@bongos/core 1.19.102 → 1.19.104

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.102",
-  "core_contract": "1.19.102",
-  "source_commit": "484851c87018d5e1be475e9964f1215eaf50e4b1",
+  "core_version": "1.19.104",
+  "core_contract": "1.19.104",
+  "source_commit": "3c2a0481a031c30a0afdd9294b2510373ffe960f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-13T23:21:54.630Z",
+  "built_at": "2026-08-14T00:14:10.093Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 301,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1232,
+    "functional_verbatim": 1236,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1554,
-  "tree_sha256": "5858094e2d3e98c087659218b83067785b4a98e0ee29e6f26c06dc354d8eaeea",
+  "file_count": 1558,
+  "tree_sha256": "8257863293fa7660b41b1617777db22fadd851349106de278c846a482dd31a66",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3754,6 +3754,11 @@
       "mode": "0000644",
       "sha256": "b6eea95dbe66a3126fc2c73d93237cf38dd648a803e910eb88fbd5c780ccef62"
     },
+    {
+      "path": "modules/platform-identity/project-stats.js",
+      "mode": "0000644",
+      "sha256": "6ce71a9bd387a2b79d4c57a6669f028a807ef88ff205f65c20c55ce3d9889214"
+    },
     {
       "path": "modules/platform-identity/routes/my-projects.js",
       "mode": "0000644",
@@ -3762,7 +3767,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "33acce5b2f0c9ea9aef4a0d38f5245e56be4cd2756bc1d49129d5fadeb56a4a1"
+      "sha256": "188583ffb979d305c57a8f0958806ee0bd813007df158d74e45a0d415a3ff6aa"
     },
     {
       "path": "modules/platform-identity/routes/scouting.js",
@@ -4142,12 +4147,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c83bac76021e0d2fae2092fabdb4cd4614af07caf2dab896b07ff1ecbcdd1409"
+      "sha256": "ef0ed51dd00b72093c6deac7c061dc0fddf88b0135d2d1981c00d37cdb7a9345"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3d78882106612f2950816b2c7849605ae097a8a8b41fda1b6e1dc0e9d056bc96"
+      "sha256": "64f2fc25cfe4707562314bef85b1a22c3b3027e6b43d74644fd37fbc61daa539"
     },
     {
       "path": "public-docs/index.html",
@@ -4387,7 +4392,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "1fdc2c4e3d58ae089a71bade6aa3f5f3259447b243eacdc75b8a91797ea065e7"
+      "sha256": "3ae9d1edc18eef49ebdf90d0c20c00defda76bfb393936c4a615720314a2886e"
     },
     {
       "path": "public-landing/buddha.png",
@@ -4407,7 +4412,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "081e903fcb943e4facda8e83c9247a31602bf7750d5d7740353c97a4ccbcf1e2"
+      "sha256": "f70211d0d2bfe21fa7000ab82d0adcaa97df1f28763e366965da2b92847b31b6"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5687,7 +5692,12 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "693ef4dfd3619a2d999e6223de0e2d51b697cf4004c482b74f60b8cfb362a566"
+      "sha256": "c791369591627f89ff1755ea1d343159716b512e64f92286d27547209da88df7"
+    },
+    {
+      "path": "src/bongos/stealth-gate.js",
+      "mode": "0000644",
+      "sha256": "6ea72c90380663fac7ece7d97cd628792f3d68a2969a502c59addfcb83c2bcb4"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -5717,7 +5727,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "36d78bc9f5db096873e060769bd9b9fd24b65d5a2141e65e57adfdd30df81342"
+      "sha256": "c8a86a1c119d7da3b4baf912eb2d228f83be18b07fbce6c104858a00027efbda"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7234,10 +7244,15 @@
       "mode": "0000644",
       "sha256": "dc354f082204073409aea90df9b91f149d474c6930b761ed5c9928bb76e1358f"
     },
+    {
+      "path": "tests/project_stats.mjs",
+      "mode": "0000644",
+      "sha256": "21bd2a2d0ebb234cd3b9770d126e77ce48f5c630fe7deee2585706d4eb072b53"
+    },
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "6a59da0cfbf5d2be741ed26f3350a39d49a64b6f1dffb89f69666af7ba938dd1"
+      "sha256": "d8fd9759b99b2136f8b438727b74b15346db7cbd8f0ef8b67aec3049f059df2b"
     },
     {
       "path": "tests/provision.mjs",
@@ -7679,6 +7694,11 @@
       "mode": "0000644",
       "sha256": "aa1d79bb3f900097a911c8c6b3055debe4bb20bfe2c3d6c8c64cfd8d7688824e"
     },
+    {
+      "path": "tests/stealth_gate.mjs",
+      "mode": "0000644",
+      "sha256": "c4deafe658457e9f3c17a99f6ab2435e1b1c4d42d74d77304ba792458562e771"
+    },
     {
       "path": "tests/stop_refcheck.mjs",
       "mode": "0000644",

package/modules/platform-identity/project-stats.js

@@ -0,0 +1,207 @@
+// modules/platform-identity/project-stats.js — real Builders + Tags for the hub
+// catalog, read from each project's OWN public API (task 1002771).
+//
+// WHY THE DATA IS NOT HERE. The apex catalog stores four fields (origin, name,
+// tagline, art_url) and nothing else; the membership and activity tables that
+// would know a builder count are written only by the federated check-in a hosted
+// instance posts on sign-in, so they hold one row across the whole platform and
+// would report ZERO for every hand-wired project (task 1002760 documents why).
+// Zero is not an absence — it is the claim "nobody builds here" — so task 1002764
+// removed the columns rather than show a wrong number.
+//
+// But every Cloud Bongos instance already serves an unauthenticated
+// /api/bongos/public/* surface, and the hub's server can read it instance-to-
+// instance with no CORS involved. The project itself is the authority on its own
+// builder count, which is a better source than anything the apex could infer.
+//
+// SCALE, recorded so it is not rediscovered: this PULL model is right for a
+// handful and fine for a few dozen behind the cache. It does not scale to
+// hundreds — at that point instances should PUSH these stats on check-in, which
+// is the shape platform_identity_builder_project_activity already has. Swapping
+// pull for push must not change the column, which is why the route depends on
+// getProjectStats() and not on fetch().
+
+const fs = require('node:fs');
+const path = require('node:path');
+const dns = require('node:dns').promises;
+const net = require('node:net');
+
+const TTL_MS = 10 * 60 * 1000;   // owner's choice, 2026-08-13
+const FETCH_TIMEOUT_MS = 2500;   // per request
+const COLD_DEADLINE_MS = 3000;   // total wait a COLD cache may cost a page load
+
+const _cache = new Map();        // origin → { at, stats }
+const _inflight = new Map();     // origin → Promise (collapses concurrent refreshes)
+
+// The core's own modules/ directory IS the canonical core set — so a module the
+// core adds later is excluded automatically and nobody maintains a list. Anything
+// an instance runs beyond it is project-specific, and that is what a tag is.
+let _coreModules = null;
+function coreModules() {
+  if (_coreModules) return _coreModules;
+  try {
+    _coreModules = new Set(
+      fs.readdirSync(path.join(__dirname, '..'), { withFileTypes: true })
+        .filter((d) => d.isDirectory())
+        .map((d) => d.name),
+    );
+  } catch {
+    _coreModules = new Set();
+  }
+  return _coreModules;
+}
+
+// Machine identities, not people. Counting them inflates every project: the raw
+// leaderboards read 13/3/3 against real 11/1/1, so this filter is the difference
+// between a true number and a wrong one.
+function isSystemAccount(login) {
+  return /-system$/.test(String(login || ''));
+}
+
+// ── SSRF GUARD ──
+// This is the one place the server makes an outbound request to an address that
+// came out of the database, so it is the one place that has to assume the address
+// is hostile. "The catalog is Archon-curated" is a real mitigation but not a
+// sufficient one, for a specific reason: a curated origin is trusted, and a
+// REDIRECT TARGET is not. Following redirects hands the choice of final address
+// back to the remote server, which is the whole SSRF primitive — a listed project
+// could 302 us at 169.254.169.254 (cloud metadata) or a loopback admin port.
+//
+// So: redirects are refused outright rather than followed (a public JSON endpoint
+// has no reason to redirect), and the hostname must resolve to a PUBLIC address.
+//
+// Known and accepted limit: resolving here and connecting in fetch() is a
+// TOCTOU window — a DNS record could change between the two. Closing it properly
+// means pinning the resolved IP into the connection, which needs a custom agent.
+// Refusing redirects removes the attacker-steerable half, which is the half that
+// matters; the residual requires control of DNS for a curated origin.
+const BLOCKED_V4 = [
+  [/^10\./, 'private'], [/^127\./, 'loopback'], [/^0\./, 'unspecified'],
+  [/^169\.254\./, 'link-local / cloud metadata'], [/^192\.168\./, 'private'],
+  [/^172\.(1[6-9]|2\d|3[01])\./, 'private'], [/^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./, 'CGNAT'],
+  [/^(22[4-9]|23\d)\./, 'multicast'], [/^(24\d|25[0-5])\./, 'reserved'],
+];
+function blockedReason(addr) {
+  const ip = String(addr).replace(/^::ffff:/i, '');   // unwrap IPv4-mapped IPv6
+  if (net.isIPv4(ip)) {
+    for (const [re, why] of BLOCKED_V4) if (re.test(ip)) return why;
+    return null;
+  }
+  const v6 = ip.toLowerCase();
+  if (v6 === '::1' || v6 === '::') return 'loopback';
+  if (/^f[cd]/.test(v6)) return 'unique-local';
+  if (/^fe[89ab]/.test(v6)) return 'link-local';
+  return null;
+}
+
+async function assertPublicHost(hostname) {
+  // a literal IP needs no lookup — check it directly
+  if (net.isIP(hostname)) {
+    const why = blockedReason(hostname);
+    if (why) throw new Error(`refused ${hostname} (${why})`);
+    return;
+  }
+  const addrs = await dns.lookup(hostname, { all: true });
+  if (!addrs.length) throw new Error(`no address for ${hostname}`);
+  for (const { address } of addrs) {
+    const why = blockedReason(address);
+    if (why) throw new Error(`refused ${hostname} → ${address} (${why})`);
+  }
+}
+
+function publicUrl(origin, route) {
+  const u = new URL(origin);
+  if (u.protocol !== 'https:' && u.protocol !== 'http:') throw new Error('bad scheme');
+  return new URL(`/api/bongos/public/${route}`, u).href;
+}
+
+async function getJson(url) {
+  await assertPublicHost(new URL(url).hostname);
+  const res = await fetch(url, {
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    headers: { accept: 'application/json' },
+    redirect: 'error',   // never let the remote choose our final address
+  });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  return res.json();
+}
+
+// One project's stats. Either half may fail on its own — a project whose
+// leaderboard is down can still report its modules — so they settle independently
+// and a missing half is null (an em dash) rather than a discarded pair.
+async function fetchStats(origin) {
+  const [lb, mods] = await Promise.allSettled([
+    getJson(publicUrl(origin, 'leaderboard')),
+    getJson(publicUrl(origin, 'modules')),
+  ]);
+
+  let builders = null;
+  if (lb.status === 'fulfilled' && Array.isArray(lb.value?.leaderboard)) {
+    builders = lb.value.leaderboard.filter((b) => !isSystemAccount(b?.github_login)).length;
+  }
+
+  let tags = null;
+  if (mods.status === 'fulfilled' && mods.value?.enabled && typeof mods.value.enabled === 'object') {
+    const core = coreModules();
+    tags = Object.entries(mods.value.enabled)
+      .filter(([key, on]) => on === true && !core.has(key))
+      .map(([key]) => key)
+      .sort();
+  }
+
+  return { builders, tags };
+}
+
+function refresh(origin) {
+  if (_inflight.has(origin)) return _inflight.get(origin);
+  const p = fetchStats(origin)
+    .then((stats) => {
+      _cache.set(origin, { at: Date.now(), stats });
+      return stats;
+    })
+    .catch(() => {
+      // Remember the FAILURE for a full TTL too. Without this a permanently
+      // unreachable project is re-fetched on every request and pays the timeout
+      // every time — the exact way one dead project slows the whole page.
+      const stats = { builders: null, tags: null };
+      _cache.set(origin, { at: Date.now(), stats });
+      return stats;
+    })
+    .finally(() => _inflight.delete(origin));
+  _inflight.set(origin, p);
+  return p;
+}
+
+// Stale-while-revalidate: a warm cache answers instantly, a STALE cache answers
+// instantly and refreshes behind the request, and only a COLD cache waits — and
+// then only until COLD_DEADLINE_MS, after which whatever has not arrived renders
+// as a dash and fills itself in on the next load. The hub's speed must never
+// become hostage to the slowest project's uptime.
+async function getProjectStats(origins = []) {
+  const now = Date.now();
+  const cold = [];
+
+  for (const origin of origins) {
+    const hit = _cache.get(origin);
+    if (!hit) cold.push(origin);
+    else if (now - hit.at > TTL_MS) refresh(origin);   // stale: revalidate, do not await
+  }
+
+  if (cold.length) {
+    await Promise.race([
+      Promise.allSettled(cold.map((o) => refresh(o))),
+      new Promise((r) => setTimeout(r, COLD_DEADLINE_MS)),
+    ]);
+  }
+
+  // null-prototype: an origin literally equal to '__proto__' would otherwise
+  // retarget the object's prototype instead of adding a key
+  const out = Object.create(null);
+  for (const origin of origins) out[origin] = _cache.get(origin)?.stats || { builders: null, tags: null };
+  return out;
+}
+
+// tests
+function _reset() { _cache.clear(); _inflight.clear(); _coreModules = null; }
+
+module.exports = { getProjectStats, isSystemAccount, coreModules, blockedReason, assertPublicHost, _reset, TTL_MS };

package/modules/platform-identity/routes/projects.js

@@ -13,6 +13,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
+const projectStats = require('../project-stats');
 
 const { pool, requireBuilder, requirePermission, validateOrRespond, parseId, corsPublicGet } = api;
 
@@ -100,7 +101,26 @@ module.exports = function projectsRoutes() {
   // rank: public — a curated public showcase; no auth by design.
   router.get('/projects/featured', async (_req, res) => {
     try {
-      res.json({ projects: await pi.listFeaturedProjects({ pool }) });
+      const projects = await pi.listFeaturedProjects({ pool });
+      // Builders + tags come from each project's OWN public API, because the
+      // apex catalog does not know them and the membership tables would report
+      // zero for every hand-wired project (task 1002771; see project-stats.js).
+      // Enrichment is best-effort by construction: a project that is down gets
+      // nulls, which the table renders as an em dash. It must never fail the
+      // listing — a broken stats fetch cannot take the catalog down with it.
+      let stats = {};
+      try {
+        stats = await projectStats.getProjectStats(projects.map((p) => p.origin));
+      } catch (err) {
+        console.error('[platform-identity] project stats enrichment failed (non-fatal):', err.message);
+      }
+      res.json({
+        projects: projects.map((p) => ({
+          ...p,
+          builders: stats[p.origin]?.builders ?? null,
+          tags: stats[p.origin]?.tags ?? null,
+        })),
+      });
     } catch (err) {
       console.error('[platform-identity] GET /projects/featured', err);
       res.fail('explore_failed', { status: 500, message: 'internal error' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.102",
+  "version": "1.19.104",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.102",
+      "version": "1.19.104",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.102",
+  "version": "1.19.104",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -540,6 +540,10 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   box-shadow:0 0 0 3px color-mix(in srgb,var(--acc) 22%,transparent);}
 .tbl .ptitle{font-family:var(--font-display);font-weight:700;font-size:15px;color:var(--ink);}
 .tbl .ptag{font-size:12.5px;color:var(--ink-faint);font-weight:600;}
+.tbl .num{font-family:var(--font-mono);font-weight:500;}
+.tbl .tags{display:flex;gap:6px;flex-wrap:wrap;}
+.tbl .tags span{font-family:var(--font-mono);font-size:10.5px;padding:2px 8px;border-radius:999px;
+  border:1px solid var(--line);color:var(--ink-faint);white-space:nowrap;}
 .tbl .pill{display:inline-block;font-family:var(--font-mono);font-size:11px;padding:3px 10px;
   border-radius:999px;background:var(--accent-soft);color:var(--accent-deep);}
 :root[data-mode="dark"] .tbl .pill{color:var(--sun-lit);}
@@ -553,6 +557,7 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .tbl .colStatus{width:1%;white-space:nowrap;}
 .tbl .colGo{width:1%;white-space:nowrap;padding-left:8px;}
 .tbl .colName{width:auto;}
+@media (max-width:780px){.tbl .colTags{display:none;}}
 
 /* ── the project card ──
    An overlay INSIDE the map, not a destination: opening a project must not cost

package/public-landing/projects.html

@@ -182,6 +182,8 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       <thead>
         <tr>
           <th class="colName" data-sort="name" aria-sort="ascending">Project</th>
+          <th class="right" data-sort="builders">Builders</th>
+          <th class="colTags">Runs</th>
           <th class="right colStatus">Status</th>
           <th class="colGo"></th>
         </tr>
@@ -196,6 +198,8 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
           <td class="colName"><span class="pname"><span class="pdot" style="--acc:var(--accent)"></span>
             <span><span class="ptitle" data-brand-product-inline>Cloud Bongos</span><span id="selfPill"></span><br>
             <span class="ptag">this platform</span></span></span></td>
+          <td class="right num" id="selfBuilders">—</td>
+          <td class="colTags" id="selfTags">—</td>
           <td class="right colStatus"><span class="chip calm"><span class="cdot"></span>—</span></td>
           <td class="colGo"><a class="btn small ghost" href="#" data-self-open>Open →</a></td>
         </tr>
@@ -568,6 +572,18 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     if (!me) return 'none';
     return me.rank === 'archon' ? 'owner' : 'builder';
   }
+  /* A tag is a module the project RUNS beyond the core set — a fact it declares
+     about itself, not a guess about what it is. Capped so one heavily-moduled
+     project cannot blow the column open; the overflow is counted, never hidden
+     silently. null = we could not ask (em dash); [] = asked, runs nothing beyond
+     core, which is a real answer and still reads as a dash in the cell. */
+  var TAG_CAP = 3;
+  function tagsHtml(tags) {
+    if (!Array.isArray(tags) || !tags.length) return '—';
+    var shown = tags.slice(0, TAG_CAP).map(function (t) { return '<span>' + esc(t) + '</span>'; });
+    if (tags.length > TAG_CAP) shown.push('<span>+' + (tags.length - TAG_CAP) + '</span>');
+    return '<span class="tags">' + shown.join('') + '</span>';
+  }
   function matchesMapQuery(p, q) {
     if (!q) return true;
     return (String(p.name || '') + ' ' + String(p.tagline || '')).toLowerCase().indexOf(q) !== -1;
@@ -622,6 +638,13 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
           accentOf(p) + '"></span>' +
           '<span><span class="ptitle">' + esc(p.name) + '</span>' + pill + '<br>' +
           '<span class="ptag">' + esc(p.tagline || '') + '</span></span></span></td>' +
+        /* Builders and Runs come from the project's OWN public API, enriched
+           server-side (task 1002771). null is unknown — the project was
+           unreachable — and an em dash says exactly that. 0 is a real answer and
+           renders as 0, because "nobody has joined yet" is a different fact from
+           "we could not ask". */
+        '<td class="right num">' + (p.builders == null ? '—' : esc(String(p.builders))) + '</td>' +
+        '<td class="colTags">' + tagsHtml(p.tags) + '</td>' +
         /* liveness on a catalog row is NOT probed by this surface. A chip that
            said "live" here would claim more than anything verified (C6); the
            verification overlay on owned orbs is its own task. */
@@ -641,6 +664,15 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     });
     list.sort(function (x, y) {
       if (mapSort.key === 'name') return String(x.name || '').localeCompare(String(y.name || '')) * mapSort.dir;
+      /* unknown (null) sorts to the BOTTOM in both directions — it is not a low
+         number, and letting it ride the comparator would rank "we could not ask"
+         above a project that honestly has one builder */
+      if (mapSort.key === 'builders') {
+        if (x.builders == null && y.builders == null) return 0;
+        if (x.builders == null) return 1;
+        if (y.builders == null) return -1;
+        return (x.builders - y.builders) * mapSort.dir;
+      }
       return 0;
     });
     renderOrbs(list);
@@ -759,6 +791,25 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     if (ev.key === 'Escape') closeCard();
   });
 
+  /* The platform's own row is not in the catalog (it is synthesized — task
+     1002760), so the server-side enrichment never sees it. It can answer for
+     itself though: this is its own origin, so one same-origin call gets the same
+     number by the same rule the server applies to everyone else — real builders,
+     machine accounts excluded. Its Runs cell stays a dash honestly: every module
+     this instance enables is a CORE module, so it declares nothing beyond the
+     baseline and there is no tag to show. */
+  function loadSelfStats() {
+    return fetch(API + '/public/leaderboard', { credentials: 'same-origin' })
+      .then(function (res) { return res.ok ? res.json() : null; })
+      .then(function (d) {
+        var rows = (d && d.leaderboard) || [];
+        if (!rows.length) return;
+        var real = rows.filter(function (b) { return !/-system$/.test(String(b.github_login || '')); });
+        $('selfBuilders').textContent = String(real.length);
+      })
+      .catch(function () { /* unreachable → the dash already in the markup stands */ });
+  }
+
   function loadCatalog() {
     fetch(API + '/projects/featured', { credentials: 'same-origin' })
       .then(function (res) { if (!res.ok) throw new Error('catalog'); return res.json(); })
@@ -1467,7 +1518,9 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     })
     /* the catalog is PUBLIC, so it loads either way — the map is the view a
        signed-out stranger lands on and it must not depend on identity */
-    .then(loadCatalog, loadCatalog);
+    .then(loadCatalog, loadCatalog)
+    /* the platform's own count is public too, so it loads either way */
+    .then(loadSelfStats, loadSelfStats);
 })();
 </script>
 </body>

package/src/bongos/serve-internal.js

@@ -45,6 +45,7 @@ const { buildInfo } = require('../build-info');
 const { buildDevboxDownloads } = require('../devbox-downloads');
 const { buildBongosDownloads } = require('../bongos-downloads');
 const { clientBranding, branding } = require('../branding');
+const { stealthGate } = require('./stealth-gate');
 const { clientModules, isModuleEnabled } = require('../modules');
 const { hallWidgetScripts, moduleWebSurfaces } = require('../module-loader/loader');
 const { resolveCoreRoot, resolveDocsRoot, resolveInstanceRoot } = require('../instance-config');
@@ -441,6 +442,16 @@ function mountInternalSurfaces(app) {
   // game routes too) — it records on res 'finish' regardless of which handler
   // answers. The /metrics scrape endpoint is access-gated (loopback Prometheus
   // or Bearer METRICS_TOKEN; see metrics.authorizeScrape).
+  // THE STEALTH GATE (task 1002775) mounts before anything it is meant to
+  // cover — a surface registered earlier would answer first and the gate would
+  // never run. Inert unless STEALTH_PASSWORD is set, so a vanilla instance is
+  // unaffected and pays only a closure call per request.
+  //
+  // It sits ABOVE the metrics middleware deliberately: a refused knock is still
+  // a request this instance served, and hiding gate 401s would make the traffic
+  // graph lie about how much attention an unannounced instance is getting.
+  app.use(stealthGate());
+
   app.use(metrics.httpMiddleware());
   app.get('/metrics', metrics.metricsHandler());
 

package/src/bongos/stealth-gate.js

@@ -0,0 +1,203 @@
+// src/bongos/stealth-gate.js — the pre-launch stealth gate (task 1002775).
+//
+// An instance that is built but not announced needs a door that is shut without
+// being broken. The proxy can do that with basic_auth, and task 1002774 did
+// exactly that to close an exposure quickly — but HTTP basic auth is per-ORIGIN,
+// so the apex, the hall and the status dashboard each prompt separately. Three
+// native browser dialogs, none of them able to say what the site is or why it is
+// asking. The owner asked for one password, entered once, good across the whole
+// domain for the session.
+//
+// So the gate lives in the app, where it can set a cookie the browser will send
+// to every subdomain:
+//
+//   - It is INERT unless STEALTH_PASSWORD is set. That is the portable default:
+//     a vanilla instance has no gate and needs no config to not have one.
+//   - The cookie is a SESSION cookie — no Max-Age, no Expires — because the
+//     owner explicitly did not want it to outlive the browser. That is also the
+//     safer default: nothing is written to disk to be found later.
+//   - It is scoped to the cookie apex, so ONE entry unlocks apex + www +
+//     builders + status. The apex and its host set come from the same branding
+//     key auth.js reads (domains.cookieDomain), so the gate and the session
+//     cookie cannot disagree about what "this domain" means.
+//   - The cookie carries an HMAC KEYED BY THE PASSWORD, never the password. No
+//     second secret to manage, and rotating the password invalidates every
+//     outstanding cookie for free.
+//
+// This is deliberately not an authorization system. It has no accounts, no
+// ranks, and it grants nothing: everything behind it still enforces its own
+// rank checks against the database (ADR 0016). It only decides whether a
+// stranger may SEE the instance at all, which is why one shared password is the
+// right primitive and why it must never be mistaken for sign-in.
+
+'use strict';
+
+const crypto = require('node:crypto');
+const { branding } = require('../branding');
+
+const COOKIE = 'cb_stealth';
+const SUBMIT_PATH = '/__stealth';
+
+// Paths that must answer even to a stranger, each for its own reason:
+//   /api/*    the GitHub OAuth round trip has to complete, and a gated callback
+//             would break sign-in for the very people holding the password
+//   /healthz  external probes + the upgrade's post-restart health check
+//   /metrics  Prometheus, already access-gated on its own terms (loopback or
+//             bearer token) — double-gating it would break the scrape
+//   /version  the deploy pin check, a public commit sha
+const EXEMPT = [/^\/api\//, /^\/healthz$/, /^\/metrics$/, /^\/version$/, /^\/__stealth$/];
+
+function password() {
+  const p = process.env.STEALTH_PASSWORD;
+  return typeof p === 'string' && p.length ? p : null;
+}
+
+function enabled() { return password() !== null; }
+
+// The token a valid cookie must carry. Keyed by the password, so the password
+// itself never leaves the server and a rotation invalidates every cookie.
+function expectedToken() {
+  return crypto.createHmac('sha256', password()).update('stealth-v1').digest('hex');
+}
+
+function tokenMatches(raw) {
+  if (typeof raw !== 'string') return false;
+  const want = Buffer.from(expectedToken(), 'utf8');
+  const got = Buffer.from(raw, 'utf8');
+  // timingSafeEqual throws on a length mismatch, which is itself a comparison —
+  // check the length first so both branches cost the same shape
+  if (got.length !== want.length) return false;
+  return crypto.timingSafeEqual(got, want);
+}
+
+function cookieApex() {
+  try {
+    return String(branding().domains?.cookieDomain || '').replace(/^\./, '').toLowerCase();
+  } catch {
+    return '';
+  }
+}
+
+function reqHost(req) {
+  const raw = req.headers['x-forwarded-host'] || req.headers['host'] || '';
+  return String(raw).toLowerCase().split(',')[0].trim().split(':')[0];
+}
+
+// Scope to the apex only on the hosts that actually share it — the same set
+// auth.js uses for the session cookie. Anywhere else (localhost, a preview host)
+// the cookie stays host-only, because a Domain= attribute for a domain you are
+// not on is simply rejected by the browser and would lock the operator out.
+function domainOpts(req) {
+  const apex = cookieApex();
+  if (!apex) return {};
+  const host = reqHost(req);
+  const shared = new Set([apex, 'www.' + apex, 'builders.' + apex, 'status.' + apex]);
+  return shared.has(host) ? { domain: '.' + apex } : {};
+}
+
+function readCookie(req, name) {
+  for (const part of String(req.headers.cookie || '').split(';')) {
+    const [k, ...v] = part.trim().split('=');
+    if (k === name && v.length) return decodeURIComponent(v.join('='));
+  }
+  return null;
+}
+
+function isExempt(path) {
+  return EXEMPT.some((re) => re.test(path));
+}
+
+// The form. Self-contained and token-free on purpose: it is served BEFORE the
+// visitor is allowed to see anything, so it must not pull the branding bundle,
+// the stylesheet, or any other asset that would leak the design of an
+// unannounced product to whoever knocks.
+function formHtml({ productName, wrong }) {
+  const name = String(productName || 'This instance').replace(/[<>&"]/g, '');
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="robots" content="noindex,nofollow">
+<title>${name}</title><style>
+:root{color-scheme:light dark}
+*{box-sizing:border-box}
+body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;
+  font:500 15px/1.5 ui-rounded,"Quicksand",system-ui,-apple-system,"Segoe UI",sans-serif;
+  background:#f9d9a8;color:#2b170e}
+@media(prefers-color-scheme:dark){body{background:#150c06;color:#f4e6cd}}
+.box{width:min(380px,100%);text-align:center}
+.dots{display:flex;gap:10px;justify-content:center;margin-bottom:22px}
+.dots i{display:block;border-radius:50%;background:#ce4806}
+.dots i:first-child{width:38px;height:38px}
+.dots i:last-child{width:28px;height:28px;background:#855b3d;align-self:flex-end}
+h1{font-size:20px;font-weight:700;margin:0 0 6px}
+p{margin:0 0 20px;opacity:.72;font-size:14px}
+form{display:flex;gap:8px}
+input{flex:1;min-width:0;padding:11px 14px;border-radius:999px;border:1.5px solid rgba(206,72,6,.35);
+  background:rgba(255,255,255,.72);color:inherit;font:inherit}
+@media(prefers-color-scheme:dark){input{background:rgba(255,255,255,.08)}}
+input:focus{outline:2px solid #ce4806;outline-offset:1px}
+button{padding:11px 20px;border:0;border-radius:999px;background:#ce4806;color:#fff;
+  font:700 14px/1 inherit;cursor:pointer}
+.err{margin:14px 0 0;color:#b3261e;font-size:13.5px}
+@media(prefers-color-scheme:dark){.err{color:#ffb4a8}}
+</style></head><body><div class="box">
+<div class="dots"><i></i><i></i></div>
+<h1>${name}</h1>
+<p>Not open to the world yet. Enter the password to have a look.</p>
+<form method="POST" action="${SUBMIT_PATH}">
+  <input type="password" name="password" placeholder="Password" aria-label="Password" autofocus required>
+  <button type="submit">Enter</button>
+</form>
+${wrong ? '<p class="err">That password didn’t work.</p>' : ''}
+</div></body></html>`;
+}
+
+function productName() {
+  try { return branding().identity?.productName || 'This instance'; } catch { return 'This instance'; }
+}
+
+// Mounted FIRST, ahead of every other surface — a route registered earlier would
+// answer before the gate ever ran.
+function stealthGate() {
+  return function stealth(req, res, next) {
+    if (!enabled()) return next();
+
+    if (req.method === 'POST' && req.path === SUBMIT_PATH) {
+      // The form is urlencoded; body parsers mount later (and only on some
+      // routers), so read it here rather than depending on middleware order.
+      let body = '';
+      req.on('data', (c) => {
+        body += c;
+        if (body.length > 4096) req.destroy();   // a password is not a payload
+      });
+      req.on('end', () => {
+        const params = new URLSearchParams(body);
+        const given = params.get('password') || '';
+        const want = password();
+        const ok = given.length === want.length
+          && crypto.timingSafeEqual(Buffer.from(given), Buffer.from(want));
+        if (!ok) {
+          return res.status(401).type('html').send(formHtml({ productName: productName(), wrong: true }));
+        }
+        res.cookie(COOKIE, expectedToken(), {
+          httpOnly: true,
+          secure: req.secure || req.headers['x-forwarded-proto'] === 'https',
+          sameSite: 'lax',
+          path: '/',
+          ...domainOpts(req),
+          // no maxAge/expires — a SESSION cookie, by the owner's choice
+        });
+        res.redirect(303, '/');
+      });
+      return undefined;
+    }
+
+    if (isExempt(req.path)) return next();
+    if (tokenMatches(readCookie(req, COOKIE))) return next();
+
+    // 401 rather than 200: this is an unauthenticated request being refused, and
+    // a crawler that ignores the noindex should still be told so.
+    return res.status(401).type('html').send(formHtml({ productName: productName(), wrong: false }));
+  };
+}
+
+module.exports = { stealthGate, enabled, isExempt, tokenMatches, expectedToken, COOKIE, SUBMIT_PATH };

package/src/module-api.js

@@ -631,8 +631,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.100 with no explicit bump. run 31752022322. (task 1002620)
 //   1.19.102 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.101 with no explicit bump. run 31753496152. (task 1002620)
+//   1.19.103 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.102 with no explicit bump. run 31754659965. (task 1002620)
+//   1.19.104 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.103 with no explicit bump. run 31756625919. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.102'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.104'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/project_stats.mjs

@@ -0,0 +1,206 @@
+// tests/project_stats.mjs — the hub's cross-instance stats fetcher (task 1002771).
+//
+// The hub reads Builders + Runs from each project's OWN public API, because the
+// apex catalog does not know them and the membership tables would report zero for
+// every hand-wired project (task 1002760). The risk in that design is not the
+// happy path — it is the failure modes: a dead project must cost a dash, not the
+// page; a machine account must not be counted as a person; and "we could not ask"
+// must never be rendered as "the answer is none".
+//
+// Run:  node --test tests/project_stats.mjs
+//
+// Fixture origins are literal PUBLIC IPs on purpose: net.isIP() short-circuits
+// the SSRF guard's DNS lookup, so these exercise the fetch/cache/filter logic
+// without a resolver in the loop. The guard itself is tested separately below.
+
+import test, { beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const stats = require('../modules/platform-identity/project-stats.js');
+
+const realFetch = globalThis.fetch;
+afterEach(() => { globalThis.fetch = realFetch; });
+beforeEach(() => { stats._reset(); });
+
+function json(body) {
+  return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve(body) });
+}
+// route a fake instance: { leaderboard: [...], enabled: {...} }
+function stub(map) {
+  globalThis.fetch = (url) => {
+    const u = new URL(url);
+    const site = map[u.origin];
+    if (!site) return Promise.reject(new Error('unreachable'));
+    if (u.pathname.endsWith('/leaderboard')) {
+      return site.leaderboard ? json({ leaderboard: site.leaderboard }) : Promise.reject(new Error('down'));
+    }
+    if (u.pathname.endsWith('/modules')) {
+      return site.enabled ? json({ enabled: site.enabled }) : Promise.reject(new Error('down'));
+    }
+    return Promise.reject(new Error('404'));
+  };
+}
+
+test('system accounts are excluded — they are machines, not builders', async () => {
+  // measured live: raw leaderboards read 13/3/3 against real 11/1/1
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [
+        { github_login: 'ada' }, { github_login: 'grace' },
+        { github_login: 'bfg-system' }, { github_login: 'discord-bot-system' },
+      ],
+      enabled: {},
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].builders, 2, 'four rows, two of them machines');
+});
+
+test('a tag is a NON-core module — core modules carry no information', async () => {
+  // every instance runs the core set, so including it would print the same
+  // fifteen tags on every row
+  const core = [...stats.coreModules()];
+  assert.ok(core.includes('grading'), 'the core set is read from the repo, not hardcoded');
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [],
+      enabled: { grading: true, lifecycle: true, game: true, 'art-pipeline': true },
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.deepEqual(out['https://8.8.8.8'].tags, ['art-pipeline', 'game']);
+});
+
+test('a disabled module is not a tag', async () => {
+  stub({ 'https://8.8.8.8': { leaderboard: [], enabled: { game: false, 'art-pipeline': true } } });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.deepEqual(out['https://8.8.8.8'].tags, ['art-pipeline']);
+});
+
+test('an unreachable project yields nulls — never zero, never a throw', async () => {
+  // 0 would be the claim "nobody builds here". null is "we could not ask".
+  stub({});   // nothing resolves
+  const out = await stats.getProjectStats(['https://9.9.9.9']);
+  assert.equal(out['https://9.9.9.9'].builders, null);
+  assert.equal(out['https://9.9.9.9'].tags, null);
+});
+
+test('one dead half does not discard the half that answered', async () => {
+  // a project whose leaderboard is down can still report its modules
+  stub({ 'https://8.8.8.8': { leaderboard: null, enabled: { game: true } } });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].builders, null, 'the dead half is unknown');
+  assert.deepEqual(out['https://8.8.8.8'].tags, ['game'], 'the live half still answers');
+});
+
+test('a dead project does not take the healthy ones down with it', async () => {
+  stub({ 'https://1.1.1.1': { leaderboard: [{ github_login: 'a' }], enabled: {} } });
+  const out = await stats.getProjectStats(['https://1.1.1.1', 'https://9.9.9.9']);
+  assert.equal(out['https://1.1.1.1'].builders, 1);
+  assert.equal(out['https://9.9.9.9'].builders, null);
+});
+
+test('results are cached — a warm origin is not re-fetched', async () => {
+  let calls = 0;
+  const site = { leaderboard: [{ github_login: 'a' }], enabled: {} };
+  stub({ 'https://8.8.8.8': site });
+  const counting = globalThis.fetch;
+  globalThis.fetch = (u) => { calls++; return counting(u); };
+
+  await stats.getProjectStats(['https://8.8.8.8']);
+  const first = calls;
+  assert.ok(first > 0, 'the cold call must actually fetch');
+  await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(calls, first, 'the second call must be served from cache');
+});
+
+test('a FAILURE is cached too, or one dead project pays its timeout on every request', async () => {
+  let calls = 0;
+  globalThis.fetch = () => { calls++; return Promise.reject(new Error('down')); };
+  await stats.getProjectStats(['https://9.9.9.9']);
+  const first = calls;
+  await stats.getProjectStats(['https://9.9.9.9']);
+  assert.equal(calls, first, 'a known-dead origin must not be retried on the next page load');
+});
+
+test('concurrent requests for the same origin collapse into one fetch', async () => {
+  let calls = 0;
+  globalThis.fetch = (url) => {
+    calls++;
+    return new Promise((r) => setTimeout(() => r({
+      ok: true, status: 200, json: () => Promise.resolve({ leaderboard: [], enabled: {} }),
+    }), 10));
+  };
+  await Promise.all([
+    stats.getProjectStats(['https://8.8.8.8']),
+    stats.getProjectStats(['https://8.8.8.8']),
+    stats.getProjectStats(['https://8.8.8.8']),
+  ]);
+  assert.equal(calls, 2, 'two endpoints for one origin, not six for three callers');
+});
+
+test('a non-http origin is refused rather than fetched', async () => {
+  globalThis.fetch = () => { throw new Error('must not be called'); };
+  const out = await stats.getProjectStats(['file:///etc/passwd']);
+  assert.equal(out['file:///etc/passwd'].builders, null);
+});
+
+test('the cache TTL is the owner-chosen ten minutes', () => {
+  assert.equal(stats.TTL_MS, 10 * 60 * 1000);
+});
+
+/* ── SSRF guard (grader finding, task 1002771 round 2) ──────────────────────
+   This is the one place the server dials an address that came out of the
+   database, so it is the one place that must treat the address as hostile.
+   "The catalog is Archon-curated" covers the ORIGIN but not a REDIRECT TARGET —
+   following redirects hands the final address back to the remote server, which
+   is the SSRF primitive itself. ── */
+
+test('loopback, private, link-local and metadata addresses are refused', () => {
+  const blocked = {
+    '127.0.0.1': 'loopback',
+    '169.254.169.254': 'cloud metadata',      // the one that matters
+    '10.0.0.5': 'private',
+    '192.168.1.1': 'private',
+    '172.16.0.1': 'private',
+    '172.31.255.255': 'private (upper bound)',
+    '100.64.0.1': 'CGNAT',
+    '0.0.0.0': 'unspecified',
+    '::1': 'IPv6 loopback',
+    'fd00::1': 'IPv6 unique-local',
+    'fe80::1': 'IPv6 link-local',
+    '::ffff:127.0.0.1': 'IPv4-mapped loopback',
+  };
+  for (const [addr, why] of Object.entries(blocked)) {
+    assert.ok(stats.blockedReason(addr), `${addr} (${why}) must be refused`);
+  }
+});
+
+test('ordinary public addresses are allowed', () => {
+  for (const addr of ['8.8.8.8', '104.21.64.15', '172.15.0.1', '172.32.0.1', '2606:4700::1']) {
+    assert.equal(stats.blockedReason(addr), null, `${addr} is public and must be allowed`);
+  }
+});
+
+test('a literal private IP as the origin host is refused before any fetch', async () => {
+  globalThis.fetch = () => { throw new Error('fetch must not be reached'); };
+  const out = await stats.getProjectStats(['http://169.254.169.254']);
+  assert.equal(out['http://169.254.169.254'].builders, null);
+});
+
+test('redirects are refused, never followed', async () => {
+  // following would let a curated origin choose our final address
+  const src = await import('node:fs').then((fs) =>
+    fs.readFileSync(new URL('../modules/platform-identity/project-stats.js', import.meta.url), 'utf8'));
+  assert.match(src, /redirect:\s*'error'/, 'the remote must not choose where we end up');
+  assert.doesNotMatch(src, /redirect:\s*'follow'/);
+});
+
+test('an origin named __proto__ cannot retarget the result prototype', async () => {
+  globalThis.fetch = () => Promise.reject(new Error('down'));
+  const out = await stats.getProjectStats(['__proto__']);
+  assert.equal(Object.getPrototypeOf(out), null, 'the result map is null-prototype');
+  assert.equal(({}).builders, undefined, 'Object.prototype is untouched');
+});

package/tests/projects_hub.mjs

@@ -379,10 +379,14 @@ test('the row keeps its own Open link working underneath the card', () => {
 
 test('the table declares no column it has no source for', () => {
   const thead = (HUB.match(/<thead>([\s\S]*?)<\/thead>/) || [, ''])[1];
-  for (const dead of [/>Builders</, />Type</, />Tags</]) {
-    assert.doesNotMatch(thead, dead, `a permanently-empty column must not be advertised`);
-  }
-  assert.match(thead, />Project</, 'the name column is real');
+  // Type is still absent: the owner's call is that a project DECLARES its type
+  // at creation, so until that field exists the hub must not guess one.
+  assert.doesNotMatch(thead, />Type</, 'Type has no source until a project declares it');
+  // Builders and Runs came back in task 1002771 WITH a source behind them
+  assert.match(thead, />Builders</);
+  assert.match(thead, />Runs</);
+  assert.match(SCRIPT, /p\.builders/, 'the Builders cell must read real data');
+  assert.match(SCRIPT, /tagsHtml\(p\.tags\)/, 'the Runs cell must read real data');
 });
 
 test('header and body agree on the column count', () => {
@@ -395,9 +399,9 @@ test('header and body agree on the column count', () => {
 });
 
 test('no sort control is offered for a column that cannot sort', () => {
-  // `data-sort="builders"` was declared sortable while the comparator handled
-  // only 'name' — clicking it did nothing at all
-  assert.doesNotMatch(HUB, /data-sort="builders"/);
+  // `data-sort="builders"` was once declared sortable while the comparator
+  // handled only 'name' — clicking it did nothing at all. The column is back
+  // (task 1002771) and so is its comparator arm; this keeps the two in step.
   const sorts = [...HUB.matchAll(/data-sort="([^"]+)"/g)].map((m) => m[1]);
   const comparator = (SCRIPT.match(/list\.sort\(function[\s\S]*?\n    \}\);/) || [''])[0];
   for (const key of sorts) {
@@ -405,8 +409,47 @@ test('no sort control is offered for a column that cannot sort', () => {
   }
 });
 
-test('the CSS for the dropped columns went with them', () => {
-  for (const orphan of ['.colType', '.colTags', '.tbl .num', '.tbl .tags']) {
-    assert.ok(!COSMOS.includes(orphan), `${orphan} is dead once its column is gone`);
+test('Type left no styling behind, and the live columns kept theirs', () => {
+  assert.ok(!COSMOS.includes('.colType'), '.colType is dead — the column is gone');
+  for (const live of ['.tbl .num', '.tbl .tags', '.colTags']) {
+    assert.ok(COSMOS.includes(live), `${live} styles a column that now renders real data`);
   }
 });
+
+/* ── Real Builders + Runs (task 1002771) ────────────────────────────────────
+   The columns came back only once something could fill them: each project's
+   OWN public API. The distinction these pin is between "we could not ask"
+   (null → em dash) and "we asked, the answer is none" (0 / []). ── */
+
+test('unknown and zero are rendered as different things', () => {
+  // 0 builders is a real answer — "nobody has joined yet". null is not an
+  // answer at all. Collapsing them would restate the lie 1002764 removed.
+  assert.match(SCRIPT, /p\.builders == null \? '—'/,
+    'only null becomes a dash; 0 must render as 0');
+});
+
+test('a project that cannot be reached degrades to a dash, not to a wrong number', () => {
+  const fn = (SCRIPT.match(/function tagsHtml\(tags\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'tagsHtml() must exist');
+  assert.match(fn, /Array\.isArray\(tags\)/, 'a non-array (null) must not be spread into the cell');
+  assert.match(fn, /return '—'/);
+});
+
+test('the tag list is capped, and the overflow is counted rather than hidden', () => {
+  const fn = (SCRIPT.match(/function tagsHtml\(tags\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(fn, /TAG_CAP/, 'one heavily-moduled project must not blow the column open');
+  assert.match(fn, /\+' \+ \(tags\.length - TAG_CAP\)/, 'a silent truncation reads as "that is all of them"');
+});
+
+test('sorting by builders puts UNKNOWN last, never first', () => {
+  const comparator = (SCRIPT.match(/list\.sort\(function[\s\S]*?\n    \}\);/) || [''])[0];
+  assert.match(comparator, /x\.builders == null\) return 1/,
+    'null is not a low number — it must sink in both directions');
+  assert.match(comparator, /y\.builders == null\) return -1/);
+});
+
+test('the platform answers for itself by the same rule it applies to others', () => {
+  // the self row is synthesized, so the server-side enrichment never sees it
+  assert.match(SCRIPT, /function loadSelfStats/);
+  assert.match(SCRIPT, /-system\$/, 'machine accounts are excluded here too, or the platform inflates itself');
+});

package/tests/stealth_gate.mjs

@@ -0,0 +1,169 @@
+// tests/stealth_gate.mjs — the pre-launch stealth gate (task 1002775).
+//
+// A gate that is wrong in either direction is worse than no gate: too open and
+// the unannounced instance is readable; too closed and it locks out sign-in,
+// health probes, or the operator. These drive the REAL booted app, because the
+// gate's whole job is to sit in front of surfaces registered elsewhere — a unit
+// test of the middleware alone could not prove it was mounted early enough.
+//
+// Run:  node --test tests/stealth_gate.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+const PASSWORD = 'a-test-password';
+process.env.STEALTH_PASSWORD = PASSWORD;   // set BEFORE the app is built
+
+const gate = require('../src/bongos/stealth-gate.js');
+const platformMod = require('../src/platform-server.js');
+
+let server, port;
+
+before(async () => {
+  server = http.createServer(platformMod.buildPlatformApp());
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => {
+  await new Promise((r) => server.close(r));
+  delete process.env.STEALTH_PASSWORD;
+});
+
+function request(pathname, { method = 'GET', cookie, body } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({
+      host: '127.0.0.1', port, path: pathname, method,
+      headers: {
+        host: '127.0.0.1',
+        ...(cookie ? { cookie } : {}),
+        ...(body ? { 'content-type': 'application/x-www-form-urlencoded', 'content-length': Buffer.byteLength(body) } : {}),
+      },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: data }));
+    });
+    req.on('error', reject);
+    if (body) req.write(body);
+    req.end();
+  });
+}
+
+const validCookie = () => `${gate.COOKIE}=${gate.expectedToken()}`;
+
+test('a stranger gets the form, not the product', async () => {
+  const res = await request('/');
+  assert.equal(res.status, 401, 'a refused knock is a 401, not a 200');
+  assert.match(res.body, /type="password"/, 'the form must be usable');
+  assert.match(res.body, /noindex/, 'an unannounced instance must not be indexed');
+});
+
+test('the form leaks nothing about the product it is hiding', async () => {
+  const res = await request('/');
+  // it is served BEFORE the visitor may see anything, so it must not pull the
+  // stylesheet, the branding bundle, or any other asset that would show the
+  // design of an unannounced product to whoever knocks
+  assert.doesNotMatch(res.body, /cosmos\.css/);
+  assert.doesNotMatch(res.body, /__BRANDING__/);
+  assert.doesNotMatch(res.body, /<script/, 'no script at all on the gate page');
+});
+
+test('every human surface is gated, not just the front page', async () => {
+  // the old proxy lock covered '/' but not '/projects', so the hub leaked for
+  // the whole stealth period — that regression must be impossible here
+  for (const p of ['/', '/projects', '/create', '/builders', '/docs']) {
+    const res = await request(p);
+    assert.equal(res.status, 401, `${p} must be gated`);
+  }
+});
+
+test('the OAuth round trip and the probes stay open', async () => {
+  // gating these would lock out the very people holding the password, and blind
+  // the deploy's own health check
+  for (const p of ['/healthz', '/version']) {
+    const res = await request(p);
+    assert.notEqual(res.status, 401, `${p} must answer a stranger`);
+  }
+  // a DB-free API path: 404 from the router proves the request REACHED the API
+  // (i.e. the gate let it through) without needing a database in this suite
+  const api = await request('/api/bongos/__not-a-route');
+  assert.notEqual(api.status, 401, 'the OAuth/public API surface must not be gated');
+  assert.equal(api.status, 404, 'and it should reach the API router itself');
+});
+
+test('the right password opens it and sets a SESSION cookie', async () => {
+  const res = await request(gate.SUBMIT_PATH, {
+    method: 'POST',
+    body: new URLSearchParams({ password: PASSWORD }).toString(),
+  });
+  assert.equal(res.status, 303, 'a successful POST redirects rather than rendering');
+  const setCookie = String(res.headers['set-cookie'] || '');
+  assert.match(setCookie, new RegExp(gate.COOKIE));
+  assert.match(setCookie, /HttpOnly/i, 'script must not be able to read it');
+  assert.match(setCookie, /SameSite=Lax/i);
+  // the owner asked for session-only — no persistence to disk
+  assert.doesNotMatch(setCookie, /Max-Age/i, 'must not outlive the browser session');
+  assert.doesNotMatch(setCookie, /Expires/i);
+});
+
+test('the cookie never carries the password itself', async () => {
+  const res = await request(gate.SUBMIT_PATH, {
+    method: 'POST',
+    body: new URLSearchParams({ password: PASSWORD }).toString(),
+  });
+  const setCookie = String(res.headers['set-cookie'] || '');
+  assert.ok(!setCookie.includes(PASSWORD), 'the password must never reach the client');
+});
+
+test('a valid cookie gets the real page', async () => {
+  const res = await request('/', { cookie: validCookie() });
+  assert.equal(res.status, 200);
+  assert.doesNotMatch(res.body, /type="password"/, 'the gate must be out of the way now');
+});
+
+test('a wrong password is refused and says so', async () => {
+  const res = await request(gate.SUBMIT_PATH, {
+    method: 'POST',
+    body: new URLSearchParams({ password: 'not-it' }).toString(),
+  });
+  assert.equal(res.status, 401);
+  assert.match(res.body, /didn/, 'the visitor must be told it failed');
+  assert.ok(!String(res.headers['set-cookie'] || '').includes(gate.COOKIE), 'no cookie on failure');
+});
+
+test('a forged or stale cookie does not open it', async () => {
+  for (const bad of ['x', 'deadbeef', gate.expectedToken().slice(0, -1) + '0']) {
+    const res = await request('/', { cookie: `${gate.COOKIE}=${bad}` });
+    assert.equal(res.status, 401, `forged cookie ${bad.slice(0, 12)} must be refused`);
+  }
+});
+
+test('rotating the password invalidates outstanding cookies', async () => {
+  const old = validCookie();
+  process.env.STEALTH_PASSWORD = 'a-different-password';
+  const res = await request('/', { cookie: old });
+  process.env.STEALTH_PASSWORD = PASSWORD;
+  assert.equal(res.status, 401, 'the token is keyed by the password, so a rotation revokes');
+});
+
+test('an oversized POST body is dropped rather than buffered', async () => {
+  // a password is not a payload — the handler reads the body itself, so it must
+  // bound it or it is a trivial memory sink on an unauthenticated endpoint
+  const src = require('node:fs').readFileSync(
+    new URL('../src/bongos/stealth-gate.js', import.meta.url), 'utf8');
+  assert.match(src, /body\.length > \d+/, 'the body read must be bounded');
+  assert.match(src, /req\.destroy\(\)/);
+});
+
+test('the gate is inert when no password is configured', () => {
+  // the portable default: a vanilla instance has no gate and needs no config
+  // to not have one
+  delete process.env.STEALTH_PASSWORD;
+  assert.equal(gate.enabled(), false);
+  process.env.STEALTH_PASSWORD = PASSWORD;
+  assert.equal(gate.enabled(), true);
+});