@bongos/core 1.17.0 → 1.17.1

package/modules/grading/CLAUDE.md

@@ -1,42 +1,15 @@
-# `grading` module — the grade-a-diff adversarial panel + the `grade` kernel port
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> The **second CORE-domain** carved into a module (BV1.R73, [ADR 0091](../../docs/adr/<redacted>.md) §1+§4) — after memory (R72). It is the carve that proves ADR 0091 §4's load-bearing pattern: **keep the lifecycle state machine whole, extract the capability it invokes behind a kernel seam.** The lifecycle no longer imports the grader directly; it resolves a `grade` PORT this module registers.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns the **quality gate**: the v4 adversarial worker panel (Narc / Quality / Hacker / Efficiency, unanimous-PASS), the deterministic pre-passes (route-rank + permission-path, run as panel inputs), and the scoring **rubric**. `default: true` in `module.json` — every instance grades its own ships, so it mounts unconditionally unless explicitly disabled.
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-## The boundary (the one rule)
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-This module reaches core **only** through the published doorway `../../src/module-api.js` (`coreVersion ^1.6.0` — it needs the R73 doorway additions: `routeRankCheck`, `permissionPathCheck`, `llmCache`). It must **never** `require()` a core internal directly, and never another module. Core, in turn, must never `require()` a file in here — it reaches grading only through the `grade` port (below). Both directions are enforced by the BV1.R44/R45 fitness checks; R70's `kernel-imports-no-domain` check keeps the kernel from reaching back in.
-
-## The `grade` kernel PORT (ADR 0091 §4 — the headline of this carve)
-
-- **Provides — port `grade`** → the grader module surface. Registered in `routes/grade.js`'s factory (the loader runs it at boot, and again whenever a test rebuilds the GDS router — `hasProvider`-guarded so re-instantiation never trips the single-provider duplicate guard).
-- **Core consumes it WITHOUT importing this module:**
-  - `routes/tasks.js` (the LIFECYCLE ship path, `POST /tasks/:id/grade`) resolves it via `seams.resolveOptional('grade')` and calls `grade.validateAndScore(...)` then `grade.serverSideGuards(...)`. A grading-disabled instance gets a clean `503 grading_unavailable` instead of a thrown `resolve()`.
-  - `routes/public.js` (`GET /public/grades`) resolves it the same way and reads `grade.RUBRIC.{threshold,version}`, falling back to `null` when grading is off.
-- This replaced the former `const grader = require('../grader')` core→domain import in both files — the edge ADR 0091 §4 set out to sever.
-
-Why a route factory for a module with **no HTTP routes**: `mountModuleRoutes` is the only loader hook that runs both in the live server and when a test rebuilds the GDS router, so it's where the port registration belongs. The factory returns an empty `express.Router()` purely as the mount vehicle.
-
-## Files
-
-| File | What |
-|---|---|
-| `grader.js` | the quality gate (~86 KB): v4 adversarial panel + `validateAndScore`/`serverSideGuards`/`gradeSubagent`/`RUBRIC`. The deterministic pre-passes reach `routeRankCheck`/`permissionPathCheck` through the doorway; `runSubagentCached` wraps spawns in the doorway's `llmCache`. |
-| `grader-workers/` | the four worker modules (`narc`/`quality`/`hacker`/`efficiency`) + shared kit (`fence`, `worker-prompt`, `worker-verdict`, `rubric`, `extract-json`, `index`). All intra-module relative requires — unchanged by the move. |
-| `grader-rubric.json` | the single-source scoring rubric (thresholds, per-worker config). Read by `grader.js` + `grader-workers/rubric.js` via `__dirname`-relative paths — survives the move. |
-| `routes/grade.js` | registers the `grade` port (above); no HTTP endpoint. |
-
-## NOT in this module (deliberately left in core)
-
-- **`cascade-dispatch.js`** — stays in `src/bongos/`. It is dormant System 3 (model-tier dispatch, `OTB_AUTONOMY_ENABLED`-gated; nothing calls it but its mock unit test), and its real dependencies are core `task-classifier` (lifecycle) + `skill-prefs` (builder-settings), **not** the grader (the grader is an injected `runner`, never imported). Moving it would force two gratuitous doorway domain-leaks (`classifyTaskKind`, `skill-prefs.getForBuilder`) for capabilities grading never uses — the "ceremony with no boundary benefit" ADR 0091 §Alternatives rejects. It stays a core lib (scoped to `grading` in `module-scope-map.js`) until autonomy/dispatch is carved (tranche 2). The grading scope-map glob lists it as a core file, not part of this dir.
-- **`scripts/gds/grade-smoke.js`** + the other grading-owned CLIs — a command travels with its domain but stays under `scripts/gds/` (the memory-carve precedent). They `require('../../modules/grading/grader')`.
-- **`llm-cache.js`** — shared LLM-cost infra core also uses (`routes/llm-cache.js`, the cost scripts); it stays core and is exposed to this module on the doorway as `api.llmCache` (a tracked R70 leak).
-
-## Tables
-
-None owned. The grade-attempt rows (`grades`, `grade_attempts`, …) are written by core `db.applyGrade` on the lifecycle side; grading only computes the verdict the route then persists. No `modules/grading/migrations/` yet.
-
-## Tests
-
-`tests/grader.mjs`, `tests/grader_panel.mjs`, `tests/grader_prompt_fencing.mjs`, `tests/grade_server_authoritative.mjs`, `tests/grade_unavailable_display.mjs` import from `modules/grading/…`. `tests/cascade-dispatch.mjs` still imports `src/bongos/cascade-dispatch.js` (it stayed core). `scripts/gds/grade-smoke.js` is the live panel smoke.
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/hall-ui/CLAUDE.md

@@ -1,61 +1,15 @@
-# `hall-ui` module — the authenticated builders' hall
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> A CORE-domain carve (BV1.R85, [ADR 0093](../../docs/adr/<redacted>.md) §1) — the **second WEB-SURFACE module** ([02-module-map §6](../../docs/design/modular-architecture/02-module-map.md): "a web surface is first-class"), after status-UI (BV1.R84), and the **largest** (~13k LOC). `default: true` — a Cloud Bongos instance ships its hall like it ships its status page, so it mounts unconditionally unless an instance disables it.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns the authenticated builders' hall served at **`builders.<apex>`** (`builders.example.com`) — the roster, the Work Board, standing/karma, the leaderboard, achievements, the citizen's primer, the system maps, the Repo Atlas, Settings, the dev-box pair page, and the Archon-only watch/harbor/gate pages. A no-framework single-page surface (`builders.js` + per-page `*.js`) that polls `/api/gds/*` and the read-only `/api/gds/public/*` surface (live updates ride the SSE channel, `routes/live.js`).
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-## The shape: a static surface, but with DEDICATED serving (the difference from status-UI)
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-Like status-UI this module has **no `.js` backend, no `db.js` slice, no kernel port, and no routes**. It is purely:
-- `public/` — the static hall (HTML/CSS/JS/cursors/chime.wav), moved verbatim from the old repo-root `public-builders/`.
-- `module.json` — declares one **`contributes.webSurfaces`** entry `{ host: "builders.", dir: "public" }`.
-
-**But the hall is NOT served by the generic web-surface loop that serves status-UI.** The status page is a plain static surface; the hall has far richer serving that MUST be byte-identical:
-- the apex `/builders/*` tree + the `builders.<apex>` subdomain **rewrite shim** (#726),
-- the **canonical-URL redirects** (#744: `/builders/ranks` → `/ranks` on the subdomain; #739: apex `/builders/*` → `builders.<apex>`),
-- the **citizen/Archon page gates** (#488/#770: primer, diagrams, work, pair, settings, atlas are sign-in-gated; watch, harbor, gate are Archon-only — the real curl-proof access control),
-- per-page **asset-stamping** (#521 content-hash `?v=`),
-- the **module hall-widget injection** (BV1.R75 — `injectModuleHallWidgets`),
-- the diagram PNG + `primer.md` static mounts.
-
-So the manifest `webSurfaces` declaration is the **discovery + scope-map + `window.__MODULES__` record**; the bytes are served by the hall's dedicated block in `serve-internal.js`.
-
-## The serving seam (how the hall keeps its dedicated block + is still a module)
-
-`src/bongos/serve-internal.js` resolves `loader.moduleWebSurfaces({ isEnabled })` — the same seam status-UI uses — but **PARTITIONS the hall out** of the generic static loop on the builders-host predicate (`isBuildersHost`), so:
-- the **generic loop** owns every web surface EXCEPT the hall (status-UI today),
-- the hall's **dedicated block** owns the builders host and reads from `BUILDERS_DIR = modules/hall-ui/public/`.
-
-The filter is on the **host** (`isBuildersHost`), not the `"hall-ui"` key, so the kernel still names no module key ([ADR 0083](../../docs/adr/<redacted>.md) §Decision #4). `isModuleSurfaceHost` (which the dedicated `/builders` guards use to skip the GENERIC status surface) therefore deliberately EXCLUDES the builders host — the dedicated block is what serves it, so it must not self-skip.
-
-## The boundary
-
-This module reaches **nothing** in core (no doorway require — it has no JS the server requires; `builders.js` etc. are browser code). Core, in turn, must never `require()` a file in here — `serve-internal.js` resolves the surface through `loader.moduleWebSurfaces`/`BUILDERS_DIR`, never an import of `modules/hall-ui/*`. Both directions are enforced by the BV1.R44/R45 fitness checks.
-
-## The data it renders STAYS shared core (the judgment call)
-
-The `/api/gds/me`, `/api/gds/public/*`, and `/api/gds/leaderboard` read endpoints the hall polls **did not move** — they live in `src/bongos/routes/{me,public,builders}.js` and are consumed by the status surface and the off-box mirror too, not just this hall. A read shared by multiple surfaces is correctly core/shared, not hall-exclusive (the same call status-UI / economy / ideas made). So the carve moves the *surface*, not the reads it happens to render.
-
-## The hall-widget registry (BV1.R75)
-
-The hall's `<main>` is filled from a **registry** (`public/dom-utils.js` `contributeHallWidget`; the core set in `public/hall-widgets.js`; a module's own client script otherwise). No widget may be hardcoded as a literal `<section class="scroll">` in `index.html` — a fitness check (`scripts/gds/fitness.js`, `HALL_INDEX` now points at `modules/hall-ui/public/index.html`) reds the build if one creeps back. Module-contributed hall widgets are injected via `serve-internal.js`'s `injectModuleHallWidgets` (the `hallWidgetScripts` loader seam), served at `/modules/<key>/public/hall-widget.js`. (Known pre-existing limitation, idea #465: that asset path 404s on the builders *subdomain* because the rewrite shim shadows it — injection works on both hosts; serving works on the apex. No module ships a hall-widget today so it's a live no-op.)
-
-## Files & tooling
-
-| Path | What |
-|---|---|
-| `public/index.html` · `public/builders.js` · `public/style.css` | the hall shell + core script + stylesheet (no build step, no framework) |
-| `public/{work,roadmap,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,not-ready}.{html,js}` | the per-page surfaces |
-| `public/task.html` + `public/task.js` | the task-detail page (`/task/:id`, task 751) — a real, shareable page that replaced the old `#/task/N` overlay. Irregular routing: `serve-internal.js`'s `TASK_DETAIL_PAGE_RE` resolves the two-segment `/builders/task/:id` path to this one file (every other page is a single-segment slug). (The old read-only Task Board twin `board.html`/`board.js` was removed in task 1965 — `/board` now 301s to `/work`.) |
-| `public/goals.html` + `public/goals-page.js` | the Goals page (irregular basename — `goals.js` is the index's Goals hall-widget) |
-| `public/dom-utils.js` · `public/hall-widgets.js` | the hall-widget + settings-panel registries (browser IIFEs) |
-| `public/instances-panel.js` | the "Instances" hall widget (provisioning module, [ADR 0111](../../docs/adr/<redacted>.md) §1, task 1947) — self-registers **gated on `module:'provisioning'`** (`contributeHallWidget` drops it when the module is off); a self-fetching widget (the `goals.js` pattern) that reads the P1 `/provisioning/*` routes and renders own instances always + the Archon fleet + cost-ledger total when `/me` is `archon`. Read/state only. |
-| `public/new-project-wizard.js` | the "Start a project" hall widget (provisioning module, [ADR 0111](../../docs/adr/<redacted>.md) / goal 35, task 1983) — the **CREATE** flow the instances-panel deferred: the most accessible form of the canonical onboarding runbook (the `/new-project` skill task 1981 + `bongos onboard` CLI task 1982). Same `module:'provisioning'` gating; a form that files a **standalone** provisioning request (`POST /provisioning/instances` — the web tier only ENQUEUES, trust boundary intact) then renders the irreducibly-human steps UI-first (create repo, OAuth app with the pinned apex callback, first sign-in) + points at the Instances panel for status. |
-| `public/cursors/` · `public/chime.wav` | bronze cursors + the volume-slider preview chime |
-| `module.json` | `contributes.webSurfaces: [{ host: "builders.", dir: "public" }]`; no port, no routes |
-
-Generators that WRITE into this surface live under `scripts/` and were re-pointed at `modules/hall-ui/public/`: `scripts/gds/gen-atlas.js` (the `atlas.json` Repo Atlas data, gitignored — regenerated on deploy), `scripts/art/gen-cursors.py` (cursors), `.claude/sounds/generate.js` (the chime mirror).
-
-## Tests
-
-The loader seam is covered in `tests/module_loader.mjs` (`moduleWebSurfaces` + the live hall-ui surface); the manifest `webSurfaces` validation in `tests/module_manifest.mjs`; the carve discovery-key membership in `tests/fitness.mjs` / `tests/module_loader.mjs` / `tests/modules.mjs`; the browser settings-panel seam in `tests/module_contributions.mjs` (reads `public/dom-utils.js`); the Repo Atlas renderer contract in `tests/atlas.mjs`; and the carve proof in `scripts/gds/coreB-carve-proof.sh` (leg 4i).
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/hall-ui/public/goals-page.js

@@ -94,6 +94,13 @@
       todo: { page: 1, perPage: loadPerPageFor(WORK_PER_PAGE_KEY.todo) },
       done: { page: 1, perPage: loadPerPageFor(WORK_PER_PAGE_KEY.done) },
     },
+    // task 1953 — private goals: my own pending join-request on the OPEN goal (row
+    // from GET /goals/inbox's myPendingRequests, filtered to this goal), or null.
+    myPendingRequest: null,
+    // task 1953 — the open goal's own pending invite/join-request queue (manager
+    // view, GET /goals/:id/requests), or null while loading / on error / not a
+    // manager. Feature-detected: an older server 404s and the panel just stays hidden.
+    pendingRequests: null,
   };
 
   async function getJSON(path) {
@@ -112,6 +119,13 @@
     if (!res.ok) { const e = new Error(`${path} → ${res.status}`); e.status = res.status; e.data = data; throw e; }
     return data;
   }
+  // task 1953 — the visibility toggle is the only PATCH this page makes.
+  async function patchJSON(path, body) {
+    const res = await api.request('PATCH', path, { body: body || {} });
+    const data = res.data || {};
+    if (!res.ok) { const e = new Error(`${path} → ${res.status}`); e.status = res.status; e.data = data; throw e; }
+    return data;
+  }
 
   const curLabel = () => window.OTBBranding?.currencyLabel?.() ?? 'credits';
   // task 1957 — a task's drachmae is an ESTIMATE until it SETTLES (confirmed/
@@ -857,38 +871,74 @@
       const depsSpan = deps.length
         ? `<span class="goal-deps${(g.status === 'open' && unmet.length) ? ' goal-deps--blocked' : ''}" title="This goal is blocked until each prerequisite goal is achieved">${(g.status === 'open' && unmet.length) ? '🔒 ' : ''}depends on: ${deps.map((dep) => `${escapeHtml(dep.title || ('goal ' + dep.id))} ${dep.satisfied ? '✓' : '○'}`).join(', ')}</span>`
         : '';
-      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${scope} ${depsSpan}`;
+      // task 1953 — a private goal is join-GATED, not hidden, so the lock badge is
+      // informational for every viewer (the toggle that flips it lives in Actions,
+      // manager-only).
+      const lockSpan = g.visibility === 'private'
+        ? '<span class="goal-badge goal-badge--locked" title="Private — join is by invitation or an approved request">🔒 Private</span>' : '';
+      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${lockSpan} ${scope} ${depsSpan}`;
     }
 
-    const actions = $('#goal-detail-actions');
-    if (actions) {
-      actions.innerHTML = g.status === 'open'
-        ? (joined
-          ? '<button class="btn-ghost" id="goal-leave-btn" type="button">Leave goal</button>'
-          : '<button class="landing__btn" id="goal-join-btn" type="button">Join goal</button>')
-        : '';
-      $('#goal-join-btn')?.addEventListener('click', () => joinLeave(g.id, 'join'));
-      $('#goal-leave-btn')?.addEventListener('click', () => joinLeave(g.id, 'leave'));
-    }
+    // task 1762: the goal's own owner/manager (or an Archon) can invite/manage
+    // without an Archon in the loop — mirrors the server's authorizeGoalManagement
+    // gate. A protected-scope goal stays Archon-only on the SERVER (goals.js);
+    // this client gate deliberately doesn't re-derive the protected-module list
+    // (that roster lives server-side only, module-scope-map.js) — a non-Archon
+    // owner/manager sees the control on a protected-scope goal and gets a clear
+    // toast if the server 403s (see inviteMember's error handling below).
+    const isOwner = sameId(g.created_by, selfId());
+    const canManage = g.status === 'open' && (isArchon() || isOwner || iAmLead);
+    renderActions(g, { joined, canManage });
 
     // task 1828 — Completion + Members each render into their band column AND
     // their dedicated full view (capped in the band, "View all →" into the view).
     renderCompletion();
-    // task 1762: the goal's own owner/manager (or an Archon) can invite without
-    // an Archon in the loop — mirrors the server's authorizeGoalManagement gate.
-    // A protected-scope goal stays Archon-only on the SERVER (goals.js); this
-    // client gate deliberately doesn't re-derive the protected-module list (that
-    // roster lives server-side only, module-scope-map.js) — a non-Archon owner/
-    // manager sees the control on a protected-scope goal and gets a clear toast
-    // if the server 403s (see inviteMember's error handling below).
-    const isOwner = sameId(g.created_by, selfId());
-    const canInvite = g.status === 'open' && (isArchon() || isOwner || iAmLead);
-    renderInviteBox(g.id, canInvite, members);
+    renderInviteBox(g.id, canManage, members);
     renderMembers();
 
     loadGoalTasks(g.id);
+    // task 1953 — my own pending request (any viewer) + the goal's pending queue
+    // (managers only); async, re-renders Actions + the pending panel on arrival.
+    loadGoalMembership(g.id, canManage);
     void sat; void crit; // now read inside renderCompletion()
-    void iAmLead; // lead-only resolution actions arrive with tasks 1735/1736
+  }
+
+  // task 1953 — the goal-detail Actions row: Leave/Join (unchanged), a manager's
+  // Private/Public toggle (PATCH /goals/:id/visibility), and — for a non-member
+  // viewer of a PRIVATE goal — Request to join / Requested (withdraw) in place of
+  // Join (private goals are join-GATED: POST /goals/:id/join 409s goal_private for
+  // a non-Archon non-member). An Archon keeps the plain Join button: the server
+  // lets them self-join any goal regardless of visibility (POST /goals/:id/join),
+  // so "request" would be a pointless extra step for them.
+  function renderActions(g, { joined, canManage }) {
+    const actions = $('#goal-detail-actions');
+    if (!actions) return;
+    const parts = [];
+    if (canManage) {
+      const nextVisibility = g.visibility === 'private' ? 'public' : 'private';
+      const label = g.visibility === 'private' ? '🔒 Private — make public' : 'Make private';
+      parts.push(`<button class="btn-ghost" id="goal-visibility-btn" type="button" data-next-visibility="${escapeHtml(nextVisibility)}">${label}</button>`);
+    }
+    if (g.status === 'open') {
+      if (joined) {
+        parts.push('<button class="btn-ghost" id="goal-leave-btn" type="button">Leave goal</button>');
+      } else if (g.visibility === 'private' && !isArchon()) {
+        if (state.myPendingRequest) {
+          parts.push('<span class="role-pill" title="Awaiting the owner/manager\'s approval">Requested</span>');
+          parts.push('<button class="btn-ghost" id="goal-withdraw-btn" type="button">Withdraw</button>');
+        } else {
+          parts.push('<button class="btn-ghost" id="goal-request-btn" type="button">🔒 Request to join</button>');
+        }
+      } else {
+        parts.push('<button class="landing__btn" id="goal-join-btn" type="button">Join goal</button>');
+      }
+    }
+    actions.innerHTML = parts.join(' ');
+    $('#goal-join-btn')?.addEventListener('click', () => joinLeave(g.id, 'join'));
+    $('#goal-leave-btn')?.addEventListener('click', () => joinLeave(g.id, 'leave'));
+    $('#goal-visibility-btn')?.addEventListener('click', (e) => toggleVisibility(g.id, e.currentTarget.dataset.nextVisibility));
+    $('#goal-request-btn')?.addEventListener('click', () => requestToJoin(g.id));
+    $('#goal-withdraw-btn')?.addEventListener('click', () => withdrawRequest(g.id, state.myPendingRequest && state.myPendingRequest.id));
   }
 
   // task 1828 — the active-claim feed (all builders' in-flight claims) powers the
@@ -1056,12 +1106,153 @@
     } catch (err) {
       const code = err?.data?.error;
       if (code === 'archon_approval_required') toast('This goal is Archon-mediated — an Archon must add you.');
+      else if (code === 'goal_private') toast('This goal is private — request to join instead.');
       else if (code === 'not_a_member') toast('You are not a member of this goal.');
       else if (code === 'goal_not_open') toast('This goal is not open.');
       else toast(`Could not ${action} just now.`);
     }
   }
 
+  // task 1953 — a manager (or Archon) flips a goal public|private.
+  async function toggleVisibility(goalId, visibility) {
+    try {
+      await patchJSON(`${API}/goals/${encodeURIComponent(goalId)}/visibility`, { visibility });
+      toast(visibility === 'private' ? 'Goal is now private.' : 'Goal is now public.');
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+      renderList();
+    } catch (err) {
+      const code = err?.data?.error;
+      if (code === 'not_owner_or_manager') toast('Only this goal\'s owner or a manager (or an Archon) may do this.');
+      else if (code === 'goal_not_open') toast('Only an open goal can be managed.');
+      else toast('Could not update visibility just now.');
+    }
+  }
+
+  // task 1953 — a non-member asks to join a private (or protected) goal.
+  // renderDetail (below) re-derives canManage/joined and re-triggers
+  // loadGoalMembership, so a plain reload-and-rerender is enough here — same
+  // shape as joinLeave/inviteMember.
+  async function requestToJoin(goalId) {
+    try {
+      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/requests`, {});
+      toast('Request sent — the owner or a manager will review it.');
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+    } catch (err) {
+      const code = err?.data?.error;
+      if (code === 'request_pending') toast('You already have a pending request or invitation for this goal.');
+      else if (code === 'already_a_member') toast('You are already a member of this goal.');
+      else if (code === 'goal_is_open') toast('This goal is open — joining directly instead.');
+      else toast('Could not send the request just now.');
+    }
+  }
+
+  // task 1953 — withdraw MY OWN pending join-request (self-served, no manager needed).
+  async function withdrawRequest(goalId, reqId) {
+    if (reqId == null) return;
+    try {
+      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/requests/${encodeURIComponent(reqId)}/withdraw`, {});
+      toast('Request withdrawn.');
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+    } catch (err) {
+      toast((err && err.data && err.data.message) || 'Could not withdraw that request just now.');
+    }
+  }
+
+  // task 1953 — a manager approves/denies a pending join-request from the goal's
+  // own pending panel (mirrors the home-inbox action, POST …/requests/:reqId/respond).
+  const pendingActionsPending = new Set();
+  async function respondToJoinRequest(goalId, reqId, action, btn) {
+    const key = `respond:${reqId}`;
+    if (pendingActionsPending.has(key)) return;
+    pendingActionsPending.add(key);
+    if (btn) btn.disabled = true;
+    try {
+      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/requests/${encodeURIComponent(reqId)}/respond`, { action });
+      toast(action === 'approve' ? 'Approved — they’re now a member.' : 'Request denied.');
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+      renderList();
+    } catch (err) {
+      toast((err && err.data && err.data.message) || 'Could not resolve that request just now.');
+      if (btn) btn.disabled = false;
+    } finally {
+      pendingActionsPending.delete(key);
+    }
+  }
+
+  // task 1953 — every pending row on THIS goal, rendered for a manager: join
+  // requests get Approve/Deny; outstanding invites are informational (only the
+  // invitee can accept/decline theirs — the server has no manager-cancel route).
+  function pendingRequestWho(r) {
+    return r.display_name || (r.github_login ? `@${r.github_login}` : `builder #${r.builder_id}`);
+  }
+  function pendingRequestsHtml(rows) {
+    const requests = rows.filter((r) => r.kind === 'request');
+    const invites = rows.filter((r) => r.kind === 'invite');
+    const requestLi = (r) => `<li class="pending-row">
+        <span class="pending-row__who">${escapeHtml(pendingRequestWho(r))}</span>
+        ${r.note ? `<span class="pending-row__note">“${escapeHtml(r.note)}”</span>` : ''}
+        <span class="pending-row__actions">
+          <button class="btn-ghost" type="button" data-approve-req="${escapeHtml(String(r.id))}">Approve</button>
+          <button class="btn-ghost" type="button" data-deny-req="${escapeHtml(String(r.id))}">Deny</button>
+        </span>
+      </li>`;
+    const inviteLi = (r) => `<li class="pending-row">
+        <span class="pending-row__who">${escapeHtml(pendingRequestWho(r))}</span>
+        <span class="pending-row__note">invited — awaiting their response</span>
+      </li>`;
+    const parts = [];
+    if (requests.length) parts.push(`<div class="pending-group"><h3 class="pending-group__h">Join requests<span class="goal-count">${requests.length}</span></h3><ul class="pending-list">${requests.map(requestLi).join('')}</ul></div>`);
+    if (invites.length) parts.push(`<div class="pending-group"><h3 class="pending-group__h">Pending invitations<span class="goal-count">${invites.length}</span></h3><ul class="pending-list">${invites.map(inviteLi).join('')}</ul></div>`);
+    return parts.join('');
+  }
+  function renderPendingRequests() {
+    const box = $('#goal-pending');
+    if (!box) return;
+    const rows = state.pendingRequests;
+    if (!rows || !rows.length) { box.hidden = true; box.innerHTML = ''; return; }
+    box.hidden = false;
+    box.innerHTML = pendingRequestsHtml(rows);
+  }
+
+  // task 1953 — async membership-queue load, kicked off (fire-and-forget) from
+  // renderDetail like loadGoalTasks: my own pending request on this goal (any
+  // viewer, from GET /goals/inbox's myPendingRequests) + — for a manager — the
+  // goal's own pending queue (GET /goals/:id/requests, task 1953's new route).
+  // Feature-detected the way the conflicts panel 404-detects the server-side
+  // detector: an older server (or a non-manager 403) just hides the panel.
+  async function loadGoalMembership(goalId, canManage) {
+    try {
+      const inbox = await getJSON(`${API}/goals/inbox`);
+      if (!sameId(state.current, goalId)) return;
+      state.myPendingRequest = (inbox.myPendingRequests || []).find((r) => sameId(r.goal_id, goalId)) || null;
+    } catch (err) {
+      if (err && err.message === 'redirecting to auth') return;
+      if (!sameId(state.current, goalId)) return;
+      state.myPendingRequest = null;
+    }
+    if (canManage) {
+      try {
+        const r = await getJSON(`${API}/goals/${encodeURIComponent(goalId)}/requests`);
+        if (!sameId(state.current, goalId)) return;
+        state.pendingRequests = r.requests || [];
+      } catch (err) {
+        if (err && err.message === 'redirecting to auth') return;
+        if (!sameId(state.current, goalId)) return;
+        state.pendingRequests = null;
+      }
+    } else {
+      state.pendingRequests = null;
+    }
+    if (!sameId(state.current, goalId)) return;
+    renderPendingRequests();
+    const d = currentDetail();
+    if (d) renderActions(d.goal, { joined: (d.members || []).some((m) => sameId(m.builder_id, selfId())), canManage });
+  }
+
   /* ---------------- data + routing ---------------- */
 
   async function loadDetail(goalId, { force = false } = {}) {
@@ -1084,6 +1275,12 @@
     state.claimsByTask = new Map();
     state.conflictPairs = null;
     state.conflictSource = null;
+    // task 1953 — a freshly opened goal starts with no known membership-queue
+    // state; loadGoalMembership (kicked off from renderDetail) fills it in.
+    state.myPendingRequest = null;
+    state.pendingRequests = null;
+    const pending = $('#goal-pending');
+    if (pending) { pending.hidden = true; pending.innerHTML = ''; }
     setWorkTab('todo');
     ['#goal-todo-count', '#goal-done-count', '#goal-conflicts-count', '#goal-conflicts-view-count',
       '#goal-members-count', '#goal-members-view-count', '#goal-completion-count'].forEach((sel) => {
@@ -1290,6 +1487,14 @@
       if (row && row.dataset.taskId && window.OTBTaskDetail) window.OTBTaskDetail.open(row.dataset.taskId);
     });
   });
+  // task 1953 — Approve/Deny on the goal's own pending-requests panel.
+  $('#goal-pending')?.addEventListener('click', (e) => {
+    if (state.current == null) return;
+    const approveBtn = e.target.closest('[data-approve-req]');
+    if (approveBtn) { respondToJoinRequest(state.current, approveBtn.dataset.approveReq, 'approve', approveBtn); return; }
+    const denyBtn = e.target.closest('[data-deny-req]');
+    if (denyBtn) { respondToJoinRequest(state.current, denyBtn.dataset.denyReq, 'deny', denyBtn); return; }
+  });
   window.addEventListener('hashchange', route);
   wireDragReorder();
 

package/modules/hall-ui/public/goals.html

@@ -150,6 +150,18 @@
     .goal-invite__form { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
     .goal-invite__form select#goal-invite-builder { flex: 1; min-width: 180px; }
 
+    /* task 1953 — private goals: the lock badge (meta line) + the goal's own
+       pending invite/join-request queue (manager view, next to the invite box). */
+    .goal-badge--locked { background: var(--warn-weak); color: var(--warn); }
+    .goal-pending { margin: 4px 0 10px; display: flex; flex-direction: column; gap: 10px; }
+    .pending-group__h { font-size: 12px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.02em; color: var(--ink-faint); margin: 0 0 4px; display: flex; align-items: center; gap: 6px; }
+    .pending-list { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; }
+    .pending-row { display: flex; align-items: center; gap: 8px; padding: 6px 0; border-bottom: 1px solid var(--rule-soft); font-size: 13px; flex-wrap: wrap; }
+    .pending-row:last-child { border-bottom: none; }
+    .pending-row__who { font-weight: 600; }
+    .pending-row__note { color: var(--ink-faint); font-size: 12px; flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+    .pending-row__actions { display: flex; gap: 6px; margin-left: auto; }
+
     .conflict { border: 1px solid color-mix(in srgb, var(--warn) 30%, var(--border)); background: var(--warn-weak); border-radius: var(--radius-sm); padding: 10px 14px; font-size: 13px; margin: 10px 0 0; }
     .conflict__pair { font-weight: 600; }
     .conflict__paths { font-family: ui-monospace, "SF Mono", Menlo, Consolas, monospace; font-size: 11.5px; color: var(--ink-soft); margin-top: 4px; word-break: break-all; }
@@ -246,6 +258,10 @@
               <h2 class="scroll__h">Members<span class="goal-count" id="goal-members-count" hidden></span></h2>
               <p class="scroll__lede" id="goal-members-lede"></p>
               <div class="goal-invite" id="goal-invite" hidden></div>
+              <!-- task 1953 — the goal's own pending invite/join-request queue
+                   (manager view; feature-detected, hidden on an older server or
+                   when the viewer isn't owner/manager/Archon). -->
+              <div class="goal-pending" id="goal-pending" hidden></div>
               <ul class="member-list" id="goal-members"></ul>
               <div class="goal-col__foot" id="goal-members-foot" hidden></div>
             </div>

package/modules/hall-ui/public/new-project-wizard.js

@@ -74,11 +74,11 @@
     const oa = domain ? oauthAppValues(domain) : null;
     const dnsNote = domain ? '' : '<li>Add a domain you own, then re-run to wire the address (a domain is needed before sign-in works).</li>';
     const repoStep = adopt
-      ? `<li><strong>Layer onto your existing repo</strong> — in your repo run <code>bongos init --adopt</code>. It shows a conflict pre-flight (migrations, CI, protected paths) and writes <em>nothing</em> until you accept; it never overwrites your files, and it imports your existing backlog (GitHub issues / a TODO/ROADMAP file). Commit + push.</li>`
-      : '<li><strong>Create the empty GitHub repo</strong> — github.com → New repository, leave it empty.</li>';
+      ? `<li data-onboard-step="github-repo"><strong>Layer onto your existing repo</strong> — in your repo run <code>bongos init --adopt</code>. It shows a conflict pre-flight (migrations, CI, protected paths) and writes <em>nothing</em> until you accept; it never overwrites your files, and it imports your existing backlog (GitHub issues / a TODO/ROADMAP file). Commit + push.</li>`
+      : '<li data-onboard-step="github-repo"><strong>Create the empty GitHub repo</strong> — github.com → New repository, leave it empty.</li>';
     // The one-click GitHub sign-in step + a collapsible manual fallback (only when a
     // domain is set — the App needs a real callback host).
-    const signInStep = oa ? `<li><strong>Set up GitHub sign-in — one click</strong>. We’ll open GitHub with a pre-filled app; approve it, and we place the credentials on your instance automatically (no secret to copy).
+    const signInStep = oa ? `<li data-onboard-step="oauth-app"><strong>Set up GitHub sign-in — one click</strong>. We’ll open GitHub with a pre-filled app; approve it, and we place the credentials on your instance automatically (no secret to copy).
         <div class="np-signin-actions">
           <button id="np-github-app" type="button" class="np-create-btn" data-instance="${escapeHtml(String(instanceId))}">Set up GitHub sign-in</button>
           <span id="np-github-app-msg" class="ledger__note"></span>
@@ -88,6 +88,7 @@
             <li><strong>Create the GitHub OAuth app</strong> — GitHub → <em>your account's</em> Settings → Developer settings → OAuth Apps → New OAuth App.
               <div class="np-kv"><span>Homepage URL</span><code>${escapeHtml(oa.homepageUrl)}</code></div>
               <div class="np-kv"><span>Authorization callback URL</span><code>${escapeHtml(oa.callbackUrl)}</code></div>
+              <div class="np-kv"><span>Enable Device Flow</span><code>✅ required — the terminal login uses it (off by default)</code></div>
             </li>
             <li><strong>Place the secret — verified</strong> (never hand-edit the env file): on the control plane run
               <code>bongos … oauth-secret place ${escapeHtml(slug)} --client-id &lt;id&gt; --client-secret &lt;secret&gt; --apply</code>.</li>
@@ -101,7 +102,7 @@
         ${repoStep}
         ${dnsNote}
         ${signInStep}
-        ${oa ? `<li><strong>First sign-in</strong> — once the instance is live, open <code>${escapeHtml(oa.homepageUrl)}</code> and sign in with GitHub; that makes you the owner (Archon).</li>
+        ${oa ? `<li data-onboard-step="first-sign-in"><strong>First sign-in</strong> — once the instance is live, open <code>${escapeHtml(oa.homepageUrl)}</code> and sign in with GitHub; that makes you the owner (Archon).</li>
         <li><strong>Verify</strong> — <code>${escapeHtml(oa.homepageUrl)}/healthz</code> should report <code>auth_configured: true</code>.</li>` : ''}
       </ol>
       <p class="ledger__note">This is the same sequence the <code>/new-project</code> assistant and <code>bongos onboard</code> use.</p>

package/modules/ideas/CLAUDE.md

@@ -1,37 +1,15 @@
-# `ideas` module — the idea inbox + blockers + the `ideas.capture` kernel port
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> The **fourth CORE-domain** carved into a module (BV1.R78, [ADR 0093](../../docs/adr/<redacted>.md) §1) — after memory (R72), grading (R73), and economy (R77). A clean, self-contained slice: its SQL already lived in dedicated `inbox.js`/`blockers.js` files (not the `db.js` monolith), so the carve is a move + a doorway re-point, OTB byte-identical. `default: true` in `module.json` — every instance captures ideas and tracks what's stuck on its owner, so it mounts unconditionally unless explicitly disabled.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns the **methodology intake surfaces** that feed the backlog: the `idea_inbox` (free-form capture → triage → promote/discard/merge, plus the Metic-proposes / Archon-ratifies `criterion-proposal` flow that writes `done_when_criteria`), and the `blockers` queue (a thing stuck on a human; resolving one auto-promotes its linked `blocked` tasks via a DB trigger).
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-## The boundary (the one rule)
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-This module reaches core **only** through the published doorway `../../src/module-api.js` (`coreVersion ^1.8.0` — it needs the R78 doorway addition `parseId`, the route-param validator alongside `validateOrRespond`/`LIMITS`). It must **never** `require()` a core internal directly, and never another module. Core, in turn, must never `require()` a file in here — it reaches ideas only through the `ideas.capture` port (below). Both directions are enforced by the BV1.R44/R45 fitness checks.
-
-## The `ideas.capture` kernel PORT (ADR 0093 §5 — the headline of this carve)
-
-- **Provides — port `ideas.capture`** → `inbox.captureIdea`. Registered in `routes/inbox.js`'s factory (the loader runs it at boot, and again whenever a test rebuilds the GDS router — `hasProvider`-guarded so re-instantiation never trips the single-provider duplicate guard). Mirrors `modules/economy/routes/reward.js` (a capability registered from a route factory).
-- **It retires the `captureIdea` doorway leak.** ADR 0091 §3 parked `captureIdea` on `src/module-api.js` as a temporary "domain-leak-pending-carve" because the ideas domain wasn't a module yet. This carve deletes that re-export; the discord `#ideas` inbound (`modules/discord/discord-inbound.js`, the **sole** consumer) now resolves `ideas.capture` at call time instead of importing the doorway helper. This is the codebase's **first module→module port** (every prior port is consumed by core); discord declares it in `consumes`.
-- **Why a verb-noun port, not a doorway re-export:** the same reason `grade`/`reward` are ports — a module capability another module invokes goes behind the kernel switchboard, never a direct import (ADR 0091 §4).
-
-## Files
-
-| File | What |
-|---|---|
-| `inbox.js` | the `idea_inbox` domain: `captureIdea` (the port provider) + the keyword `classify` fallback, `listOpenIdeas`/`getIdea`/`countOpenIdeas` (with the V3.R70 skill-friction rank-visibility gate), `updateIdea`, and the `ratifyCriterionProposal` transaction (criterion-proposal → `done_when_criteria` + `karma_log` + `criterion_proposal_audit`, all in one `pool.connect()` tx). Reaches the shared pool through the doorway. |
-| `blockers.js` | the `blockers` domain: `listOpenBlockers`/`getBlocker`/`createBlocker`/`resolveBlocker`/`linkBlockerToTask`. `resolveBlocker` relies on the DB trigger on `blockers.status` to auto-promote linked `blocked` tasks. |
-| `routes/inbox.js` | `POST/GET /inbox`, `GET /inbox/:id`, `PATCH /inbox/:id` (Metic+ triage), `POST /inbox/:id/ratify` (Archon). Its factory **registers the `ideas.capture` port**. |
-| `routes/blockers.js` | `GET /blockers` (**public** — the status page reads it), `GET /blockers/:id`, `POST /blockers` (any builder files), `POST /blockers/:id/{resolve,link}` (Metic+). |
-
-## NOT in this module (deliberately left in core)
-
-- **The public idea/blocker projections** — `routes/public.js` (`projectPublicIdea`/`projectPublicBlocker`) reads `idea_inbox`/`blockers` with its **own** inline `pool.query` SELECTs (existence/ref checks for the hall's `#NNN` deep-link resolver + the public sitemap). Core querying a shared table with its own SQL is allowed; it does **not** import this module, so there is no vendored twin to keep in sync — the boundary is about code imports, not table access.
-- **The ideas/blockers CLIs** — `scripts/gds/{capture,triage,render-ideas}.js` travel with the domain but stay under `scripts/`; they now `require('../../modules/ideas/inbox')` (the economy/memory CLI precedent — `scripts/gds/autonomy-gate.js` does the same for its idea-inbox read).
-
-## Tables
-
-None owned. `idea_inbox`, `blockers`, `task_blockers`, `criterion_proposal_audit` (+ the `done_when_criteria`/`karma_log` rows the ratify tx touches) were created before the module system and stay in core `migrations/` (the `schema_migrations` stem-key makes a later relocation a no-op). The module owns the *queries*; any **new** ideas migration belongs in `modules/ideas/migrations/` namespaced `ideas_*` (the additive rule).
-
-## Tests
-
-`tests/criterion_proposal.mjs` imports `modules/ideas/inbox` (the ratify transaction). `tests/discord_inbound.mjs` exercises the consumer (it injects a stub `captureIdea` via dependency injection, so it never hits the real port). `tests/route_validation.mjs` exercises the inbox/blocker write-schemas via the dependency-free `validate()` helper (it imports `_helpers`, not these routes). The doorway-surface contract (`tests/module_api.mjs`) asserts `captureIdea` is **gone** and `parseId` is present. See ADR 0093.
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._