@bongos/core 1.25.19 → 1.25.21

package/modules/provisioning/routes/provisioning.js

@@ -65,10 +65,11 @@ const catalogBridge = require('../catalog-bridge');
 const capacity = require('../capacity');   // the box's slot ceiling (ADR 0285, task 1003927)
 const { callbackPage } = require('./callback-page'); const githubSetup = require('../github-setup');
 // the LOUD body validators (task 1003504) — lifted out when this file hit the size ratchet
-const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators'); const demo = require('../demo'); const birth = require('../birth'); const testProject = require('../test-project');
+const { badProjectDetail, badModuleSelection, badProjectType, screenedOut } = require('./body-validators'); const demo = require('../demo'); const birth = require('../birth'); const testProject = require('../test-project'); const guideHandoff = require('../guide-handoff');
 const { failFrom } = require('../public-refusal');   // every catch: a declared refusal reaches the owner, anything else stays opaque (task 1004126)
 const { settingsPush, failPushConflict } = require('../settings-push');   // a settings save's push + receipt, shared with routes/look.js (task 1004421)
-const { requireProjectOwner, projectActor, isProjectOwner } = require('../route-helpers');   // the owner-or-archon gate (task 1004159, ADR 0328)
+const { requireProjectOwner, projectActor, projectActorLabel, isProjectOwner, grantedView } = require('../route-helpers');
+const GRANTEE = { grantee: 'operate' };   // the three routes here a granted helper may use (task 1004161, ADR 0407 §3)   // the owner-or-archon gate (task 1004159, ADR 0328)
 // the kernel ports this module provides (moved out at the size ratchet, task 1003578)
 const { registerProvisioningSeams } = require('../seams');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
@@ -362,7 +363,7 @@ module.exports = function provisioningRoutes() {
       // exactly the set the panel preselected. An explicit [] is the different
       // answer "none of them". maxItems is a sanity ceiling well above a catalog
       // that is three modules wide today.
-      modules: { type: 'array', itemsType: 'string', maxItems: 50 }, terms_acknowledged: { type: 'boolean' }, demo: { type: 'object' }, ship_mode: { type: 'string', enum: ['auto', 'manual'] }, genesis: { type: 'boolean' }, test: { type: 'boolean' },   // the wizard's terms tick (task 1004417, ../terms-ack.js); the demo route's { people, hours_each } (task 1004420, ../demo.js)
+      modules: { type: 'array', itemsType: 'string', maxItems: 50 }, terms_acknowledged: { type: 'boolean' }, demo: { type: 'object' }, ship_mode: { type: 'string', enum: ['auto', 'manual'] }, genesis: { type: 'boolean' }, test: { type: 'boolean' }, from_guide: { type: 'boolean' },   // from_guide: the page pre-filled from the guide's plan (task 1005274, ../guide-handoff.js); the wizard's terms tick (task 1004417, ../terms-ack.js); the demo route's { people, hours_each } (task 1004420, ../demo.js)
     })) return;
     const body = req.body || {};
     const detailFault = badProjectDetail(body.detail);
@@ -485,6 +486,8 @@ module.exports = function provisioningRoutes() {
       if (created && testAsk.test) await testProject.stampTestProject(pool, instance.id).catch((err) => log.error('[provisioning] test mark not stamped', err));
       // The wizard's ship mode (task 1004629) rides beside it; a miss means the project asks at its first ship.
       if (created) await birth.stampShipMode(pool, instance.id, body.ship_mode).catch((err) => log.error('[provisioning] ship mode not stamped', err));
+      // The guide's answers (task 1005274): the CALLER's own attached plan, never one the request names; a miss means the project opens unprefilled.
+      if (created && body.from_guide === true) await guideHandoff.stampGuideHandoff(pool, instance.id, req.builder.id, { name: slug }).catch((err) => log.error('[provisioning] guide hand-off not stamped', err));
       const demoRow = created && demoAsk.demo ? await demo.startDemoProject(pool, provisioning, instance.id, demoAsk.demo) : null;
       // Enqueue the provision intent (idempotent: an already-open intent is returned)
       // — but ONLY when the instance actually needs standing up. Blindly enqueueing on
@@ -656,7 +659,7 @@ module.exports = function provisioningRoutes() {
   // GET /provisioning/instances/:id — read one instance (the manage page's read).
   // rank: any authenticated builder (own resource; archon may read any — task
   // 1003041). 404 otherwise — does not leak another owner's instance existence.
-  router.get('/provisioning/instances/:id', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
+  router.get('/provisioning/instances/:id', auth.requireBuilder, requireProjectOwner(loadInstance, GRANTEE), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     try {
@@ -674,7 +677,7 @@ module.exports = function provisioningRoutes() {
       // panel recovers it from server state after a reload — not from sessionStorage.
       const manifest = await provisioning.getLatestOAuthManifestForInstance(pool, id);
       const githubSetupNow = await githubSetup.githubSetupRead(pool, inst, manifest, manifest ? provisioning.publicGithubApp(manifest).status : null, { withState: false });
-      res.json({
+      res.json(grantedView(req, {
         // the standing install nudge rides the instance, as on the list read (task 1004763)
         instance: { ...ownerInstance(inst), github_install: githubSetup.installNudge(githubSetupNow) },
         open_intent: open ? { action: open.action, state: open.state } : null,
@@ -682,7 +685,7 @@ module.exports = function provisioningRoutes() {
         // the four-step checklist from what the runner verified (task 1004649) — the
         // install link rides WITHOUT the state token this read never carries
         github_setup: githubSetupNow,
-      });
+      }));
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id', err);
       failFrom(res, err, 'read_failed');
@@ -872,7 +875,7 @@ module.exports = function provisioningRoutes() {
   // GET /provisioning/instances/:id/settings — read a project's effective
   // settings + the allowed values (so a form can render its choices).
   // rank: any authenticated builder (own resource; archon may read any).
-  router.get('/provisioning/instances/:id/settings', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
+  router.get('/provisioning/instances/:id/settings', auth.requireBuilder, requireProjectOwner(loadInstance, GRANTEE), async (req, res) => {
     try {
       const inst = req.project;
       // `planet` rides beside `settings` (task 1003347): the same row, read by a
@@ -1036,7 +1039,7 @@ module.exports = function provisioningRoutes() {
   // Every refusal names the action that IS available in that state rather than
   // hiding behind a code, and no branch promises a duration — a restart's downtime
   // is exactly what this route cannot know (the F16 rule, ADR 0190 §7).
-  router.post('/provisioning/instances/:id/restart', auth.requireBuilder, requireProjectOwner(loadInstance), async (req, res) => {
+  router.post('/provisioning/instances/:id/restart', auth.requireBuilder, requireProjectOwner(loadInstance, GRANTEE), async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
     try {
@@ -1067,7 +1070,7 @@ module.exports = function provisioningRoutes() {
       if (r.created) {
         await provisioning.recordEvent(pool, {
           instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'restart',
-          detail: 'restart requested by owner', actor,
+          detail: `restart requested by ${projectActorLabel(req)}`, actor,
         }).catch(() => {});
       }
       res.json({ ok: true, queued: r.created, action: 'restart', status: inst.status, message: r.created

package/modules/provisioning/routes/render-standup.js

@@ -23,7 +23,8 @@ const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const renderStandup = require('../render-standup');
 const { failFrom } = require('../public-refusal');
-const { lookupRender, RenderLookupError } = require('../render-lookup');
+const { lookupRender, lookupPromotion, RenderLookupError } = require('../render-lookup');
+const renderPromote = require('../render-promote');
 const { appStatus } = require('../app-status');
 const renderSandbox = require('../render-sandbox');
 const envManifest = require('../env-manifest');
@@ -46,6 +47,10 @@ const LOOKUP_STATUS = { render_key_refused: 422, render_workspace_unreachable: 4
 // OWNER ONLY, no archon override, for every Render route: the key and the account it acts
 // in are the owner's. A missing project and someone else's answer the same 404, so an id is
 // never confirmed.
+// One sentence for "another run holds this project, so the key was dropped" — the sandbox
+// and promote routes say it the same way (voice.md V1: one fixed sentence per concept).
+const BUSY_KEY_NOT_KEPT = 'Something else is being done to this project right now, so your key was not kept. Try again in a minute.';
+
 function ownedBy(inst, builder) { return !!(inst && builder && String(inst.owner_builder_id) === String(builder.id)); }
 
 module.exports = function buildRenderStandupRouter({ fetchImpl } = {}) {
@@ -105,7 +110,9 @@ module.exports = function buildRenderStandupRouter({ fetchImpl } = {}) {
         : [];
       // The sandbox beside it (ADR 0406, task 1005289), in the same shape.
       const sandbox = renderSandbox.sandboxStatus(inst);
-      res.json({ ok: true, app, sandbox, env_vars: envVars, values_held: false });
+      // Promoting from it (ADR 0406 §2, task 1005290): whether the owner can, and the record.
+      const promote = { ...renderPromote.promoteView(inst), recent: await renderPromote.listPromotions(pool, id) };
+      res.json({ ok: true, app, sandbox, promote, env_vars: envVars, values_held: false });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id/render', err && err.message);
       failFrom(res, err, 'render_status_failed');
@@ -139,7 +146,7 @@ module.exports = function buildRenderStandupRouter({ fetchImpl } = {}) {
       const r = await renderSandbox.enqueueSandboxAdd(pool, id, { keyEnc: api.secretBox.encrypt(req.body.key), requestedBy: 'api:self' });
       if (r.conflict) {
         return res.fail('intent_conflict', { status: 409,
-          message: `A '${r.intent.action}' run is ${r.intent.state} for this project, so your key was not kept. Try again once it has finished.`,
+          message: BUSY_KEY_NOT_KEPT,
           details: { action: r.intent.action, state: r.intent.state } });
       }
       await provisioning.recordEvent(pool, {
@@ -155,6 +162,78 @@ module.exports = function buildRenderStandupRouter({ fetchImpl } = {}) {
     }
   });
 
+  // POST /provisioning/instances/:id/render/promote/look — rank: any authenticated builder,
+  // and OWNER ONLY. What is waiting on the sandbox to go live (ADR 0406 §2, task 1005290):
+  // the change the live app runs, and every change that has run on the sandbox since, newest
+  // first. A read-only look at Render on the owner's key held for this one request (ADR 0348
+  // as widened by ADR 0406 §11): GET only, never stored, logged or sent back.
+  router.post('/provisioning/instances/:id/render/promote/look', api.requireBuilder, lookupLimit, async (req, res) => {
+    const id = parseId(req, res, { positiveInt: true });
+    if (!id) return;
+    if (validateOrRespond(req, res, { key: { required: true, type: 'string', maxLength: 200 } })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!ownedBy(inst, req.builder)) return res.fail('instance_not_found', 404);
+      if (!renderStandup.KEY_RE.test(req.body.key)) return res.fail('render_request_invalid', { status: 400, message: 'That doesn’t look like a Render API key. It starts with “rnd_”.' });
+      const why = renderPromote.noPromoteReason(inst);
+      if (why) return res.fail('promote_unavailable', { status: 409, message: why });
+      const h = inst.app_host;
+      const out = await lookupPromotion(req.body.key, { ownerId: h.ownerId, liveServiceId: h.serviceId, sandboxServiceId: h.sandbox.serviceId, fetchImpl: fetchImpl || globalThis.fetch });
+      res.json({ ok: true, ...out });
+    } catch (err) {
+      if (err instanceof RenderLookupError) return res.fail(err.code, { status: LOOKUP_STATUS[err.code] || 502, message: err.message });
+      log.error('[provisioning] POST /provisioning/instances/:id/render/promote/look', err && err.message);
+      failFrom(res, err, 'render_lookup_failed');
+    }
+  });
+
+  // POST /provisioning/instances/:id/render/promote — rank: any authenticated builder, and
+  // OWNER ONLY: the key and the live app are the owner's, so the server decides only the
+  // owner may move it (an archon on someone else's project gets the stranger's 404). Takes
+  // the change the owner chose (`commit_id`) and the change live ran when they looked
+  // (`expect_live_commit`); the runner refuses if either moved. This is the ONLY way Bongos
+  // moves a live app that has a sandbox, and the reply is a receipt: nothing is live yet.
+  router.post('/provisioning/instances/:id/render/promote', api.requireBuilder, sandboxLimit, async (req, res) => {
+    const id = parseId(req, res, { positiveInt: true });
+    if (!id) return;
+    if (validateOrRespond(req, res, {
+      key: { required: true, type: 'string', maxLength: 200 },
+      commit_id: { required: true, type: 'string', maxLength: 64 },
+      expect_live_commit: { type: 'string', maxLength: 64 },
+    })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!ownedBy(inst, req.builder)) return res.fail('instance_not_found', 404);
+      if (!renderStandup.KEY_RE.test(req.body.key)) return res.fail('render_request_invalid', { status: 400, message: 'That doesn’t look like a Render API key. It starts with “rnd_”.' });
+      const commit = String(req.body.commit_id).trim().toLowerCase();
+      const expect = req.body.expect_live_commit == null ? null : String(req.body.expect_live_commit).trim().toLowerCase();
+      if (!renderPromote.COMMIT_RE.test(commit) || (expect !== null && !renderPromote.COMMIT_RE.test(expect))) {
+        return res.fail('promote_request_invalid', { status: 400, message: 'Choose one of the changes waiting on your sandbox.' });
+      }
+      const why = renderPromote.noPromoteReason(inst);
+      if (why) return res.fail('promote_unavailable', { status: 409, message: why });
+      if (!api.secretBox.isConfigured()) {
+        return res.fail('render_unavailable', { status: 503, message: 'The platform can’t take a key safely right now, so nothing was sent. Try again later.' });
+      }
+      const r = await renderPromote.enqueuePromote(pool, id, { keyEnc: api.secretBox.encrypt(req.body.key), commitId: commit, expectLiveCommit: expect, requestedBy: req.builder.id });
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: BUSY_KEY_NOT_KEPT,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      await provisioning.recordEvent(pool, {
+        instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'render-promote',
+        detail: `promote of ${commit.slice(0, 7)} to the live app requested by owner`, actor: 'api:self',
+      }).catch(() => {});
+      res.json({ ok: true, queued: true, action: 'render-promote',
+        message: 'Queued. That change goes to your live app in a moment; Render then builds it, which usually takes a few minutes. Your key is used once and then thrown away.' });
+    } catch (err) {
+      // Never log the request: it carries the key.
+      log.error('[provisioning] POST /provisioning/instances/:id/render/promote', err && err.message);
+      failFrom(res, err, 'render_promote_failed');
+    }
+  });
+
   // POST /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER
   // ONLY: the key is the owner's and so is the account it acts in, so an archon on
   // someone else's project gets the same 404 as a stranger. The reply is a receipt;

package/modules/public-landing/public/projects.html

@@ -1579,6 +1579,8 @@ summary{min-height:24px;padding:3px 0;}
                 <h2 id="p1-h"><span class="n">01</span>Your project</h2>
                 <!-- auto-fill: the answers this account gave on its most recent project -->
                 <p class="fillOffer" id="physFillOffer" hidden><button type="button" class="linklike" id="physFromAccount">Fill these in from my last project</button></p>
+                <!-- the guide's answers (task 1005274): shown only when this page filled itself in from the plan -->
+                <p class="fillOffer hint" id="guideFill" hidden>Filled in from your talk with the guide. Change anything you like. <a id="guideFileLink" href="#" download="PROJECT-HANDOFF.md">Download the plan for your AI</a></p>
                 <!-- the demo route (task 1004420, BV2.PS09): opened in place at the top of part
                      01 by the small link under the heading; the rest of the page is unchanged
                      and marked "demo" (D9). The fit check is a copy of modules/provisioning/demo.js
@@ -2311,6 +2313,7 @@ summary{min-height:24px;padding:3px 0;}
     }
     if (app.links) v.root.appendChild(appPara([appLink(app.links.service, 'Open it on Render')]));
     sandboxView(data.sandbox, v);
+    promoteView(data.promote, data.sandbox, v);
     var vars = (data.env_vars || []).filter(function (x) { return !x.set_for_you; });
     if (vars.length) {
       v.root.appendChild(appEl('h3', null, 'Still to set on Render'));
@@ -2378,8 +2381,60 @@ summary{min-height:24px;padding:3px 0;}
     }
     v.root.appendChild(box);
   }
+  /* ── promote: a person moves what ran on the sandbox to the live app (task 1005290, ADR 0406) ──
+     The look at what is waiting and the press each take the owner's Render key, held in this
+     closure and the field for the two requests and then dropped. The second press is the
+     confirm: it names the change that goes live. Nothing here moves the live app by itself. */
+  function promoteView(p, sb, v) {
+    if (!p || !sb || ['none', 'requested'].indexOf(sb.state) >= 0) return;
+    var box = appEl('div', 'appPromote');
+    box.appendChild(appEl('h3', null, 'Going live'));
+    box.appendChild(appPara([p.live_follows_main
+      ? 'Your live app still takes every finished change by itself. It stops once your sandbox is running or you promote for the first time.'
+      : 'Your live app changes only when you promote. Look at your sandbox first, then promote what you are happy with.'], 'finePrint'));
+    var last = p.last;
+    if (last && last.state === 'requested') box.appendChild(appPara(['Promoting ' + (last.commit || 'your change') + ' to your live app…']));
+    else if (last && last.state === 'sent') box.appendChild(appPara(['Sent ' + (last.commit || 'your change') + ' to your live app. Render is building it; that usually takes a few minutes.']));
+    else if (last && last.state === 'failed') box.appendChild(appPara([String(last.error || 'The last promotion did not go through.')], 'err'));
+    if (p.can) {
+      v.prBtn = appEl('button', 'btn ghost small appPrBtn', 'See what is waiting to go live');
+      v.prBtn.type = 'button';
+      box.appendChild(v.prBtn);
+      v.prForm = appEl('div', 'appRetry appPrForm');
+      v.prForm.hidden = true;
+      var lab = appEl('label', 'wizField');
+      lab.appendChild(appEl('span', null, 'Render API key'));
+      v.prKey = appEl('input', 'appRetryKey');
+      v.prKey.type = 'password'; v.prKey.autocomplete = 'off'; v.prKey.spellcheck = false; v.prKey.maxLength = 200; v.prKey.placeholder = 'rnd_…';
+      lab.appendChild(v.prKey);
+      v.prForm.appendChild(lab);
+      v.prLook = appEl('button', 'btn small', 'Look');
+      v.prLook.type = 'button';
+      v.prForm.appendChild(v.prLook);
+      v.prList = appEl('div', 'appPrList');
+      v.prForm.appendChild(v.prList);
+      v.prHint = appEl('div', 'hint appRetryHint', 'Your key is used for this look and the promotion, then thrown away.');
+      v.prHint.setAttribute('role', 'status');
+      v.prForm.appendChild(v.prHint);
+      box.appendChild(v.prForm);
+    } else if (p.reason && sb.state !== 'failed') {
+      box.appendChild(appPara([String(p.reason)], 'finePrint'));
+    }
+    if (p.recent && p.recent.length) {
+      box.appendChild(appEl('h4', null, 'Recent promotions'));
+      var ul = appEl('ul', 'appPrRecent');
+      p.recent.forEach(function (r) {
+        var when = r.at ? new Date(r.at).toLocaleString() : '';
+        var what = r.state === 'failed' ? ' — did not go through' : (r.state === 'started' ? ' — being sent' : '');
+        ul.appendChild(appEl('li', null, when + ': ' + r.commit + (r.message ? ' — ' + r.message : '') + what));
+      });
+      box.appendChild(ul);
+    }
+    v.root.appendChild(box);
+  }
+  function promotePending(data) { var l = data && data.promote && data.promote.last; return !!(l && l.state === 'requested'); }
   function sandboxSettled(sb) { return !sb || ['none', 'left', 'removed'].indexOf(sb.state) >= 0 || !!sb.error || sb.stage === 'live' || sb.stage === 'quiet'; }
-  function appTerminal(data) { var a = data && data.app; return (!a || a.state === 'disconnected' || !!a.error || a.stage === 'live') && sandboxSettled(data && data.sandbox); }
+  function appTerminal(data) { var a = data && data.app; return (!a || a.state === 'disconnected' || !!a.error || a.stage === 'live') && sandboxSettled(data && data.sandbox) && !promotePending(data); }
   function fetchAppStatus(id) {
     return fetch(API + '/provisioning/instances/' + encodeURIComponent(id) + '/render', { credentials: 'same-origin' })
       .then(function (res) { return res.ok ? res.json() : null; })
@@ -2414,6 +2469,7 @@ summary{min-height:24px;padding:3px 0;}
     function tick() { fetchAppStatus(id).then(paint); }
     function wire(v) {
       if (v.sbBtn) wireSandbox(v);
+      if (v.prBtn) wirePromote(v);
       if (!v.retryBtn) return;
       v.retryBtn.addEventListener('click', function () {
         v.retryForm.hidden = false; v.retryBtn.hidden = true; v.keyEl.focus();
@@ -2443,6 +2499,50 @@ summary{min-height:24px;padding:3px 0;}
         });
       });
     }
+    function wirePromote(v) {
+      var key = '';
+      function hint(t, bad) { v.prHint.textContent = t; v.prHint.className = 'hint appRetryHint' + (bad ? ' err' : ''); }
+      function send(path, body) {
+        return fetch(API + '/provisioning/instances/' + encodeURIComponent(id) + path, {
+          method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body)
+        }).then(function (res) {
+          return res.json().catch(function () { return {}; }).then(function (d) {
+            if (!res.ok) throw new Error((d.error && d.error.message) || 'That did not go through.');
+            return d;
+          });
+        });
+      }
+      function drop() { key = ''; v.prKey.value = ''; }
+      v.prBtn.addEventListener('click', function () { v.prForm.hidden = false; v.prBtn.hidden = true; v.prKey.focus(); });
+      v.prLook.addEventListener('click', function () {
+        key = String(v.prKey.value || '').trim();
+        if (!/^rnd_[A-Za-z0-9]{16,128}$/.test(key)) { key = ''; hint('That doesn’t look like a Render API key. It starts with “rnd_”.', true); return; }
+        v.prLook.disabled = true; hint('Asking Render…');
+        send('/render/promote/look', { key: key }).then(function (d) {
+          v.prList.textContent = ''; v.prLook.disabled = false;
+          v.prList.appendChild(appPara([d.live ? 'Live now: ' + d.live.short + (d.live.message ? ' — ' + d.live.message : '') : 'Nothing is live on your app yet.']));
+          if (!d.waiting || !d.waiting.length) { drop(); hint('Nothing new is waiting: your live app already runs what your sandbox runs.'); return; }
+          var ul = appEl('ul', 'appPrWaiting');
+          d.waiting.forEach(function (w) { ul.appendChild(appEl('li', null, w.short + (w.message ? ' — ' + w.message : ''))); });
+          v.prList.appendChild(appPara(['Waiting on your sandbox, newest first:']));
+          v.prList.appendChild(ul);
+          var go = appEl('button', 'btn small appPrGo', 'Promote ' + d.waiting[0].short + ' to my live app');
+          go.type = 'button';
+          v.prList.appendChild(go);
+          hint('Promoting the newest brings everything listed above.');
+          go.addEventListener('click', function () {
+            if (!go.dataset.sure) { go.dataset.sure = '1'; go.textContent = 'Yes, put ' + d.waiting[0].short + ' live'; hint('Press again to confirm. Your live app will change.'); return; }
+            go.disabled = true; hint('Sending…');
+            var body = { key: key, commit_id: d.waiting[0].commit_id };
+            if (d.live && d.live.commit_id) body.expect_live_commit = d.live.commit_id;
+            send('/render/promote', body).then(function (r) {
+              body.key = ''; drop(); hint(r.message || 'Queued.');
+              v.prForm.hidden = true; view = null; clearTimeout(t); ticks = 0; tick();
+            }).catch(function (err) { body.key = ''; drop(); go.disabled = false; hint(err.message + ' Enter your key again to retry.', true); });
+          });
+        }).catch(function (err) { drop(); v.prLook.disabled = false; hint(err.message, true); });
+      });
+    }
     function wireSandbox(v) {
       v.sbBtn.addEventListener('click', function () { v.sbForm.hidden = false; v.sbBtn.hidden = true; v.sbKey.focus(); });
       v.sbSend.addEventListener('click', function () {
@@ -5213,6 +5313,77 @@ summary{min-height:24px;padding:3px 0;}
     });
     paintTeam(state.teamShape || null);
 
+    /* ── the guide's answers (task 1005274) ──
+       A founder who talked with the start-a-project guide (modules/front-door-guide) is
+       never asked the same thing twice. This browser holds their chat in localStorage
+       (the landing's guide-scene.js writes it); once they are signed in, the chat moves
+       onto their account (POST …/attach) and its plan fills in what it covers, and ONLY
+       what is still unanswered: the kind, the sentence, the extras. The name stays the
+       founder's (the plan has none). Every field stays the ordinary control it always
+       was, so each answer is editable. The create then says from_guide, and the hub
+       carries the plan's scope answers and the hand-off file into the new project
+       (modules/provisioning/guide-handoff.js). No chat in this browser: nothing is read
+       and nothing changes. */
+    var GUIDE_KEY = 'cb-front-door-guide';
+    var guideAsked = false;
+    function guideChat() {
+      try {
+        if (!(window.__MODULES__ && window.__MODULES__.enabled && window.__MODULES__.enabled['front-door-guide'])) return null;
+        var g = JSON.parse(localStorage.getItem(GUIDE_KEY) || 'null');
+        return g && g.id && g.token ? g : null;
+      } catch (e) { return null; }
+    }
+    /* applyGuidePlan(plan) — fills the unanswered fields from a plan; returns what it filled. */
+    function applyGuidePlan(plan) {
+      var filled = [];
+      if (!plan || typeof plan !== 'object') return filled;
+      if (!state.projType && plan.project_type && root.querySelector('#typeCards .tpill[data-type="' + plan.project_type + '"]')) {
+        state.projType = plan.project_type; filled.push('type');
+      }
+      if (!String(state.description || '').trim() && typeof plan.summary === 'string' && plan.summary.trim()) {
+        state.description = plan.summary.trim().slice(0, 600); filled.push('description');
+      }
+      if (state.modules === null && Array.isArray(plan.modules) && plan.modules.length) {
+        state.modules = plan.modules.map(function (m) { return m && m.key; }).filter(function (k) { return typeof k === 'string' && k; });
+        filled.push('modules');
+      }
+      return filled;
+    }
+    function paintGuideFill() {
+      var note = $('guideFill');
+      if (!note) return;
+      note.hidden = !state.fromGuide;
+      $('guideFileLink').href = API + '/front-door-guide/mine/handoff.md?name=' + encodeURIComponent(String(state.name || '').trim());
+    }
+    function guidePrefill() {
+      if (guideAsked || !me) return;
+      var g = guideChat();
+      if (!g) return;
+      guideAsked = true;
+      fetch(API + '/front-door-guide/conversations/' + encodeURIComponent(g.id) + '/attach', {
+        method: 'POST', credentials: 'same-origin',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ token: g.token })
+      }).catch(function () { return null; }).then(function () {
+        return fetch(API + '/front-door-guide/mine', { credentials: 'same-origin' });
+      }).then(function (res) {
+        return res && res.ok ? res.json() : null;
+      }).then(function (data) {
+        var plan = data && data.conversation && data.conversation.plan;
+        if (!plan) return;
+        applyGuidePlan(plan);
+        state.fromGuide = true;
+        saveDraft();
+        paintType(state.projType || null);
+        $('f-desc').value = state.description || '';
+        renderModules();
+        paintSetup();
+        paintCreate();
+        paintGuideFill();
+      }).catch(function () { /* the guide is a convenience: the page works without it */ });
+    }
+    paintGuideFill();
+
     /* ── the module picker (task 1002339, BV1.R20) ──
        ONE public read gives the panel both halves it needs: `optional` is the
        catalog it renders, `bundles` is what each project type preselects
@@ -6933,6 +7104,9 @@ summary{min-height:24px;padding:3px 0;}
                has commits rejects as unrelated history. state.mode already tracked
                greenfield|adopt for the UI — it has to reach the server too. */
             onboard_mode: state.mode === 'adopt' ? 'adopt' : 'greenfield',
+            /* the page filled itself in from the guide's plan (task 1005274): the hub
+               carries the scope answers and the hand-off file into the new project */
+            from_guide: state.fromGuide ? true : undefined,
             /* the ship row (task 1004629): becomes the new project's own ship mode */
             ship_mode: shipModeChoice()
           })
@@ -6963,6 +7137,8 @@ summary{min-height:24px;padding:3px 0;}
             demo_invites: state.demo && state.demo.invites && state.demo.invites.length ? state.demo.invites.slice() : undefined
           }));
           sessionStorage.removeItem(DRAFT_KEY);
+          /* the guide's chat has done its job: a second project must not fill in from it */
+          if (state.fromGuide) localStorage.removeItem(GUIDE_KEY);
         } catch (e) {}
         createBusy = false;
         renderDone();
@@ -8568,6 +8744,7 @@ summary{min-height:24px;padding:3px 0;}
         $('f-owner').value = state.owner;
         saveDraft();
       }
+      guidePrefill();
       if (currentView === 'new') enter(false);
     }
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.19",
+  "version": "1.25.21",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.19",
+      "version": "1.25.21",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.19",
+  "version": "1.25.21",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11858,5 +11858,33 @@
       "id": "1005115",
       "text": "A solo founder's Genesis now moves to the next stage by itself when a stage's work is finished, and every stage leaves a named document (the scope, the strategy...) they can come back and edit any time."
     }
+  ],
+  "1.25.20": [
+    {
+      "id": "1005112",
+      "text": "While a new project is being set up, the menu now shows only the rooms that are open, a room that just opened is highlighted, a closed room can't be reached by its address, and the later setup stages say what finishing them ea"
+    },
+    {
+      "id": "1005274",
+      "text": "A founder who planned their project with the guide now finds the project form and the first Genesis question already filled in, plus a plan file for their own AI."
+    }
+  ],
+  "1.25.21": [
+    {
+      "id": "1004162",
+      "text": "Someone already connected to a hosted project who can't manage it is now told what to do next (apply to join, accept their invite, or ask the owner) instead of \"not found\"; strangers still learn nothing, and private projects s"
+    },
+    {
+      "id": "1005130",
+      "text": "When founding a project, the charter step now tells the founder the project is already a monarchy, what every form of government will ask of them day to day, and plainly when a choice changes nothing."
+    },
+    {
+      "id": "1004161",
+      "text": "A project owner can now give a named teammate access to help run their hosted project (view it, restart it, keep its settings list) and take it back; signing in alone still gives nobody access."
+    },
+    {
+      "id": "1005290",
+      "text": "Finished work now reaches a project's test copy first; the owner sees what is waiting and presses promote to put it on the live site, and every promotion is recorded."
+    }
   ]
 }

package/scripts/bongos/genesis.js

@@ -58,7 +58,17 @@ function formatStage(s) {
 // Pure: the charter stage's recommendation from the founder's answers (task 1005119).
 // A recommendation only: choosing is still the founder's.
 function formatAdvice(a) {
-  const out = [`  Recommended government: ${a.charter.name}`, `    Why: ${a.charter.why}`];
+  const out = [];
+  // task 1005130: what is in force now, and what each form asks of you day to day.
+  if (a.in_force) out.push(`  In force now: ${a.in_force.line}`);
+  if (a.forms) {
+    out.push('  The forms you can choose:');
+    for (const f of a.forms.filter((x) => x.available)) {
+      out.push(`    ${f.name}${f.current ? ' (in force now)' : ''}: ${f.who_decides} ${f.to_close}`);
+    }
+  }
+  out.push(`  Recommended government: ${a.charter.name}`, `    Why: ${a.charter.why}`);
+  if (a.charter.on_choose) out.push(`    ${a.charter.on_choose.line}`);
   if (a.charter.council_rank) out.push(`    It is governed by a council rank you create: ${a.charter.council_rank}.`);
   out.push('    It is a recommendation. Any form, or your own settings, is still yours to choose.');
   if (a.preset) {

package/scripts/bongos/government-walk-sole.js

@@ -0,0 +1,41 @@
+'use strict';
+// scripts/bongos/government-walk-sole.js — the government walk's board-of-one rows
+// (task 1005130, part C). Its own file so government-walk.js stays under the size
+// ratchet; the walk calls it with its own helpers, so the rows run through the same
+// real routers and in-memory store as every other row.
+//
+// WHY. A board of one decides by filing: when the sole member of a first_ratifier
+// board files an amendment, their yes is cast in the same call (sole-member.js).
+// These rows prove the other side of that rule through the real routes: a lower rank
+// is refused by the route's own permission gate before anything is filed, and a
+// filing by a builder the board does not seat — a charter change and a rules change —
+// waits for the board with no vote cast.
+
+// What a filing decided in the same call, when a board of one decided it.
+const decidedOf = (r) => (r.json && r.json.decided) || {};
+
+// The genesis pick was adopted by filing: the item passed, and the vote that passed it
+// is the founder's own, recorded as cast by filing.
+function adoptedByFiling({ store, stateOf, itemId, voterId }) {
+  const via = (store.votes.find((v) => v.item_id === String(itemId) && v.voter_id === String(voterId)) || {}).cast_via || 'none';
+  return { got: `${stateOf(itemId)}; the founder's yes, cast by ${via === 'filed' ? 'filing' : via}`, pass: stateOf(itemId) === 'passed' && via === 'filed' };
+}
+
+async function soleMemberRows({ check, call, vote, code, store, stateOf, itemIdOf, ids: { EVE, BEN, FOUNDER_ID }, SHORT_LAW }) {
+  await check('A builder without the right to propose is refused before anything is filed', '403; nothing filed', async () => {
+    const before = store.items.length;
+    const r = await call(EVE, 'POST', '/government/board/laws', { enact: [SHORT_LAW] });
+    return { got: `${r.status}; ${store.items.length === before ? 'nothing filed' : 'a sitting was opened'}`, pass: r.status === 403 && store.items.length === before };
+  });
+  await check('A charter and a rules change filed by a builder the board does not seat wait for the board', 'both sitting open; no vote cast', async () => {
+    const c = await call(BEN, 'POST', '/government/board/charter', { form: 'direct-democracy' });
+    const d = await call(BEN, 'POST', '/government/board/decision-rules', { rules: [{ area: 'review', decided_by: 'rank:council', rule: 'majority' }] });
+    const items = [itemIdOf(c), itemIdOf(d)];
+    const open = items.every((id) => id && stateOf(id) === 'open');
+    const cast = store.votes.filter((v) => items.includes(v.item_id)).length;
+    for (const id of items) if (id) await vote(FOUNDER_ID, id, 'no'); // the board returns both, so nothing is left standing
+    return { got: `${open ? 'both sitting open' : `${c.status} ${code(c)} ${stateOf(items[0])}, ${d.status} ${code(d)} ${stateOf(items[1])}`}; ${cast ? `${cast} vote cast` : 'no vote cast'}`, pass: open && cast === 0 };
+  });
+}
+
+module.exports = { decidedOf, adoptedByFiling, soleMemberRows };