with no live session it
+  //   sends the person to /account, so only a signed-in person ever links (ADR 0396).
+  router.get('/auth/link/github/start', async (req, res) => {
+    if (!hubLinker()) return notOffered(res);
+    let session = null;
+    try { session = await auth.resolveSession(req); } catch (err) { log.error({ err: err && err.message }, '[auth] link start session'); }
+    if (!session || session.status === 'inactive') return res.redirect('/account');
+    const state = crypto.randomBytes(16).toString('hex');
+    res.cookie(LINK_STATE_COOKIE, state, { httpOnly: true, sameSite: 'lax', secure: isSecure(req), maxAge: authRoutes.HANDSHAKE_COOKIE_MS });
+    // The account picker, so the person can choose a GitHub account other than
+    // the one this browser is signed in to at github.com.
+    res.redirect(buildAuthorizeUrl(state, linkRedirectUri(), { switchAccount: true }));
+  });
+
+  // rank: public — the OAuth callback for linking; the state cookie + code are the
+  //   bearer, and the live session cookie names the person (no session: /account).
+  router.get('/auth/web/callback/link', async (req, res) => {
+    if (!hubLinker()) return notOffered(res);
+    const expected = parseCookie(req, LINK_STATE_COOKIE);
+    res.clearCookie(LINK_STATE_COOKIE);
+    const { state, code, error } = req.query;
+    if (error || !code || !state || !expected || state !== expected) {
+      return res.redirect(linkLanding('github', { refused: error === 'access_denied' ? 'cancelled' : 'expired' }));
+    }
+    let session = null;
+    try { session = await auth.resolveSession(req); } catch (err) { log.error({ err: err && err.message }, '[auth] link callback session'); }
+    if (!session || session.status === 'inactive') return res.redirect('/account');
+    try {
+      const { accessToken } = await exchangeCodeForToken(code, linkRedirectUri());
+      const ghUser = await fetchGithubUser(accessToken);
+      // A GitHub account with its own builder row here is its own account, with
+      // its own credits and history: say so, never merge (owner, 2026-10-29).
+      if (String(ghUser.id) !== String(session.github_id) && await db.getBuilderByGithubId(String(ghUser.id))) {
+        return res.redirect(linkLanding('github', { refused: 'taken' }));
+      }
+      const out = await linkToSession({
+        session, provider: 'github', subject: String(ghUser.id),
+        email: typeof ghUser.email === 'string' ? ghUser.email : null, githubLogin: ghUser.login,
+      });
+      return res.redirect(linkLanding('github', out));
+    } catch (err) {
+      log.error({ err: err && err.message }, '[auth] web/callback/link');
+      return res.redirect(linkLanding('github', { refused: 'failed' }));
+    }
+  });
+
+  return router;
+};
+
+module.exports.linkLanding = linkLanding;
+module.exports.linkToSession = linkToSession;
+module.exports.hubLinker = hubLinker;

package/src/bongos/routes/me.js

@@ -34,6 +34,7 @@ const db = require('../db');
 // prefs-module-less instance so the slices simply render their unset/default shape.
 const { validateOrRespond } = require('./_helpers');
 const { readModes: readCraftModes, describeCraftMode } = require('../craft-mode'); // task 1002992
+const { withStandingRules } = require('../agent-standing-rules'); // task 1005015
 const { branding } = require('../../branding'); // task 2011: instance model-allocation default
 // The onboarding state machine carved into modules/onboarding/ (BV1.R81 / ADR
 // 0093 §1): the GET /me aggregator + PATCH /me/disciplines resolve the
@@ -565,7 +566,9 @@ module.exports = function buildMeRouter() {
       // contract. The old §2 "The Prompter" owner-defaults, now per-builder. The
       // session-start injection + /settings UI read this; describeInteraction is
       // the SSOT (builder-settings port). null when the prefs module is off.
-      interaction: lawed ? lawed.interaction : (settings && settings.describeInteraction ? settings.describeInteraction(behaviorPrefs) : null),
+      // task 1005015: the standing rules (human-task markers, slop detection) ride
+      // this contract because every Conductor, stale ones included, relays it.
+      interaction: withStandingRules(lawed ? lawed.interaction : (settings && settings.describeInteraction ? settings.describeInteraction(behaviorPrefs) : null)),
       // task 1004707: the project's LAWS, read into every AI session. The
       // Conductor hook relays `contract` verbatim beside the interaction profile
       // (inject:false, and no block, when no law is in force). `laws` is the book

package/src/bongos/routes.js

@@ -24,6 +24,7 @@ const buildFeedbackRouter = require('./routes/feedback');
 const buildAuthRouter = require('./routes/auth');
 // Google sign-in + the browser page that approves a CLI sign-in (task 1004993).
 const buildAuthGoogleRouter = require('./routes/auth-google');
+const buildAuthLinkRouter = require('./routes/auth-link');
 const buildGithubRouter = require('./routes/github');
 const buildMeRouter = require('./routes/me');
 // The own-scoped session self-service (list / revoke one / sign out everywhere,
@@ -170,6 +171,7 @@ function buildGdsRouter() {
   router.use(buildFeedbackRouter());
   router.use(buildAuthRouter());
   router.use(buildAuthGoogleRouter());
+  router.use(buildAuthLinkRouter());
   router.use(buildGithubRouter());
   router.use(buildMeRouter());
   router.use(buildMySessionsRouter());

package/src/bongos/sign-in-pages.js

@@ -75,6 +75,25 @@ function renderSignInChooser({ githubHref, googleHref }) {
   });
 }
 
+// A first Google sign-in whose address an account that signs in with GitHub
+// already shows (task 1004995). Nothing is joined and the page names no one: it
+// offers the account the person may already have, where they can link Google,
+// or a new, separate account. The second button restarts the Google sign-in
+// with the hint switched off, because the code Google sent is spent.
+function renderExistingAccountHint({ githubHref, newAccountHref }) {
+  return renderPage({
+    title: 'sign in',
+    heading: 'You may already have an account',
+    subtitle: 'An account that signs in with GitHub uses the same email as this Google account.',
+    bodyHtml: `      <p>If that account is yours, sign in with GitHub, then add Google under <b>ways to sign in</b> on your account page. Both will open the same account, with the same credits and history.</p>
+      <div class="signinChoices">
+        <a class="landing__btn" href="${escapeHtml(githubHref)}">${GITHUB_MARK}Sign in with GitHub</a>
+        <a class="landing__btn" href="${escapeHtml(newAccountHref)}">${GOOGLE_MARK}Make a new account with Google</a>
+      </div>
+      <p class="landing__note">We never join accounts on our own, even when the emails match.</p>`,
+  });
+}
+
 // The command-line approval page, in its four states:
 //   'enter'    — no code, or one that is unknown or expired: ask for it
 //   'signin'   — a live code, nobody signed in: offer both ways in
@@ -135,4 +154,4 @@ ${choiceButtons(view)}
   });
 }
 
-module.exports = { renderSignInChooser, renderDeviceApprovalPage };
+module.exports = { renderSignInChooser, renderExistingAccountHint, renderDeviceApprovalPage };

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.4'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.6'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');