@bongos/core 1.25.28 → 1.25.29

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.25.28",
-  "core_contract": "1.25.28",
-  "source_commit": "d57438daf7b41ef384d043322db8c1696d9d6a84",
+  "core_version": "1.25.29",
+  "core_contract": "1.25.29",
+  "source_commit": "62fa1f242e8657746b0c64fbd5adf531a8d9d680",
   "source_ref": "HEAD",
-  "built_at": "2026-11-14T12:52:24.114Z",
+  "built_at": "2026-11-14T13:39:09.975Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 658,
+    "docs_redacted": 659,
     "agent_docs_stubbed": 34,
-    "functional_verbatim": 4091,
+    "functional_verbatim": 4092,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4784,
-  "tree_sha256": "e47a923e1652a5ad72ab026213daeb41097984e6ff49c48d573d256c9d5f3ca1",
+  "file_count": 4786,
+  "tree_sha256": "cffc1cb4b2282e842a416b44aaa5f0dfd78b4c12a75fbd3d81013c8e10319dae",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2522,7 +2522,7 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "5d62f07bd68f7dcf24c9acf1cfb2be95df55e7d64c289844cdecab73bf1f5d49"
+      "sha256": "da3a897ac5c83c96a2e08177374aa40d39d5d69dd361eeb3649922c69575ef57"
     },
     {
       "path": "docs/branding-contract.md",
@@ -3102,7 +3102,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "9e73c20b28e72b23b5336fb4a0a14a28c87d4afea393f54eb83e2b7a300dee98"
+      "sha256": "a26428f06b23343e46a71e076981e4fa7c5b72e604552cd14a1829bc084a50e5"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3187,7 +3187,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "b280296d461a2afc4697aecdb944859aa443ac8cdb2962f3d209b4abcfb054ce"
+      "sha256": "3c608defd6f95e39d31b5508c639b06981423af325d49ed379cbd85d753e8204"
     },
     {
       "path": "docs/project-context.template.md",
@@ -3309,6 +3309,11 @@
       "mode": "0000644",
       "sha256": "25349889d924866627bb8c07395be660263457eb83cb984f145c6fac9f388591"
     },
+    {
+      "path": "docs/recipes/platform-sandbox.md",
+      "mode": "0000644",
+      "sha256": "919821e09d1466da2f8a00bd6622efa716d23d1bdf5cef6e9f956db755372f02"
+    },
     {
       "path": "docs/recipes/private-npm-distribution.md",
       "mode": "0000644",
@@ -7472,7 +7477,7 @@
     {
       "path": "modules/hall-ui/public/sky-time.js",
       "mode": "0000644",
-      "sha256": "250ccdbe25cbe932ec91700b543a1bb698f501da199ceaee9391c31350946fd5"
+      "sha256": "37f4ae3015b9b7bb3d45ac41ee83a75e2ec71cd1c2332b4eebd6c5d537a0cb33"
     },
     {
       "path": "modules/hall-ui/public/sky-tour.js",
@@ -12522,12 +12527,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "020295caad9dfc655e8f57457cdd0a8977212cb1e4410e687bc182988def9522"
+      "sha256": "0f10bd2a7aa8926425d73f8cd0d896d524fe30bac3529437dfc0891795d381d1"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9b822cfc58bea6349fdd6d8b8b70e59f7aa2d71966b6292144802b023a3356a9"
+      "sha256": "20f2a47ed4d0e769ac47107a5eba117496014d076d218b5225711d0412f63b17"
     },
     {
       "path": "public-docs/index.html",
@@ -12547,7 +12552,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "9524b2252dbf5a13633784a99794b938b53c8e436e2e99f676b29fb3ad2a26dd"
+      "sha256": "65da0f0378a212330d8859407c6abf229a99a2500e487d77be389e0671a9edf9"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -16627,7 +16632,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5f7de06f25f1b3593a637818281843c7ae9a44b51f4f69b1d5fe5ef46cdef09d"
+      "sha256": "c596b3f0c569ae12a277daeb2be50ad22fd5eeb3309df52112ae35baa3760e30"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16677,7 +16682,7 @@
     {
       "path": "src/platform-server.js",
       "mode": "0000644",
-      "sha256": "57713cdf702f436cd5440d0d08afd403cbb1be71ede94fa95e4dd994cddcfeaf"
+      "sha256": "604478c1cfd916afb2b4094002cb321674b112b1155237250dde9450ebd47a42"
     },
     {
       "path": "src/role-responsibilities.js",
@@ -16687,12 +16692,12 @@
     {
       "path": "src/sandbox/gate.js",
       "mode": "0000644",
-      "sha256": "56f9c561130c5fb74ac119bf9e398a53eb163af7a7ba7c275c984796da05b6a6"
+      "sha256": "066f13a1de590bfd6a4acc08a5f59134d21beacbf8332f4fb7de404a04b1dc8c"
     },
     {
       "path": "src/sandbox/index.js",
       "mode": "0000644",
-      "sha256": "589d7fe4ac8a7213eaa432e337dd00cf5855e1387a8d771f738c0e5cb2a62555"
+      "sha256": "bc4114997f39a149a1ae162f168ac738ccedd8505daee871d50f0057894408e7"
     },
     {
       "path": "src/sleep.js",
@@ -19902,7 +19907,7 @@
     {
       "path": "tests/hall_sky_time.mjs",
       "mode": "0000644",
-      "sha256": "77589e0ab28f723090eeb1863e1a431ed6fec9c761ece66239431d3116b1c63a"
+      "sha256": "babbac6ab91fdd9326c0b04aabc784ccde5445c855e8531e9a1decfc6eb583f8"
     },
     {
       "path": "tests/hall_sky_visor.mjs",
@@ -21649,6 +21654,11 @@
       "mode": "0000644",
       "sha256": "147b219cb30b92df1e48b8cf7809559c6ade8729ae09cd5f4241a642ea3d539b"
     },
+    {
+      "path": "tests/platform_sandbox.mjs",
+      "mode": "0000644",
+      "sha256": "ccc162070bdf89dd32b0bc785854057578595d237db4cd3bd0efa1547e4d34e7"
+    },
     {
       "path": "tests/platform_visibility_gate.mjs",
       "mode": "0000644",

package/docs/architecture.md

@@ -16,6 +16,7 @@
 - **Server stack:** Node.js 22 LTS · PostgreSQL 16 · Caddy 2.11.2. `example.service` (systemd) runs `node server.js` as user `lars` on `127.0.0.1:3000`; restart-on-failure.
 - **Hardening:** `lars` user with passwordless sudo; SSH key-only (root login disabled, password auth disabled); ufw allows 22/80/443; fail2ban active; unattended-upgrades enabled; timezone `America/New_York`.
 - **Credentials:** every credential the instance needs — what it is for, which env file holds it (`web.env` · `box.env` · `spaces.env`), GitHub Actions secrets and builder-machine logins — is listed in [`docs/credentials.md`](credentials.md), names only. Whether each is SET on a host is one command run there: `node scripts/bongos/credential-presence.js` (task 1002880). Check both before asking the owner for a credential.
+- **Cloud Bongos sandbox droplet (NEW 2026-11-14, [ADR 0406](adr/0406-every-project-gets-a-sandbox-that-follows-main-and-live-moves-only-when-a-person-promotes.md) §7, task 1005292):** DigitalOcean, hostname `cloudbongos-sandbox`, `s-1vcpu-2gb`, **NYC1**, ~$12/mo, tag `cloudbongos-sandbox`. Serves `https://sandbox.cloudbongos.com` (one host; test projects at `*.sandbox.cloudbongos.com`, grey-cloud wildcard), runs with `BONGOS_SANDBOX=1`, its own empty `cloudbongos` DB and no outside credentials, and takes **every** published release itself (`cloudbongos-sandbox-update.timer`, follow `candidates`). The live hub's update rule is `pinned`: it moves only from Hall → Deploy. Full layout: [`recipes/platform-sandbox.md`](recipes/platform-sandbox.md).
 - **TLS:** Origin cert at `/etc/caddy/origin.crt` + `/etc/caddy/origin.key` for the example apexes on the co-hosting box. **cloudbongos.com's apexes moved to the dedicated control-plane droplet** ([ADR 0126](adr/0126-dedicated-cloudbongos-control-plane-droplet.md)) with their own copy of the Cloudflare Origin Cert (SAN `*.cloudbongos.com, cloudbongos.com`) at `/etc/caddy/cloudbongos-origin.{crt,key}` on `REDACTED_IP`. Cloudflare SSL/TLS mode = Full (strict). Renewal is a non-issue for ~15 years. **Provisioned instance hosts use a different, coexisting posture** ([ADR 0111](adr/0111-instance-hosting-provisioning-module.md) §4 / task P4): Caddy **on-demand ACME** (Let's Encrypt) via the global `on_demand_tls { ask … }` block, gated to hostnames the `provisioning` module actually stood up (`/api/bongos/provisioning/tls-check`). Their DNS records are **proxied=false (grey cloud)** so the ACME challenge reaches Caddy — the opposite of the origin-cert apexes; do not enable the proxy on them or renewal breaks silently ([ADR 0003](adr/0003-cloudflare-origin-cert-over-letsencrypt.md)). Per-instance site snippets live in `/etc/caddy/sites/*.caddy` (`import`ed by `infra/Caddyfile`); the provisioning runner verifies the box's resolved Caddy config carries that import and the `on_demand_tls` ask before it reports a domain wired, and refuses with the line to add rather than editing the base file ([ADR 0303](adr/0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md)). **Tradeoff (accepted, SEC review of task 1945):** `proxied=false` publishes the box's real origin IP in public DNS for every co-tenant provisioned hostname — defeating, for those names, the Cloudflare-proxy IP-hiding the apexes enjoy (a co-tenant host resolves to the same `REDACTED_IP` that serves the main game). This is inherent to on-demand ACME (the challenge must hit the origin) and acceptable under the budget/trust model; prefer a **dedicated droplet** (its own IP) for any instance expected to draw hostile attention.
 - **Platform observability — REMOVED 2026-09-15 ([ADR 0284](adr/0284-the-control-plane-carries-no-metrics-stack.md), task 1003876):** the control plane runs **no Grafana and no Prometheus**, and `metrics.cloudbongos.com` has no Caddy site. They cost ~300 MB RSS + 2.5 GB of data on the box every provisioned project shares, and scraped none of those projects. Every instance still exports `/metrics` ([`src/bongos/metrics.js`](../src/bongos/metrics.js), loopback or `METRICS_TOKEN`), so a scraper can return from a box that is *not* the control plane. The rest of this bullet is the **historical** ADR 0127 layout, kept so its leftovers (co-hosting-box forwarders, instance `infra/` copies) can be found: this watched the **Bongos API** (`gds_http`/`tasks`/`claims`/`builders`/`auth`), not any one game, so it lived **on the control-plane box** (REDACTED_IP) at **`https://metrics.cloudbongos.com`** and observed the **whole fleet**. **Prometheus** (`127.0.0.1:9090`, loopback-only) scrapes every instance's `/metrics` ([`src/bongos/metrics.js`](../src/bongos/metrics.js)), each tagged with a `project` label (`infra/prometheus/prometheus.yml` (instance-side)): **cloudbongos** locally (`:3002`); **example + emersonian-circles** on the co-hosting box, reached over the **private VPC** via `socat` forwarders on `10.108.0.2:9101/9102` (→ their loopback `:3000`/`:3004`), ufw-locked to the control-plane box's private IP — raw TCP relays, so the exporter still sees a loopback request and needs no token; nothing is public. **Grafana** (`127.0.0.1:3003`, loopback-only) renders the 4 provisioned-as-code dashboards (folder **Cloud Bongos**: system-overview, error-watch, builder-activity, auth-security), each with a **`project`** template variable for per-instance / fleet views. Reverse-proxied on the `*.cloudbongos.com` origin cert — Archon-only, gated by Caddy `basic_auth` (user `archon`) **and** Grafana's own admin login (both secrets owner-held, never in the repo). Grafana config is a systemd `GF_*` env drop-in (`grafana-server.service.d/override.conf`, `chmod 600`). ~256 MB RAM. A future dedicated-droplet instance is added as a `METRICS_TOKEN` Bearer target instead of a VPC forwarder.
 

package/docs/module-api-changelog.md

@@ -3494,5 +3494,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.25.26 with no explicit bump. run 43595061258. (task 1002620)
   1.25.28 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.25.27 with no explicit bump. run 43596801043. (task 1002620)
+  1.25.29 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.25.28 with no explicit bump. run 43600053549. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -283,7 +283,7 @@
       "surface": "builders",
       "title": "The city",
       "states_read": ["city","fullscreen","focus","pins","living","card","card-ask"],
-      "files_hash": "3a0dc6433adca656",
+      "files_hash": "064e3dde67829d17",
       "reading_hash": "277096d903879a57",
       "counts": {"lines":26,"placed":9,"shared":6,"unplaced":11},
       "omitted": {"data":7},
@@ -954,7 +954,7 @@
       "surface": "builders",
       "title": "Builders' Hall",
       "states_read": ["home","out","founding","genesis","decide","demo","votes"],
-      "files_hash": "1d2e6eb7d4f35b41",
+      "files_hash": "4589c1f671807a3c",
       "reading_hash": "c5f4986bd90e2a2a",
       "counts": {"lines":29,"placed":8,"shared":8,"unplaced":13},
       "omitted": {"data":4},

package/docs/recipes/platform-sandbox.md

@@ -0,0 +1,54 @@
+# Cloud Bongos's own sandbox — sandbox.cloudbongos.com
+
+> Task [task 1005292](https://cloudbongos.com/builders#/task/1005292), under [ADR 0406](../adr/0406-every-project-gets-a-sandbox-that-follows-main-and-live-moves-only-when-a-person-promotes.md) §7. Stood up 2026-11-14.
+
+The same rule every project follows, one level up: **every published core release reaches the sandbox first; the live hub moves only when a person promotes.** For Cloud Bongos, "main" is the published release (ADR 0161), so the sandbox follows releases and the hub holds a pin.
+
+## Where it runs (owner's choices, 2026-11-14)
+
+| | Sandbox | Live hub |
+|---|---|---|
+| Address | `https://sandbox.cloudbongos.com` (one host: projects page and hall) | `cloudbongos.com`, `builders.`, `status.` |
+| Box | DigitalOcean `cloudbongos-sandbox` (IP in the DigitalOcean console; reached with the control-plane key `cloudbongos_ed25519`), `s-1vcpu-2gb`, **NYC1**, $12/mo, tag `cloudbongos-sandbox` (NYC3 had no `s-1vcpu-2gb` left) | `cloudbongos`, NYC3 |
+| Takes releases | **every one, as published** — `cloudbongos-sandbox-update.timer`, every 15 min, roster entry `follow: candidates`, `channel: minor`, `pinMode: local-commit` | **never by itself** — its row's update rule is `pinned` (set 2026-11-14) |
+| Moves when | a release is published | a person presses the move on **Hall → Deploy** (`/deploy`) |
+| Data | its own empty `cloudbongos` database | the real one |
+
+The owner chose a separate server over the hub's box (which every project hall shares and which sits near its memory limit), and chose that patch releases stop going live by themselves once the sandbox exists.
+
+## What makes it a sandbox
+
+- `BONGOS_SANDBOX=1` in `/etc/cloudbongos/web.env`. The hub server installs `src/sandbox` (`src/platform-server.js`), so every page carries the yellow band and sends, charges and writes to known providers (Discord, GitHub's API, Stripe, mail) are refused and logged as `[bongos-sandbox] refused …` in `journalctl -u cloudbongos-sandbox`. The band appears once a release carrying task 1005292 is installed.
+- **One named exception:** `BONGOS_SANDBOX_ALLOW=github-repo-create`, so a test project's creation can make its (free) GitHub repository. Every other GitHub change stays refused (owner's choice, 2026-11-14; `src/sandbox/gate.js` `ALLOWANCES`).
+- **No outside credentials in its environment:** no push token, no box-source token, no Discord, no Cloudflare or DigitalOcean token. Its `web.env` copies only the hub's look and behaviour settings.
+- Its own GitHub sign-in app ("Cloud Bongos sandbox", callback `https://sandbox.cloudbongos.com/api/gds/auth/web/callback`). Session cookies are host-only, and `cookieDomain` is `sandbox.cloudbongos.com`, so signing in on one site never touches the other. `firstAdmin` is `willHermesLines` (Will O'Brien, who started the goal): his first sign-in seats the sandbox's owner. The creation walk is task 1005314.
+- `config/branding.json` addresses all point at `sandbox.cloudbongos.com` (committed locally in the sandbox checkout; it has no remote, so nothing reaches the hub's instance repo).
+
+## Test projects
+
+Projects created on the sandbox live at `<slug>.sandbox.cloudbongos.com`. The wildcard `*.sandbox.cloudbongos.com` is one grey-cloud Cloudflare record pointing at the sandbox, so the sandbox needs no Cloudflare token (`BOX_DNS_HOOK` unset, the runner skips the DNS step). Caddy gives each one a certificate on demand, through the same `on_demand_tls` ask as the hub. A test project (`modules/provisioning/test-project.js`) is archon-only and never shows on the public map. Created projects are built by `sandbox-provision-intent-runner.timer` (every 2 minutes; the live hub's twin is `selfhost-provision-intent-runner`), which carries no `box.env`, so it holds no Cloudflare or DigitalOcean token.
+
+## Box layout
+
+- Checkout `/home/lars/cloudbongos-instance` (a copy of the hub's instance repo with the `origin` remote removed). Service `cloudbongos-sandbox.service`, port 3002, user `lars`.
+- Caddy `/etc/caddy/Caddyfile`: the hub's global block (Cloudflare trusted proxies, `on_demand_tls`), `import /etc/caddy/sites/*.caddy`, and the `sandbox.cloudbongos.com` site on the `*.cloudbongos.com` origin cert (proxied, orange cloud).
+- 2 GB swap, `vm.swappiness=10`, ufw allowing 22/80/443.
+- `/usr/local/sbin/sandbox-set-github` stores the sign-in app's id and secret (one per line on stdin) and restarts the service.
+
+## Checks
+
+```bash
+curl -s https://sandbox.cloudbongos.com/version
+```
+
+```bash
+ssh -i ~/.ssh/cloudbongos_ed25519 root@<sandbox droplet IP> 'systemctl list-timers | grep sandbox; journalctl -u cloudbongos-sandbox-update -n 20 --no-pager'
+```
+
+The hub's own sweep must keep printing `cloudbongos: pinned — skipped`.
+
+## Gotchas found standing it up
+
+- The hub's Cloudflare token is locked to the hub's IPv4 address: call the API with `curl -4`, or it answers 9109 "Cannot use the access token from location".
+- `@bongos/core` is public on npm, so the sandbox needs no registry token (`docs/recipes/core-release-pipeline.md` still describes an `NPM_TOKEN` file on the hub, which no longer exists there).
+- The Claude terminal panel shows what is typed even at a hidden (`read -s`) prompt. Never have a person paste a secret into it; read it from the clipboard (`pbpaste`) without reading the keyboard at all.

package/modules/hall-ui/public/sky-time.js

@@ -179,7 +179,8 @@
     if (!p) return null;
     const el = d.documentElement;
     Object.keys(p).forEach((name) => el.style.setProperty('--sky-now-' + name, String(p[name])));
-    el.setAttribute('data-sky-hour', String(Math.round(h * 10) / 10));
+    // rounded to a tenth, 23:57 to 23:59 would say 24, which is no hour: wrap after rounding (task 1005299)
+    el.setAttribute('data-sky-hour', String(wrap(Math.round(h * 10) / 10)));
     lastHour = h;
     return p;
   }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.28",
+  "version": "1.25.29",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.28",
+      "version": "1.25.29",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.28",
+  "version": "1.25.29",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11940,5 +11940,14 @@
       "id": "1005305",
       "text": "In game mode the builder's Home is now just the city: no scrolling, you move around with the arrow keys, by dragging, or by resting the cursor at a screen edge, and you rewind and replay the city's history from the visor's top"
     }
+  ],
+  "1.25.29": [
+    {
+      "text": "Cloud Bongos now has a test copy at sandbox.cloudbongos.com that gets every new release first, and the main site only updates when a person presses promote."
+    },
+    {
+      "id": "1005299",
+      "text": "The city's sky clock no longer says \"hour 24\" in the last three minutes before midnight, and its check no longer fails at random late at night."
+    }
   ]
 }

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.25.28'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.29'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/platform-server.js

@@ -225,6 +225,14 @@ function buildPlatformApp() {
   // same reqId. Mounted before any surface so nothing logs uncorrelated.
   app.use(requestIdMiddleware);
 
+  // THE PLATFORM'S OWN SANDBOX (task 1005292, ADR 0406 §7). Cloud Bongos runs a second
+  // copy of itself that takes every release first; that copy runs with BONGOS_SANDBOX=1
+  // and nothing else marks it. install() is the same one a project's app uses: every
+  // page carries the "Sandbox" band, and sends/charges/writes to known providers
+  // (Discord, GitHub's API, Stripe, mail) are refused and logged. On the live hub, where
+  // the variable is absent, it returns a pass-through and changes nothing.
+  app.use(require('./sandbox').install().middleware);
+
   // THE request.divert SEAM (task 1004300, ADR 0349). A module may register a provider that
   // takes a request BEFORE any surface answers and either handles it or passes it on —
   // today the npm-release module's version preview, which hands a browser holding its

package/src/sandbox/gate.js

@@ -56,18 +56,32 @@ function credentialOf(headers) {
   return '';
 }
 
+// NAMED EXCEPTIONS a sandbox may switch on with BONGOS_SANDBOX_ALLOW (comma-separated
+// names), each one write and nothing near it (task 1005292). Cloud Bongos's own sandbox
+// switches on `github-repo-create`, so a test project's creation walk can make its (free)
+// repository, owner's choice 2026-11-14; every other GitHub change stays refused. An
+// unknown name allows nothing.
+const ALLOWANCES = {
+  'github-repo-create': { host: /^api\.github\.com$/i, method: 'POST', path: /^\/(user|orgs\/[A-Za-z0-9-]+)\/repos$/ },
+};
+function parseAllowances(raw) {
+  return String(raw || '').split(',').map((x) => x.trim()).filter((x) => Object.prototype.hasOwnProperty.call(ALLOWANCES, x));
+}
+
 /**
- * The gate's whole policy. `{ method, host, path, headers }` → `{ allow: true }` or
- * `{ allow: false, provider, kind, reason }`. A host in no provider's row passes: the
+ * The gate's whole policy. `{ method, host, path, headers, allowances }` → `{ allow: true }`
+ * or `{ allow: false, provider, kind, reason }`. A host in no provider's row passes: the
  * gate covers the providers it knows, and says so.
  */
-function decide({ method, host, path, headers }) {
+function decide({ method, host, path, headers, allowances = [] }) {
   const m = String(method || 'GET').toUpperCase();
   const h = String(host || '').toLowerCase().replace(/:\d+$/, '');
   const p = PROVIDERS.find((x) => x.host.test(h));
   if (!p) return { allow: true };
   if (READ_METHODS.has(m)) return { allow: true, provider: p.name };
   const pathOnly = String(path || '/').split('?')[0];
+  const named = allowances.find((n) => { const a = ALLOWANCES[n]; return a && a.method === m && a.host.test(h) && a.path.test(pathOnly); });
+  if (named) return { allow: true, provider: p.name, allowance: named };
   if (m === 'POST' && (p.postReads || []).some((re) => re.test(pathOnly))) return { allow: true, provider: p.name };
   if (p.testKey && p.testKey.test(credentialOf(headers))) return { allow: true, provider: p.name, testMode: true };
   return {
@@ -97,13 +111,13 @@ class SandboxRefused extends Error {
 }
 
 /** Wrap a fetch: a refused call answers 403 with a body that says why, and never leaves. */
-function wrapFetch(fetchImpl, log) {
+function wrapFetch(fetchImpl, log, allowances = []) {
   if (!fetchImpl || fetchImpl.__bongosSandbox) return fetchImpl;
   const wrapped = async function sandboxFetch(input, init = {}) {
     const url = new URL(typeof input === 'string' || input instanceof URL ? String(input) : input.url);
     const method = (init.method || (input && input.method) || 'GET');
     const headers = init.headers || (input && input.headers) || {};
-    const d = decide({ method, host: url.host, path: url.pathname + url.search, headers: typeof headers.get === 'function' ? headers : lower(headers) });
+    const d = decide({ method, host: url.host, path: url.pathname + url.search, headers: typeof headers.get === 'function' ? headers : lower(headers), allowances });
     if (d.allow) return fetchImpl(input, init);
     log.add({ ...d, method: String(method).toUpperCase(), host: url.host, path: url.pathname });
     return new Response(JSON.stringify({ error: { type: 'bongos_sandbox_refused', provider: d.provider, kind: d.kind, message: d.reason } }),
@@ -140,14 +154,14 @@ function refusedRequest(d, cb) {
 }
 
 /** Patch a node `http` / `https` module's request + get through the gate. */
-function wrapHttp(mod, log) {
+function wrapHttp(mod, log, allowances = []) {
   if (!mod || mod.request.__bongosSandbox) return;
   const realRequest = mod.request;
   const realGet = mod.get;
   const guarded = (real, isGet) => {
     const fn = function sandboxRequest(...args) {
       const t = targetOf(args);
-      const d = decide(t);
+      const d = decide({ ...t, allowances });
       if (d.allow) return real.apply(mod, args);
       log.add({ ...d, method: String(t.method).toUpperCase(), host: t.host, path: t.path });
       const req = refusedRequest(d, args[args.length - 1]);
@@ -161,4 +175,4 @@ function wrapHttp(mod, log) {
   mod.get = guarded(realGet, true);
 }
 
-module.exports = { decide, makeLog, wrapFetch, wrapHttp };
+module.exports = { decide, makeLog, wrapFetch, wrapHttp, parseAllowances };

package/src/sandbox/index.js

@@ -19,7 +19,7 @@
 //
 // Fake data is the app's own to seed: `isSandbox()` lets it seed only here.
 
-const { makeLog, wrapFetch, wrapHttp } = require('./gate');
+const { makeLog, wrapFetch, wrapHttp, parseAllowances } = require('./gate');
 
 const PAGE = '/__bongos/sandbox';
 let state = null;
@@ -84,7 +84,9 @@ function pageHtml(log, env = process.env, { owner = false } = {}) {
       : `<p>The project's owner sees what this copy refused from their project page.</p>`)
     + `<h2>What this cannot catch</h2>`
     + `<p>Reads to a known provider go out; sends, charges and writes to it are refused. It only sees calls this app makes through Node's own web requests, and only to the providers it knows. Code that goes around them, or a provider it does not know, is not stopped. A read-only key is the real protection; this is the second wall.</p>`
-    + `<p>The free plan also blocks outgoing email ports, so this copy cannot send email directly.</p>`
+    // Only true on Render's free plan (Render sets RENDER=true); the platform's own sandbox
+    // runs on a plain server, where saying it would be false (task 1005292).
+    + (String(env.RENDER || '') === 'true' ? `<p>The free plan also blocks outgoing email ports, so this copy cannot send email directly.</p>` : '')
     + `</body></html>`;
 }
 
@@ -131,9 +133,10 @@ function install({ env = process.env, fetchHost = globalThis, http = require('no
   if (!isSandbox(env)) return { active: false, middleware: passThrough, refusals: [], bandHtml: () => '', isSandbox: false };
   if (!state) {
     const log = makeLog(write ? { write } : {});
-    if (typeof fetchHost.fetch === 'function') fetchHost.fetch = wrapFetch(fetchHost.fetch, log);
-    wrapHttp(http, log);
-    wrapHttp(https, log);
+    const allowances = parseAllowances(env.BONGOS_SANDBOX_ALLOW);
+    if (typeof fetchHost.fetch === 'function') fetchHost.fetch = wrapFetch(fetchHost.fetch, log, allowances);
+    wrapHttp(http, log, allowances);
+    wrapHttp(https, log, allowances);
     state = { log, middleware: makeMiddleware(log, env) };
   }
   return { active: true, middleware: state.middleware, refusals: state.log.items, bandHtml, isSandbox: true };

package/tests/hall_sky_time.mjs

@@ -192,7 +192,13 @@ test('a pinned hour wins: the root attribute, then the query, then the hash; a b
 });
 
 // The page half, run against a stand-in document whose computed styles are style.css's own tokens.
-function page({ search = '', hash = '', attr = null } = {}) {
+// `now` fixes the viewer's clock (a local "HH:MM"), so no case depends on when the suite runs.
+function clockAt(now) {
+  if (now == null) return Date;
+  const [hh, mm] = now.split(':').map(Number);
+  return class extends Date { constructor(...a) { if (a.length) super(...a); else super(2026, 0, 1, hh, mm, 0); } };
+}
+function page({ search = '', hash = '', attr = null, now = null } = {}) {
   const set = {}; const attrs = attr == null ? {} : { 'data-sky-hour-at': attr };
   const timers = []; let probes = 0; let computed = 0;
   const html = {
@@ -216,7 +222,7 @@ function page({ search = '', hash = '', attr = null } = {}) {
       return { color: `rgb(${v[0]}, ${v[1]}, ${v[2]})` };
     },
     setInterval(fn, ms) { timers.push({ fn, ms }); return timers.length; },
-    Date, Number, String, Math, Object, Array, parseInt, decodeURIComponent, isFinite,
+    Date: clockAt(now), Number, String, Math, Object, Array, parseInt, decodeURIComponent, isFinite,
   };
   vm.runInNewContext(read('sky-time.js'), ctx, { filename: 'sky-time.js' });
   return { api: window.OTBSkyTime, set, attrs, timers, document, stats: () => ({ probes, computed }) };
@@ -242,12 +248,26 @@ test('on load the page wears the hour\'s palette as --sky-now-* on the root, fro
 test('the override reaches the page: the hash and the root attribute pin the hour too', () => {
   assert.equal(page({ hash: '#hour=18' }).set['--sky-now-cloud'], KEYS.dusk.cloud.toLowerCase());
   assert.equal(page({ attr: '6', search: '?hour=13' }).set['--sky-now-cloud'], KEYS.dawn.cloud.toLowerCase());
-  // with nothing pinned the viewer's clock is the source: a number from 0 up to 24
-  const live = page();
-  assert.ok(Number(live.attrs['data-sky-hour']) >= 0 && Number(live.attrs['data-sky-hour']) < 24);
+  // with nothing pinned the viewer's clock is the source (fixed here, so the case never
+  // depends on when the suite runs)
+  const live = page({ now: '13:30' });
+  assert.equal(live.attrs['data-sky-hour'], '13.5');
   assert.equal(live.api.hourNow({ document: live.document, location: { search: '?hour=4', hash: '' } }), 4);
 });
 
+// Task 1005299: 23:57 to 23:59 rounded to one decimal is 24.0, which is not an hour; the
+// last minutes of the day say the next day's first hour, and wear its palette.
+test('the hour the page says never reaches 24: the last minutes of the day wrap to 0', () => {
+  for (const now of ['23:57', '23:58', '23:59']) {
+    const p = page({ now });
+    assert.equal(p.attrs['data-sky-hour'], '0', `${now} says hour 0, not 24`);
+    assert.equal(p.set['--sky-now-mid'], KEYS.night.mid.toLowerCase(), `${now} wears night`);
+  }
+  assert.equal(page({ now: '23:56' }).attrs['data-sky-hour'], '23.9');
+  assert.equal(page({ now: '00:00' }).attrs['data-sky-hour'], '0');
+  assert.equal(page({ search: '?hour=23.98' }).attrs['data-sky-hour'], '0', 'a pinned hour wraps the same way');
+});
+
 test('no motion: the palette is recomputed at most once a minute and nothing animates between two', () => {
   const p = page({ search: '?hour=6' });
   assert.equal(p.timers.length, 1, 'one timer');

package/tests/platform_sandbox.mjs

@@ -0,0 +1,96 @@
+// tests/platform_sandbox.mjs — Cloud Bongos's own sandbox (task 1005292; ADR 0406 §7).
+//
+// The platform runs a second copy of itself that takes every release before the live hub.
+// That copy is the same server started with BONGOS_SANDBOX=1. Pinned here:
+//   1. the hub server installs the sandbox middleware, before any surface answers, so every
+//      page of the copy carries the band — and on the live hub (no variable) it is a no-op;
+//   2. the sandbox page only claims Render's blocked mail ports where Render is the host,
+//      because the platform's sandbox runs on a plain server where that sentence is false.
+//
+// Run:  node tests/platform_sandbox.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { install, pageHtml } = require('../src/sandbox/index.js');
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const src = fs.readFileSync(path.join(ROOT, 'src/platform-server.js'), 'utf8')
+  .replace(/^\s*\/\/.*$/gm, ''); // comments may cite the rule; only code counts
+
+await t('the hub server mounts the sandbox middleware', () => {
+  assert.match(src, /app\.use\(require\('\.\/sandbox'\)\.install\(\)\.middleware\)/);
+});
+
+await t('it is mounted before any surface or module answers', () => {
+  const at = src.indexOf("require('./sandbox')");
+  const divert = src.indexOf("resolveOptional('request.divert')");
+  const surfaces = src.indexOf('mountInternalSurfaces(');
+  assert.ok(at > 0 && divert > 0 && at < divert, 'sandbox must come before the request.divert seam');
+  // the import of mountInternalSurfaces sits at the top; the CALL is what matters
+  const call = src.indexOf('mountInternalSurfaces(', surfaces + 1);
+  assert.ok(call < 0 || at < call, 'sandbox must come before the surfaces mount');
+});
+
+await t('on the live hub (no BONGOS_SANDBOX) it changes nothing', () => {
+  const r = install({ env: {} });
+  assert.equal(r.active, false);
+  let called = false;
+  r.middleware({}, {}, () => { called = true; });
+  assert.equal(called, true);
+});
+
+const log = { items: [] };
+await t('on a plain server the page makes no claim about blocked mail ports', () => {
+  assert.doesNotMatch(pageHtml(log, { BONGOS_SANDBOX: '1' }), /email ports/);
+});
+await t('on Render it still says the free plan blocks them', () => {
+  assert.match(pageHtml(log, { BONGOS_SANDBOX: '1', RENDER: 'true' }), /blocks outgoing email ports/);
+});
+
+// 3. The one named exception: creating a repository (owner's choice, 2026-11-14).
+const { decide, parseAllowances } = require('../src/sandbox/gate.js');
+const ALLOW = parseAllowances('github-repo-create');
+await t('without the exception, creating a GitHub repository is refused', () => {
+  assert.equal(decide({ method: 'POST', host: 'api.github.com', path: '/user/repos' }).allow, false);
+});
+await t('with it, creating a repository for a person or an organisation passes', () => {
+  assert.equal(decide({ method: 'POST', host: 'api.github.com', path: '/user/repos', allowances: ALLOW }).allow, true);
+  assert.equal(decide({ method: 'POST', host: 'api.github.com', path: '/orgs/acme-co/repos', allowances: ALLOW }).allow, true);
+});
+await t('every other GitHub change stays refused with it on', () => {
+  for (const [m, p] of [['POST', '/repos/o/r/pulls'], ['PUT', '/repos/o/r/pulls/1/merge'], ['PATCH', '/repos/o/r'], ['DELETE', '/repos/o/r'], ['POST', '/repos/o/r/keys'], ['PUT', '/repos/o/r/collaborators/x'], ['POST', '/user/repos/extra']]) {
+    assert.equal(decide({ method: m, host: 'api.github.com', path: p, allowances: ALLOW }).allow, false, `${m} ${p}`);
+  }
+});
+await t('an unknown exception name allows nothing', () => {
+  assert.deepEqual(parseAllowances('everything, github-*'), []);
+});
+await t('install() reads the exception from BONGOS_SANDBOX_ALLOW', async () => {
+  const seen = [];
+  const host = { fetch: async (u) => { seen.push(String(u)); return new Response('{}', { status: 201 }); } };
+  const fakeMod = () => ({ request() {}, get() {} });
+  const idx = require('../src/sandbox/index.js');
+  // a fresh module instance, since install() keeps one state per process
+  delete require.cache[require.resolve('../src/sandbox/index.js')];
+  const fresh = require('../src/sandbox/index.js');
+  fresh.install({ env: { BONGOS_SANDBOX: '1', BONGOS_SANDBOX_ALLOW: 'github-repo-create' }, fetchHost: host, http: fakeMod(), https: fakeMod(), write() {} });
+  void idx;
+  return host.fetch('https://api.github.com/user/repos', { method: 'POST' }).then((r) => {
+    assert.equal(r.status, 201);
+    assert.equal(seen.length, 1);
+  });
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);