@bongos/core 1.25.28 → 1.25.30

package/docs/recipes/platform-sandbox.md

@@ -0,0 +1,54 @@
+# Cloud Bongos's own sandbox — sandbox.cloudbongos.com
+
+> Task [task 1005292](https://cloudbongos.com/builders#/task/1005292), under [ADR 0406](../adr/0406-every-project-gets-a-sandbox-that-follows-main-and-live-moves-only-when-a-person-promotes.md) §7. Stood up 2026-11-14.
+
+The same rule every project follows, one level up: **every published core release reaches the sandbox first; the live hub moves only when a person promotes.** For Cloud Bongos, "main" is the published release (ADR 0161), so the sandbox follows releases and the hub holds a pin.
+
+## Where it runs (owner's choices, 2026-11-14)
+
+| | Sandbox | Live hub |
+|---|---|---|
+| Address | `https://sandbox.cloudbongos.com` (one host: projects page and hall) | `cloudbongos.com`, `builders.`, `status.` |
+| Box | DigitalOcean `cloudbongos-sandbox` (IP in the DigitalOcean console; reached with the control-plane key `cloudbongos_ed25519`), `s-1vcpu-2gb`, **NYC1**, $12/mo, tag `cloudbongos-sandbox` (NYC3 had no `s-1vcpu-2gb` left) | `cloudbongos`, NYC3 |
+| Takes releases | **every one, as published** — `cloudbongos-sandbox-update.timer`, every 15 min, roster entry `follow: candidates`, `channel: minor`, `pinMode: local-commit` | **never by itself** — its row's update rule is `pinned` (set 2026-11-14) |
+| Moves when | a release is published | a person presses the move on **Hall → Deploy** (`/deploy`) |
+| Data | its own empty `cloudbongos` database | the real one |
+
+The owner chose a separate server over the hub's box (which every project hall shares and which sits near its memory limit), and chose that patch releases stop going live by themselves once the sandbox exists.
+
+## What makes it a sandbox
+
+- `BONGOS_SANDBOX=1` in `/etc/cloudbongos/web.env`. The hub server installs `src/sandbox` (`src/platform-server.js`), so every page carries the yellow band and sends, charges and writes to known providers (Discord, GitHub's API, Stripe, mail) are refused and logged as `[bongos-sandbox] refused …` in `journalctl -u cloudbongos-sandbox`. The band appears once a release carrying task 1005292 is installed.
+- **One named exception:** `BONGOS_SANDBOX_ALLOW=github-repo-create`, so a test project's creation can make its (free) GitHub repository. Every other GitHub change stays refused (owner's choice, 2026-11-14; `src/sandbox/gate.js` `ALLOWANCES`).
+- **No outside credentials in its environment:** no push token, no box-source token, no Discord, no Cloudflare or DigitalOcean token. Its `web.env` copies only the hub's look and behaviour settings.
+- Its own GitHub sign-in app ("Cloud Bongos sandbox", callback `https://sandbox.cloudbongos.com/api/gds/auth/web/callback`). Session cookies are host-only, and `cookieDomain` is `sandbox.cloudbongos.com`, so signing in on one site never touches the other. `firstAdmin` is `willHermesLines` (Will O'Brien, who started the goal): his first sign-in seats the sandbox's owner. The creation walk is task 1005314.
+- `config/branding.json` addresses all point at `sandbox.cloudbongos.com` (committed locally in the sandbox checkout; it has no remote, so nothing reaches the hub's instance repo).
+
+## Test projects
+
+Projects created on the sandbox live at `<slug>.sandbox.cloudbongos.com`. The wildcard `*.sandbox.cloudbongos.com` is one grey-cloud Cloudflare record pointing at the sandbox, so the sandbox needs no Cloudflare token (`BOX_DNS_HOOK` unset, the runner skips the DNS step). Caddy gives each one a certificate on demand, through the same `on_demand_tls` ask as the hub. A test project (`modules/provisioning/test-project.js`) is archon-only and never shows on the public map. Created projects are built by `sandbox-provision-intent-runner.timer` (every 2 minutes; the live hub's twin is `selfhost-provision-intent-runner`), which carries no `box.env`, so it holds no Cloudflare or DigitalOcean token.
+
+## Box layout
+
+- Checkout `/home/lars/cloudbongos-instance` (a copy of the hub's instance repo with the `origin` remote removed). Service `cloudbongos-sandbox.service`, port 3002, user `lars`.
+- Caddy `/etc/caddy/Caddyfile`: the hub's global block (Cloudflare trusted proxies, `on_demand_tls`), `import /etc/caddy/sites/*.caddy`, and the `sandbox.cloudbongos.com` site on the `*.cloudbongos.com` origin cert (proxied, orange cloud).
+- 2 GB swap, `vm.swappiness=10`, ufw allowing 22/80/443.
+- `/usr/local/sbin/sandbox-set-github` stores the sign-in app's id and secret (one per line on stdin) and restarts the service.
+
+## Checks
+
+```bash
+curl -s https://sandbox.cloudbongos.com/version
+```
+
+```bash
+ssh -i ~/.ssh/cloudbongos_ed25519 root@<sandbox droplet IP> 'systemctl list-timers | grep sandbox; journalctl -u cloudbongos-sandbox-update -n 20 --no-pager'
+```
+
+The hub's own sweep must keep printing `cloudbongos: pinned — skipped`.
+
+## Gotchas found standing it up
+
+- The hub's Cloudflare token is locked to the hub's IPv4 address: call the API with `curl -4`, or it answers 9109 "Cannot use the access token from location".
+- `@bongos/core` is public on npm, so the sandbox needs no registry token (`docs/recipes/core-release-pipeline.md` still describes an `NPM_TOKEN` file on the hub, which no longer exists there).
+- The Claude terminal panel shows what is typed even at a hidden (`read -s`) prompt. Never have a person paste a secret into it; read it from the clipboard (`pbpaste`) without reading the keyboard at all.

package/modules/hall-ui/public/craft-mode.js

@@ -265,6 +265,10 @@
     return false;
   }
   function homeHref(mode) {
+    // In game mode the street is not a place (shell-game.js would send it back
+    // home), so the patron's home there is Home itself (task 1005307).
+    var g = window.OTBShellGame;
+    if (g && typeof g.on === 'function' && g.on() === true) return '/';
     var street = mode === 'patron' && window.GovCity && window.GovCity.STREET_HREF;
     return street || '/';
   }

package/modules/hall-ui/public/home-city.js

@@ -355,9 +355,17 @@
   }
 
   // ---- the governor's Home is the street; tests swap the hop for a recorder ----
+  // Classic view only (task 1005307): in game mode the street is not a place, so
+  // shell-game.js sends it straight back here — hopping from Home made an endless
+  // reload loop. The game's patron stays on the city and walks on from the visor.
+  // shell-game.js is the one answer: a page without it is never in game mode.
+  function gameOn() {
+    const g = window.OTBShellGame;
+    return !!(g && typeof g.on === 'function' && g.on() === true);
+  }
   function streetHop() {
     const href = window.GovCity && window.GovCity.STREET_HREF;
-    if (document.documentElement.dataset.craft !== 'patron' || !href) return false;
+    if (document.documentElement.dataset.craft !== 'patron' || !href || gameOn()) return false;
     (window.OTBHomeStreetHop || ((h) => window.location.assign(h)))(href);
     return true;
   }

package/modules/hall-ui/public/sky-time.js

@@ -179,7 +179,8 @@
     if (!p) return null;
     const el = d.documentElement;
     Object.keys(p).forEach((name) => el.style.setProperty('--sky-now-' + name, String(p[name])));
-    el.setAttribute('data-sky-hour', String(Math.round(h * 10) / 10));
+    // rounded to a tenth, 23:57 to 23:59 would say 24, which is no hour: wrap after rounding (task 1005299)
+    el.setAttribute('data-sky-hour', String(wrap(Math.round(h * 10) / 10)));
     lastHour = h;
     return p;
   }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.28",
+  "version": "1.25.30",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.28",
+      "version": "1.25.30",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.28",
+  "version": "1.25.30",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11940,5 +11940,20 @@
       "id": "1005305",
       "text": "In game mode the builder's Home is now just the city: no scrolling, you move around with the arrow keys, by dragging, or by resting the cursor at a screen edge, and you rewind and replay the city's history from the visor's top"
     }
+  ],
+  "1.25.29": [
+    {
+      "text": "Cloud Bongos now has a test copy at sandbox.cloudbongos.com that gets every new release first, and the main site only updates when a person presses promote."
+    },
+    {
+      "id": "1005299",
+      "text": "The city's sky clock no longer says \"hour 24\" in the last three minutes before midnight, and its check no longer fails at random late at night."
+    }
+  ],
+  "1.25.30": [
+    {
+      "id": "1005307",
+      "text": "Choosing Patron in game mode no longer reloads the hall endlessly; it settles on the city."
+    }
   ]
 }

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.25.28'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.30'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/platform-server.js

@@ -225,6 +225,14 @@ function buildPlatformApp() {
   // same reqId. Mounted before any surface so nothing logs uncorrelated.
   app.use(requestIdMiddleware);
 
+  // THE PLATFORM'S OWN SANDBOX (task 1005292, ADR 0406 §7). Cloud Bongos runs a second
+  // copy of itself that takes every release first; that copy runs with BONGOS_SANDBOX=1
+  // and nothing else marks it. install() is the same one a project's app uses: every
+  // page carries the "Sandbox" band, and sends/charges/writes to known providers
+  // (Discord, GitHub's API, Stripe, mail) are refused and logged. On the live hub, where
+  // the variable is absent, it returns a pass-through and changes nothing.
+  app.use(require('./sandbox').install().middleware);
+
   // THE request.divert SEAM (task 1004300, ADR 0349). A module may register a provider that
   // takes a request BEFORE any surface answers and either handles it or passes it on —
   // today the npm-release module's version preview, which hands a browser holding its

package/src/sandbox/gate.js

@@ -56,18 +56,32 @@ function credentialOf(headers) {
   return '';
 }
 
+// NAMED EXCEPTIONS a sandbox may switch on with BONGOS_SANDBOX_ALLOW (comma-separated
+// names), each one write and nothing near it (task 1005292). Cloud Bongos's own sandbox
+// switches on `github-repo-create`, so a test project's creation walk can make its (free)
+// repository, owner's choice 2026-11-14; every other GitHub change stays refused. An
+// unknown name allows nothing.
+const ALLOWANCES = {
+  'github-repo-create': { host: /^api\.github\.com$/i, method: 'POST', path: /^\/(user|orgs\/[A-Za-z0-9-]+)\/repos$/ },
+};
+function parseAllowances(raw) {
+  return String(raw || '').split(',').map((x) => x.trim()).filter((x) => Object.prototype.hasOwnProperty.call(ALLOWANCES, x));
+}
+
 /**
- * The gate's whole policy. `{ method, host, path, headers }` → `{ allow: true }` or
- * `{ allow: false, provider, kind, reason }`. A host in no provider's row passes: the
+ * The gate's whole policy. `{ method, host, path, headers, allowances }` → `{ allow: true }`
+ * or `{ allow: false, provider, kind, reason }`. A host in no provider's row passes: the
  * gate covers the providers it knows, and says so.
  */
-function decide({ method, host, path, headers }) {
+function decide({ method, host, path, headers, allowances = [] }) {
   const m = String(method || 'GET').toUpperCase();
   const h = String(host || '').toLowerCase().replace(/:\d+$/, '');
   const p = PROVIDERS.find((x) => x.host.test(h));
   if (!p) return { allow: true };
   if (READ_METHODS.has(m)) return { allow: true, provider: p.name };
   const pathOnly = String(path || '/').split('?')[0];
+  const named = allowances.find((n) => { const a = ALLOWANCES[n]; return a && a.method === m && a.host.test(h) && a.path.test(pathOnly); });
+  if (named) return { allow: true, provider: p.name, allowance: named };
   if (m === 'POST' && (p.postReads || []).some((re) => re.test(pathOnly))) return { allow: true, provider: p.name };
   if (p.testKey && p.testKey.test(credentialOf(headers))) return { allow: true, provider: p.name, testMode: true };
   return {
@@ -97,13 +111,13 @@ class SandboxRefused extends Error {
 }
 
 /** Wrap a fetch: a refused call answers 403 with a body that says why, and never leaves. */
-function wrapFetch(fetchImpl, log) {
+function wrapFetch(fetchImpl, log, allowances = []) {
   if (!fetchImpl || fetchImpl.__bongosSandbox) return fetchImpl;
   const wrapped = async function sandboxFetch(input, init = {}) {
     const url = new URL(typeof input === 'string' || input instanceof URL ? String(input) : input.url);
     const method = (init.method || (input && input.method) || 'GET');
     const headers = init.headers || (input && input.headers) || {};
-    const d = decide({ method, host: url.host, path: url.pathname + url.search, headers: typeof headers.get === 'function' ? headers : lower(headers) });
+    const d = decide({ method, host: url.host, path: url.pathname + url.search, headers: typeof headers.get === 'function' ? headers : lower(headers), allowances });
     if (d.allow) return fetchImpl(input, init);
     log.add({ ...d, method: String(method).toUpperCase(), host: url.host, path: url.pathname });
     return new Response(JSON.stringify({ error: { type: 'bongos_sandbox_refused', provider: d.provider, kind: d.kind, message: d.reason } }),
@@ -140,14 +154,14 @@ function refusedRequest(d, cb) {
 }
 
 /** Patch a node `http` / `https` module's request + get through the gate. */
-function wrapHttp(mod, log) {
+function wrapHttp(mod, log, allowances = []) {
   if (!mod || mod.request.__bongosSandbox) return;
   const realRequest = mod.request;
   const realGet = mod.get;
   const guarded = (real, isGet) => {
     const fn = function sandboxRequest(...args) {
       const t = targetOf(args);
-      const d = decide(t);
+      const d = decide({ ...t, allowances });
       if (d.allow) return real.apply(mod, args);
       log.add({ ...d, method: String(t.method).toUpperCase(), host: t.host, path: t.path });
       const req = refusedRequest(d, args[args.length - 1]);
@@ -161,4 +175,4 @@ function wrapHttp(mod, log) {
   mod.get = guarded(realGet, true);
 }
 
-module.exports = { decide, makeLog, wrapFetch, wrapHttp };
+module.exports = { decide, makeLog, wrapFetch, wrapHttp, parseAllowances };

package/src/sandbox/index.js

@@ -19,7 +19,7 @@
 //
 // Fake data is the app's own to seed: `isSandbox()` lets it seed only here.
 
-const { makeLog, wrapFetch, wrapHttp } = require('./gate');
+const { makeLog, wrapFetch, wrapHttp, parseAllowances } = require('./gate');
 
 const PAGE = '/__bongos/sandbox';
 let state = null;
@@ -84,7 +84,9 @@ function pageHtml(log, env = process.env, { owner = false } = {}) {
       : `<p>The project's owner sees what this copy refused from their project page.</p>`)
     + `<h2>What this cannot catch</h2>`
     + `<p>Reads to a known provider go out; sends, charges and writes to it are refused. It only sees calls this app makes through Node's own web requests, and only to the providers it knows. Code that goes around them, or a provider it does not know, is not stopped. A read-only key is the real protection; this is the second wall.</p>`
-    + `<p>The free plan also blocks outgoing email ports, so this copy cannot send email directly.</p>`
+    // Only true on Render's free plan (Render sets RENDER=true); the platform's own sandbox
+    // runs on a plain server, where saying it would be false (task 1005292).
+    + (String(env.RENDER || '') === 'true' ? `<p>The free plan also blocks outgoing email ports, so this copy cannot send email directly.</p>` : '')
     + `</body></html>`;
 }
 
@@ -131,9 +133,10 @@ function install({ env = process.env, fetchHost = globalThis, http = require('no
   if (!isSandbox(env)) return { active: false, middleware: passThrough, refusals: [], bandHtml: () => '', isSandbox: false };
   if (!state) {
     const log = makeLog(write ? { write } : {});
-    if (typeof fetchHost.fetch === 'function') fetchHost.fetch = wrapFetch(fetchHost.fetch, log);
-    wrapHttp(http, log);
-    wrapHttp(https, log);
+    const allowances = parseAllowances(env.BONGOS_SANDBOX_ALLOW);
+    if (typeof fetchHost.fetch === 'function') fetchHost.fetch = wrapFetch(fetchHost.fetch, log, allowances);
+    wrapHttp(http, log, allowances);
+    wrapHttp(https, log, allowances);
     state = { log, middleware: makeMiddleware(log, env) };
   }
   return { active: true, middleware: state.middleware, refusals: state.log.items, bandHtml, isSandbox: true };

package/tests/craft_mode_home.mjs

@@ -31,7 +31,7 @@ function el() {
 }
 
 // One page: `page` is body[data-page], `active` the nav item the shell marked.
-function boot({ page, active = null, govCity = false }) {
+function boot({ page, active = null, govCity = false, game = false }) {
   const hops = [];
   const body = el();
   body.setAttribute('data-page', page);
@@ -55,6 +55,7 @@ function boot({ page, active = null, govCity = false }) {
     location: { search: '' },
   };
   if (govCity) window.GovCity = { STREET_HREF: '/builders/street' };
+  if (game) window.OTBShellGame = { on: () => true };
   window.window = window;
   vm.runInNewContext(CRAFT, { window, document, CustomEvent: function () {}, Promise, console });
   return { CM: window.OTBCraftMode, hops };
@@ -83,6 +84,16 @@ test('choosing Patron on another craft\'s page lands on the street', () => {
   assert.equal(boot({ page: 'studio' }).CM.homeHref('patron'), '/');
 });
 
+// task 1005307: in game mode the street is not a place (shell-game.js sends it back
+// Home, and Home sent a patron to the street again: an endless reload loop), so a
+// stranded page goes straight Home.
+test('in game mode, choosing Patron on another craft\'s page goes Home, never the street', () => {
+  const { CM, hops } = boot({ page: 'studio', active: 'studio', govCity: true, game: true });
+  assert.equal(CM.homeHref('patron'), '/');
+  CM.choose('patron');
+  assert.deepEqual(hops, ['/']);
+});
+
 test('a page the chosen craft also shows stays put', () => {
   // goals is in Artisan and Artist alike
   const { CM, hops } = boot({ page: 'goals', active: 'goals' });

package/tests/hall_sky_time.mjs

@@ -192,7 +192,13 @@ test('a pinned hour wins: the root attribute, then the query, then the hash; a b
 });
 
 // The page half, run against a stand-in document whose computed styles are style.css's own tokens.
-function page({ search = '', hash = '', attr = null } = {}) {
+// `now` fixes the viewer's clock (a local "HH:MM"), so no case depends on when the suite runs.
+function clockAt(now) {
+  if (now == null) return Date;
+  const [hh, mm] = now.split(':').map(Number);
+  return class extends Date { constructor(...a) { if (a.length) super(...a); else super(2026, 0, 1, hh, mm, 0); } };
+}
+function page({ search = '', hash = '', attr = null, now = null } = {}) {
   const set = {}; const attrs = attr == null ? {} : { 'data-sky-hour-at': attr };
   const timers = []; let probes = 0; let computed = 0;
   const html = {
@@ -216,7 +222,7 @@ function page({ search = '', hash = '', attr = null } = {}) {
       return { color: `rgb(${v[0]}, ${v[1]}, ${v[2]})` };
     },
     setInterval(fn, ms) { timers.push({ fn, ms }); return timers.length; },
-    Date, Number, String, Math, Object, Array, parseInt, decodeURIComponent, isFinite,
+    Date: clockAt(now), Number, String, Math, Object, Array, parseInt, decodeURIComponent, isFinite,
   };
   vm.runInNewContext(read('sky-time.js'), ctx, { filename: 'sky-time.js' });
   return { api: window.OTBSkyTime, set, attrs, timers, document, stats: () => ({ probes, computed }) };
@@ -242,12 +248,26 @@ test('on load the page wears the hour\'s palette as --sky-now-* on the root, fro
 test('the override reaches the page: the hash and the root attribute pin the hour too', () => {
   assert.equal(page({ hash: '#hour=18' }).set['--sky-now-cloud'], KEYS.dusk.cloud.toLowerCase());
   assert.equal(page({ attr: '6', search: '?hour=13' }).set['--sky-now-cloud'], KEYS.dawn.cloud.toLowerCase());
-  // with nothing pinned the viewer's clock is the source: a number from 0 up to 24
-  const live = page();
-  assert.ok(Number(live.attrs['data-sky-hour']) >= 0 && Number(live.attrs['data-sky-hour']) < 24);
+  // with nothing pinned the viewer's clock is the source (fixed here, so the case never
+  // depends on when the suite runs)
+  const live = page({ now: '13:30' });
+  assert.equal(live.attrs['data-sky-hour'], '13.5');
   assert.equal(live.api.hourNow({ document: live.document, location: { search: '?hour=4', hash: '' } }), 4);
 });
 
+// Task 1005299: 23:57 to 23:59 rounded to one decimal is 24.0, which is not an hour; the
+// last minutes of the day say the next day's first hour, and wear its palette.
+test('the hour the page says never reaches 24: the last minutes of the day wrap to 0', () => {
+  for (const now of ['23:57', '23:58', '23:59']) {
+    const p = page({ now });
+    assert.equal(p.attrs['data-sky-hour'], '0', `${now} says hour 0, not 24`);
+    assert.equal(p.set['--sky-now-mid'], KEYS.night.mid.toLowerCase(), `${now} wears night`);
+  }
+  assert.equal(page({ now: '23:56' }).attrs['data-sky-hour'], '23.9');
+  assert.equal(page({ now: '00:00' }).attrs['data-sky-hour'], '0');
+  assert.equal(page({ search: '?hour=23.98' }).attrs['data-sky-hour'], '0', 'a pinned hour wraps the same way');
+});
+
 test('no motion: the palette is recomputed at most once a minute and nothing animates between two', () => {
   const p = page({ search: '?hour=6' });
   assert.equal(p.timers.length, 1, 'one timer');

package/tests/home_city_widget.mjs

@@ -48,12 +48,13 @@ const stubs = (status, craft) => `
   window.OTBCraftMode = { iconHtml: (k, cls) => '<svg class="' + cls + '" data-icon="' + k + '"></svg>', choose: (m) => window.__chosen.push(m), current: () => window.__craft };
   window.OTB = { contributeHallWidget(w) { window.__widget = w; } };`;
 
-async function boot({ status = 200, width = 1280, still = true, craft = null } = {}) {
+async function boot({ status = 200, width = 1280, still = true, craft = null, game = false } = {}) {
   const ctx = await browser.newContext({ viewport: { width, height: 900 }, reducedMotion: still ? 'reduce' : 'no-preference' });
   const page = await ctx.newPage();
   await page.clock.install();
   await page.setContent(`<!doctype html><html><head><style>${CSS}</style></head><body><section id="home-city" class="scroll home-city" hidden></section></body></html>`);
   await page.addScriptTag({ content: stubs(status, craft) });
+  if (game) await page.addScriptTag({ content: 'window.OTBShellGame = { on: () => true };' });
   await page.addScriptTag({ content: GOV });
   await page.addScriptTag({ content: DRAW });
   await page.addScriptTag({ content: WIDGET });
@@ -184,6 +185,16 @@ test('the governor\'s Home is the street: Patron on Home goes there, opened or c
   await ctx.close();
 });
 
+// task 1005307: in game mode the street is not a place — shell-game.js sends it back to
+// Home — so hopping there from Home was an endless reload loop. The game's patron stays.
+test('in game mode the patron stays on Home: no hop to the street, opened or chosen', { skip }, async () => {
+  const { ctx, page } = await boot({ craft: 'patron', game: true });
+  await page.waitForFunction(() => document.querySelectorAll('.hc-rung').length > 0);
+  const flipped = await page.evaluate(() => { document.dispatchEvent(new CustomEvent('otb:craft', { detail: { mode: 'patron' } })); return window.__hops.slice(); });
+  await ctx.close();
+  assert.deepEqual(flipped, [], 'Home with Patron in game mode builds the city and never leaves for the street');
+});
+
 test('a refused read leaves the section hidden: never an empty plate', { skip }, async () => {
   const { ctx, page } = await boot({ status: 401 });
   await page.evaluate(() => new Promise((r) => setTimeout(r, 0)));

package/tests/platform_sandbox.mjs

@@ -0,0 +1,96 @@
+// tests/platform_sandbox.mjs — Cloud Bongos's own sandbox (task 1005292; ADR 0406 §7).
+//
+// The platform runs a second copy of itself that takes every release before the live hub.
+// That copy is the same server started with BONGOS_SANDBOX=1. Pinned here:
+//   1. the hub server installs the sandbox middleware, before any surface answers, so every
+//      page of the copy carries the band — and on the live hub (no variable) it is a no-op;
+//   2. the sandbox page only claims Render's blocked mail ports where Render is the host,
+//      because the platform's sandbox runs on a plain server where that sentence is false.
+//
+// Run:  node tests/platform_sandbox.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { install, pageHtml } = require('../src/sandbox/index.js');
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const src = fs.readFileSync(path.join(ROOT, 'src/platform-server.js'), 'utf8')
+  .replace(/^\s*\/\/.*$/gm, ''); // comments may cite the rule; only code counts
+
+await t('the hub server mounts the sandbox middleware', () => {
+  assert.match(src, /app\.use\(require\('\.\/sandbox'\)\.install\(\)\.middleware\)/);
+});
+
+await t('it is mounted before any surface or module answers', () => {
+  const at = src.indexOf("require('./sandbox')");
+  const divert = src.indexOf("resolveOptional('request.divert')");
+  const surfaces = src.indexOf('mountInternalSurfaces(');
+  assert.ok(at > 0 && divert > 0 && at < divert, 'sandbox must come before the request.divert seam');
+  // the import of mountInternalSurfaces sits at the top; the CALL is what matters
+  const call = src.indexOf('mountInternalSurfaces(', surfaces + 1);
+  assert.ok(call < 0 || at < call, 'sandbox must come before the surfaces mount');
+});
+
+await t('on the live hub (no BONGOS_SANDBOX) it changes nothing', () => {
+  const r = install({ env: {} });
+  assert.equal(r.active, false);
+  let called = false;
+  r.middleware({}, {}, () => { called = true; });
+  assert.equal(called, true);
+});
+
+const log = { items: [] };
+await t('on a plain server the page makes no claim about blocked mail ports', () => {
+  assert.doesNotMatch(pageHtml(log, { BONGOS_SANDBOX: '1' }), /email ports/);
+});
+await t('on Render it still says the free plan blocks them', () => {
+  assert.match(pageHtml(log, { BONGOS_SANDBOX: '1', RENDER: 'true' }), /blocks outgoing email ports/);
+});
+
+// 3. The one named exception: creating a repository (owner's choice, 2026-11-14).
+const { decide, parseAllowances } = require('../src/sandbox/gate.js');
+const ALLOW = parseAllowances('github-repo-create');
+await t('without the exception, creating a GitHub repository is refused', () => {
+  assert.equal(decide({ method: 'POST', host: 'api.github.com', path: '/user/repos' }).allow, false);
+});
+await t('with it, creating a repository for a person or an organisation passes', () => {
+  assert.equal(decide({ method: 'POST', host: 'api.github.com', path: '/user/repos', allowances: ALLOW }).allow, true);
+  assert.equal(decide({ method: 'POST', host: 'api.github.com', path: '/orgs/acme-co/repos', allowances: ALLOW }).allow, true);
+});
+await t('every other GitHub change stays refused with it on', () => {
+  for (const [m, p] of [['POST', '/repos/o/r/pulls'], ['PUT', '/repos/o/r/pulls/1/merge'], ['PATCH', '/repos/o/r'], ['DELETE', '/repos/o/r'], ['POST', '/repos/o/r/keys'], ['PUT', '/repos/o/r/collaborators/x'], ['POST', '/user/repos/extra']]) {
+    assert.equal(decide({ method: m, host: 'api.github.com', path: p, allowances: ALLOW }).allow, false, `${m} ${p}`);
+  }
+});
+await t('an unknown exception name allows nothing', () => {
+  assert.deepEqual(parseAllowances('everything, github-*'), []);
+});
+await t('install() reads the exception from BONGOS_SANDBOX_ALLOW', async () => {
+  const seen = [];
+  const host = { fetch: async (u) => { seen.push(String(u)); return new Response('{}', { status: 201 }); } };
+  const fakeMod = () => ({ request() {}, get() {} });
+  const idx = require('../src/sandbox/index.js');
+  // a fresh module instance, since install() keeps one state per process
+  delete require.cache[require.resolve('../src/sandbox/index.js')];
+  const fresh = require('../src/sandbox/index.js');
+  fresh.install({ env: { BONGOS_SANDBOX: '1', BONGOS_SANDBOX_ALLOW: 'github-repo-create' }, fetchHost: host, http: fakeMod(), https: fakeMod(), write() {} });
+  void idx;
+  return host.fetch('https://api.github.com/user/repos', { method: 'POST' }).then((r) => {
+    assert.equal(r.status, 201);
+    assert.equal(seen.length, 1);
+  });
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);