chore: upgrade platform 2.0.0-rc.39 -> 2.0.0-rc.44

.bos/generated/runtime-map.json

@@ -1,8 +1,8 @@
 {
-  "generatedAt": "2026-11-05T22:12:47.714Z",
+  "generatedAt": "2026-11-12T07:10:22.672Z",
   "env": "development",
-  "release": "2.0.0-rc.39",
-  "extends": "/Users/elliot.braem/workspace/product/activity.nearbuilders.org/bos.app.ts → bos://dev.everything.near/everything.dev",
+  "release": "2.0.0-rc.44",
+  "extends": "bos.app.ts → bos://dev.everything.near/everything.dev",
   "sources": [
     {
       "key": "ui",
@@ -21,7 +21,8 @@
       "name": "host",
       "source": "remote",
       "location": "https://cdn.everything.dev/bundles/dev.everything.near/everything.dev/host",
-      "integrity": "sha384-PsU9q6/jQS9heCznqcWkeG97L4hLl1aSENaOyK1y0syUzMK0M/gr2NTft3mkjx71"
+      "digest": "versions/3e37dfef1799bf87.json",
+      "integrity": "sha384-eEQI0AqhOr3tLmX2Y958qTtrISeBKBbIMgpMehyVqFVneXm0NVGhsKNMOO6CPJgs"
     },
     {
       "key": "api",
@@ -37,9 +38,10 @@
       "source": "remote",
       "location": "https://cdn.everything.dev/bundles/dev.everything.near/everything.dev/auth",
       "pluginManifestUrl": "https://cdn.everything.dev/bundles/dev.everything.near/everything.dev/auth/plugin.manifest.json",
-      "integrity": "sha384-FENdY7Q5xLCSYiT6gZOgFUFM0f0/9JVl8dVzmIs0oi1M9/eOwNA+4rT2mjl7NPQP",
+      "digest": "versions/f6835d88fcb01fdd.json",
+      "integrity": "sha384-outQaOt4wS2vf+UIeSfN3xIt074Ixerg2sLKtYSVyrEH9SUY4Sx6GQ8WZkkwdPdU",
       "pluginVersion": "2.0.0-rc.8",
-      "contractSha256": "11e86ebd0af6581a6348df858fc88b5e583366553f2ebcaa4f31d787569c7fca"
+      "contractSha256": "c8022b18e4cedfc30d591060b8a9d81e65fdb3cf80658db441d3d4cd9401ee4d"
     }
   ],
   "unresolved": [],
@@ -287,5 +289,11 @@
       "nav": null
     }
   ],
-  "shadowed": []
+  "shadowed": [],
+  "lockfile": {
+    "pointerDigest": "23a76a2501c8a73d",
+    "release": "2.0.0-rc.44",
+    "resolvedAt": "2026-11-12T07:08:28.715Z",
+    "drift": []
+  }
 }

.bos/generated/shared-deps.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
   "kind": "everything-dev/shared-deps",
-  "generatedAt": "2026-11-05T17:37:02.703Z",
+  "generatedAt": "2026-11-12T07:06:48.228Z",
   "deps": {},
-  "fingerprintSha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
+  "generatedDigest": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
   "inputs": {
     "mode": "catalog->bos",
     "hostMode": "local"

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ permissions:
 jobs:
   ci:
     name: CI
-    uses: NEARBuilders/everything-dev/.github/workflows/consumer-ci.yml@v2.0.0-rc.39
+    uses: NEARBuilders/everything-dev/.github/workflows/consumer-ci.yml@v2.0.0-rc.44
     with:
       working_directory: .
     secrets: inherit

.github/workflows/deploy.yml

@@ -28,7 +28,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy
-    uses: NEARBuilders/everything-dev/.github/workflows/consumer-deploy.yml@v2.0.0-rc.39
+    uses: NEARBuilders/everything-dev/.github/workflows/consumer-deploy.yml@v2.0.0-rc.44
     with:
       working_directory: .
       verbose: ${{ inputs.verbose == true }}

.github/workflows/staging.yml

@@ -27,7 +27,7 @@ permissions:
 jobs:
   deploy-staging:
     name: Deploy Staging
-    uses: NEARBuilders/everything-dev/.github/workflows/consumer-staging.yml@v2.0.0-rc.39
+    uses: NEARBuilders/everything-dev/.github/workflows/consumer-staging.yml@v2.0.0-rc.44
     with:
       working_directory: .
       verbose: ${{ inputs.verbose == true }}

.gitignore

@@ -305,9 +305,9 @@ fabric.properties
 :memory:
 
 .turbo
+# .bos is local-only runtime state (ADR 0047) — the single committed artifact
+# is bos.lock.json at the repo root, not anything under .bos/.
 .bos
-!.bos/sync-snapshot.json
-!.bos/infra-state.json
 .bos/session.json
 
 # alchemy state ledger (runtime artifact of hosting-adapter stacks)

biome.json

@@ -50,6 +50,7 @@
   "files": {
     "includes": [
       "**",
+      "!!repos",
       "!!**/.agents",
       "!!**/*.gen.ts",
       "!!**/.bos/generated",

bos.app.ts

@@ -11,7 +11,7 @@ export default App({
   description:
     "Shared activity and reputation layer for the NEAR ecosystem — Activity Sources submit signed events through one HTTP gateway; Nostr relays store and distribute them.",
   repository: "https://github.com/NEARBuilders/activity.nearbuilders.org",
-  release: "2.0.0-rc.39",
+  release: "2.0.0-rc.44",
   ci: {
     railway: {
       service: "activity-app",

bos.lock.json

@@ -0,0 +1,42 @@
+{
+  "schemaVersion": 2,
+  "kind": "everything-dev/composition-lockfile",
+  "runtimeRef": "bos://nearbuilding.near/activity.nearbuilders.org",
+  "release": "2.0.0-rc.44",
+  "remotes": {
+    "app.host": {
+      "kind": "descriptor",
+      "base": "https://cdn.everything.dev/bundles/dev.everything.near/everything.dev/host/",
+      "digest": {
+        "manifest": "versions/3e37dfef1799bf87.json",
+        "integrity": "sha384-cP/HY0FMqCIaGpIto592Nugvkw2CU9bpkD2l+h46QUDbyMaTxqTzNadnK5GSObfB"
+      }
+    },
+    "app.ui": {
+      "kind": "descriptor",
+      "base": "https://cdn.everything.dev/bundles/dev.everything.near/everything.dev/ui/",
+      "digest": {
+        "manifest": "versions/0ad24f671da7ac3f.json",
+        "integrity": "sha384-P45/wZLjsnsE6dP63LZMq6FcwXCh5xN7CWsb5oO6MIPI+jNXc4BFCuUcrUWb4Fe8"
+      }
+    },
+    "app.api": {
+      "kind": "descriptor",
+      "base": "https://cdn.everything.dev/bundles/dev.everything.near/everything.dev/api/",
+      "digest": {
+        "manifest": "versions/968c2b6d44e0f6eb.json",
+        "integrity": "sha384-FDKeUX44vGvIRKLtKeEfVsqZ0MBbvkbDtvpWOh9bG5lwYm/uSage8P62jbaBCHxU"
+      }
+    },
+    "app.auth": {
+      "kind": "descriptor",
+      "base": "https://cdn.everything.dev/bundles/dev.everything.near/everything.dev/auth/",
+      "digest": {
+        "manifest": "versions/f6835d88fcb01fdd.json",
+        "integrity": "sha384-KYhYj9y/Zp45DCOrki2osT8y98d+qNkHDvPUCRS/nIuOm91v76kYjB3QWNdnNKXT"
+      }
+    }
+  },
+  "pointerDigest": "23a76a2501c8a73d",
+  "resolvedAt": "2026-11-12T07:08:28.715Z"
+}

docs/agents/how-it-fits.md

@@ -28,6 +28,31 @@ runs your local workspaces in-process next to it. `bos.dev.ts` alters the dev
 resolution only; `_resolved` in `.bos/bos.resolved-config.json` records what the
 resolution produced (regenerate: `pnpm run types:gen`).
 
+## The verification spine
+
+That chain carries its own proof. From the on-chain write to the served byte,
+every hop is an attestation — independently checked, nothing trusted
+transitively ([ADR 0046](../adr/0046-manifest-attribution.md),
+[`GLOSSARY.md`](../../GLOSSARY.md) — "verification spine"):
+
+```mermaid
+flowchart LR
+  T["NEAR tx<br/>(the registry write<br/>is chain-signed)"] -->|"pins + key record<br/>on-chain"| C["Config<br/>bos://&lt;account&gt;/&lt;gateway&gt;"]
+  C -->|"names the immutable<br/>release record"| R["versions/&lt;release&gt;.json"]
+  C -->|"each slot pins<br/>manifest + SRI"| M["Slot manifest<br/>versions/&lt;hash&gt;.json<br/>(signed — attributed)"]
+  M -->|"content-addressed dir"| D["Version dir<br/>versions/&lt;dirId&gt;/"]
+  M -->|"every file's SRI"| F["Files<br/>(entry · chunks · ssr)"]
+```
+
+`bos verify` walks this spine at three depths (`pointer` / `entries` / `files`)
+and reports each leg by name: SRI mismatches, schema failures, and — when the
+config demands attribution — manifest signatures verified against the key
+record the config publishes. The same walker is the adopt transaction's gate
+and the smoke gate's in-image leg, so a broken prefix refuses the boot rather
+than serving past it. The one primitive underneath is the Verifier engine
+(`everything-dev/verify`): every production fetch goes through it, and its
+`Verified<T>` brand is how unverified bytes are kept out of the types.
+
 ## Composition: mounts, core-wins, shadows
 
 ```mermaid
@@ -77,17 +102,21 @@ state disagree, believe the state and fix the doc.
 | `logs/dev-latest.log` + dated `logs/dev-*.log` | what **actually ran**: which MF bundles loaded (`auth=https://cdn…`), compose warnings, per-service boot logs. `bos logs` reads it. This is the truth of last resort when a boot behaves differently than its config suggests |
 | `platform-manifest.json` | the resolved platform release — what the `platform:` pin actually pulled (source, resolvedAt, manifest) |
 | `deploy-state.json` | what was last published (version, apps) — confuses nobody when "is production serving my code?" |
-| `sync-snapshot.json` + `sync-backup/<date>/` | what the last `bos upgrade` reconciled, and pre-upgrade copies of template-owned files you'd edited — the diff surface for merge-review on upgrades |
+| `sync-backup/<date>/` | pre-upgrade copies of template-owned files you'd edited — the review surface for `--force` resolutions, bounded to the newest 10. The sync baseline itself lives in `bos.lock.json`'s `template.sync` (ADR 0047) |
 | `regression/*.json` | cached seeded sessions (`cookies.json`, `seed.json`, …) — why regression specs start signed-in without minting their own |
 
 **Clean up at source.** These are the runtime's artifacts, not yours to hack
-around. Logs currently accumulate with no rotation — 79 files / 4.6 MB in nine
-working days here — and the durable fix is upstream
-(right now: `TODO(#596)`); deleting dated `.bos/logs/*.log` is safe in the
-meantime. The regression caches are safe to wipe whenever fixtures drift: the
-next run re-seeds them. Anything else under `.bos/` (`session.json`,
-`sync-backup/`) is state you regenerate by re-running the responsible command —
-when a surface feels stale, regenerate it in place rather than editing it.
+around. Logs rotate at the source: every dev boot prunes dated logs beyond
+the newest 20 and anything older than a week — across every writer's names,
+including the regression stack's `framework-*`/`regression-*` wrappers and
+the pre-PID legacy formats the original pruner couldn't see; files touched
+within 24h are never pruned (a live session may be appending). Deleting
+`.bos/logs/*.log` by hand is always safe too. The regression caches are safe
+to wipe whenever fixtures drift: the next run re-seeds them. Anything else
+under `.bos/` (`session.json`, `sync-backup/`) is state you regenerate by
+re-running the responsible command — when a surface feels stale, regenerate
+it in place rather than editing it. `.bos/` is local-only runtime state
+(ADR 0047): the only committed artifact is `bos.lock.json`.
 
 ## Where source actually lives
 

docs/agents/testing.md

@@ -35,6 +35,29 @@ seed module is the fix, tracked at retro 2026-10-24.
 | **Integration** — the real oRPC router in-process, auth context injected via headers, DAO checks mocked | `api/tests/integration` | contract behavior: who may do what to which resource, error shapes, transactions |
 | **Regression** — the full composed `bos dev` stack, real browser, real remote auth UI | `tests/regression/browser/specs` | rendered journeys: sessions, SSR/CSR compose, navigation, admin flows |
 
+## When each tier runs
+
+The matrix runs exactly where a decision is made — never everywhere:
+
+| Tier | Where | What runs | Wall time |
+|---|---|---|---|
+| **T0 local** | lefthook hooks (`lefthook.yml`, installed by `pnpm run prepare`) | pre-commit: Biome on staged files · pre-push: `typecheck` + `lint:effect` | seconds |
+| **T1 PR** | `ci.yml` on pull requests | lint/typecheck, path-gated unit suites, ui-only app-load smoke; slow stack suites skip | ~4 min |
+| **T2 gate** | `release.yml` before every npm publish | unit + start regression (parallel planes — `tier: release`) | ~15–20 min |
+| **T2 nightly** | nightly on the main tip (`backcompat-nightly.yml`) via `regression-full.yml` (`tier: nightly`) | the full matrix: unit + dev + start + backcompat + framework, parallel planes (backcompat mode currently broken at boot — see AGENTS.md) | ~25 min |
+
+The gate proves the production artifact (start) and the published-chain
+contract (backcompat). The dev and framework planes pin the `bos dev`
+machinery (source-mode dev server, process death) — app-code changes cannot
+break them, and the start plane's full suite already covers their user
+journeys — so they canary nightly instead of gating every publish.
+
+The slow suites (HTTP stacks, sharded browser matrix, process-death framework
+regression) live in `ci.yml` as `workflow_dispatch`-only jobs for triage, and
+run for real only in T2. Consequence to accept: a journey broken by a UI PR
+surfaces at the nightly (~24h bound) or at the release gate — whichever comes
+first — not on the PR itself.
+
 Choose the lowest layer that pins the behavior. Escalate when the failure you
 are preventing only materializes one layer up (cookie handling, hydration,
 loading states, module loading are things jsdom cannot even reproduce).
@@ -50,6 +73,18 @@ look in `node_modules`):
 - SSR/client construction parity, digest computation, compose-payload schema
   checks, degrade-to-core-only semantics
 - the framework's client machinery: session refresh, MF loader retry chains
+- **the verification spine** ([ADR 0046](../adr/0046-manifest-attribution.md),
+  `GLOSSARY.md` — "verification spine"): each suite pins one layer, so
+  verification regressions have an address —
+
+| Spine layer | Suite (`packages/everything-dev/tests/unit`) | What it pins |
+|---|---|---|
+| bytes ↔ digest | `verify-engine.test.ts` | the `Verifier` engine: SRI fetches, `Verified<T>` branding, the digest cache, the tagged errors |
+| config → manifest → files | `verify-chain.test.ts` | the walker's three depths and per-leg reporting (`pointer`/`entries`/`files`) |
+| config → manifest → files | `manifest-signature.test.ts` | attribution: signing, unregistered keys, rotation, tampered documents, every-depth failure |
+| composition identities | `digest-identity.test.ts` | pointer vs deployment digests and their documented relation |
+| served bytes in the MF pipeline | `federation-integrity.test.ts` | the #642 gate: the loader verifies every registered byte at fetch time |
+| identity wiring | `boot-snapshot-schema.test.ts` · `composition-lockfile-schema.test.ts` | the stored-state planes recomputing `pointerDigest` |
 
 Prove claims about *your* composition state without re-testing the engine:
 `pnpm run verify:runtime-map` diff-checks the generated map against the real

package.json

@@ -40,9 +40,6 @@
     "test:integration-guide": "pnpm --dir api test tests/integration/activity-client-example.test.ts",
     "test:activity": "pnpm run dev:activity-infra && ACTIVITY_INTEGRATION=1 pnpm --dir api test tests/integration/activity-boundary.test.ts",
     "benchmark:leaderboard": "pnpm run dev:activity-infra && tsx api/benchmarks/activity-leaderboard.ts",
-    "dev:postgres": "docker compose up -d --wait && pnpm run dev",
-    "dev:postgres:down": "docker compose down",
-    "dev:postgres:reset": "docker compose down -v && docker compose up -d --wait",
     "db:doctor": "bos db:doctor",
     "db:repair": "bos db:repair",
     "test:scripts": "vitest run scripts"
@@ -63,10 +60,11 @@
     "vitest": "catalog:",
     "yaml": "catalog:",
     "@effect/tsgo": "^0.63.0",
-    "@playwright/test": "^1.58.1",
+    "@playwright/test": "^1.65.0",
     "@shadcn/lint": "^0.2.0",
     "oxlint": "1.90.0",
-    "oxlint-tsgolint": "7.0.2005"
+    "oxlint-tsgolint": "7.0.2005",
+    "lefthook": "^2.2.2"
   },
   "dependencies": {
     "@better-auth/api-key": "catalog:",