@bongos/core 1.19.1073 → 1.19.1075

package/modules/provisioning/routes/provisioning.js

@@ -2,7 +2,7 @@
 // surface (ADR 0111 §1/§2, task #1942). Instance hosting + domains: the web-tier
 // REQUEST + STATE surface for standing up + operating a Cloud Bongos instance.
 //
-// THE TRUST BOUNDARY (ADR 0111 §2 / ADR 0016 / the dev-box /box precedent). The
+// THE TRUST BOUNDARY (ADR 0111 §2 / ADR 0016). The
 // internet-facing web process NEVER calls a cloud API and holds NO provider tokens.
 // A mutation route only ENQUEUES an intent (provision | teardown) into
 // provisioning_intents and returns; the control-plane runner (scripts/gds/
@@ -27,7 +27,7 @@
 //                                                      task 1003581 — see the handler)
 //     POST   /provisioning/instances/:id/teardown  — request teardown of one's own
 //     GET    /provisioning/instances/:id/invite-suggestions — who is worth inviting (R28, ADR 0251)
-//   Archon-scoped (requireRank('archon') — the fleet, the /boxes precedent):
+//   Archon-scoped (requireRank('archon') — the fleet):
 //     GET    /provisioning/fleet                    — the full instance roster + the box's slot `capacity` (ADR 0285)
 //     GET    /provisioning/fleet/cost-ledger        — per-instance cost to us + to its owner, with totals
 //     POST   /provisioning/instances/:id/force-teardown — tear down ANY instance
@@ -204,7 +204,7 @@ module.exports = function provisioningRoutes() {
   // it. Archon-first keeps every route classifying to its true gate.
 
   // GET /provisioning/fleet — the full instance roster across all owners.
-  // rank: archon (exposes every owner's instance + cost; the /boxes precedent).
+  // rank: archon (exposes every owner's instance + cost).
   router.get('/provisioning/fleet', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     try {
       const status = req.query.status || undefined;
@@ -217,7 +217,7 @@ module.exports = function provisioningRoutes() {
   });
 
   // GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals.
-  // rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent).
+  // rank: archon — cost oversight across the fleet.
   // Declared among the archon routes (archon-first) for correct auditor classification.
   router.get('/provisioning/fleet/cost-ledger', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     try {

package/modules/provisioning/starter-bundles.js

@@ -75,21 +75,6 @@ const ALWAYS_ON_CORE = Object.freeze([
 // own npm package is a later, deliberate removal from this list — with picker copy.
 const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release']);
 
-// Modules that were once offered and are being WITHDRAWN. A retired key is still
-// a module on disk — its manifest, routes and tables are deleted by later tasks —
-// but it must stop being OFFERED the moment the withdrawal starts, or an owner
-// creating a project today opts into something that is on its way out.
-//
-// WHY A LIST AND NOT JUST DELETING THE ROW. The integrity test below pins
-// OPTIONAL_MODULES against the on-disk `default: false` manifests, so that a new
-// opt-in module cannot ship without owner-facing copy. Dropping a row while its
-// manifest is still on disk would trip exactly that guard. Naming the withdrawal
-// keeps the guard honest in both directions: the catalog may omit a RETIRED
-// module and may omit nothing else. The entry is deleted when the module is
-// (goal 1000091, task 1003892) — at which point the manifest is gone and the
-// plain drift check covers it again.
-const RETIRED_MODULES = Object.freeze(['dev-box']);
-
 // The OPT-IN catalog as the creation picker renders it (BV1.R20, task 1002339):
 // every module an owner may actually choose, in the order the picker lists them,
 // with copy written for someone who has met none of them.
@@ -159,9 +144,7 @@ const OPTIONAL_MODULE_KEYS = Object.freeze(OPTIONAL_MODULES.map((m) => m.key));
 //
 // Deliberately tiny: ADR 0237 already made the per-type preset the opinion, and
 // today's opt-in catalog is two modules wide — so this table's job is to correct
-// a preset the owner's answer contradicts, not to re-derive it. The two rules that
-// added and removed `dev-box` by team shape went with the module (task 1003886):
-// a rule about a module nobody can select adjusts nothing.
+// a preset the owner's answer contradicts, not to re-derive it.
 //
 // A rule may only ever name an OPT-IN module. Adding or removing an always-on one
 // would be a toggle that toggles nothing (ADR 0237 §3's argument, and
@@ -193,10 +176,8 @@ const RULED_TEAM_SHAPES = Object.freeze([...new Set(TEAM_SHAPE_RULES.map((r) =>
 // The lists are SHORT on purpose. A preselect an owner has to audit is worse than
 // none, and today's opt-in catalog is genuinely small (`agents`, `discord`); a
 // bundle grows as the catalog does, which is exactly why this is a declaration and
-// not a rule engine. `dev-box` was preselected by the game and business bundles
-// until it was retired (goal 1000091, task 1003886) — withdrawing it left both
-// bundles one module wide, which is the floor working as intended, not a gap to
-// backfill with a module an owner did not ask for.
+// not a rule engine. A bundle one module wide is the floor working as intended,
+// not a gap to backfill with a module an owner did not ask for.
 const STARTER_BUNDLES = Object.freeze({
   game: Object.freeze({
     label: 'Game starter',
@@ -287,8 +268,8 @@ function adjustBundle(bundle, teamShape) {
   for (const rule of TEAM_SHAPE_RULES) {
     if (rule.teamShape !== teamShape) continue;
     if (rule.effect === 'add' && !held.has(rule.module)) held.add(rule.module);
-    // `remove` is declared but named by no live rule since dev-box was retired
-    // (task 1003886). Kept for the next rule that needs it, not exercised today.
+    // `remove` is declared but named by no live rule today. Kept for the next
+    // rule that needs it.
     else if (rule.effect === 'remove' && held.has(rule.module)) held.delete(rule.module);
     else continue;
     adjustments.push({ rule: rule.id, effect: rule.effect, module: rule.module, reason: rule.reason });
@@ -404,7 +385,6 @@ function effectiveModules(row) {
 module.exports = {
   ALWAYS_ON_CORE,
   HUB_ONLY_MODULES,
-  RETIRED_MODULES,
   OPTIONAL_MODULES,
   STARTER_BUNDLES,
   TEAM_SHAPE_RULES,

package/modules/public-landing/module.json

@@ -2,6 +2,7 @@
   "key": "public-landing",
   "title": "The front door",
   "description": "The instance's public front door served at the APEX ROOT — the landing page (/), the projects hub (/projects, and the /create redirect into its ?view=new wizard), the three footer doors (/privacy, /terms, /contact) and every asset behind them. The third WEB-SURFACE core-domain module after status-ui (BV1.R84) and hall-ui (BV1.R85), carved in task 1003322 (ADR 0218; named in ADR 0197 §8 — the front door keeps its own key, because a customer of the ui-design capability is not part of it). default-on: an instance ships its front door like it ships its hall. Registers no port and contributes no routes — it declares a webSurface, and where hall-ui and status-ui name a Host PREFIX this one declares apexRoot:true, since the apex is whatever host is left once the subdomains are taken (ADR 0218 §2; host:\"\" is rejected, because every host string startsWith \"\"). Like the hall, the declaration is the discovery + scope-map + window.__MODULES__ record: the bytes are served by platform-server.js's dedicated landing block, which keeps the apex-only sentinel strip, the branding-token stamp and the ?v= content stamp and only re-points its root at this module's public/ dir. Disabling the module removes the front door outright — the apex then answers the game-less 404 tail. The world it renders (DESIGN.md, the token contract, the direction records) is the INSTANCE's; the method for building one stays in modules/ui-design/.",
+  "version": "1.0.0",
   "coreVersion": "^1.19.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/public-landing/public/assets/cosmos.css

@@ -1598,7 +1598,7 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 /* the six-step strip as the rail: six hairlines, a 7px dot, one lit step on the
    accent with its halo, the number in the display voice, the name in the label
    face; a step already answered (role=button) stays a way back */
-#view-new .steps{display:grid;grid-template-columns:repeat(7,1fr);gap:0 10px;align-items:start;margin:0 0 40px;}
+#view-new .steps{display:grid;grid-template-columns:repeat(8,1fr);gap:0 10px;align-items:start;margin:0 0 40px;}
 #view-new .steps li{display:block;position:relative;border-top:1px solid var(--rule);padding:12px 0 0;gap:0;}
 #view-new .steps li::before{content:"";position:absolute;top:-4px;left:0;right:auto;width:7px;height:7px;margin:0;border-radius:50%;border:1px solid var(--rule);background:var(--bg);}
 #view-new .steps .snum{display:block;width:auto;height:auto;border:0;border-radius:0;background:none;font-family:var(--font-display);font-weight:300;font-size:22px;letter-spacing:-.02em;line-height:1.1;color:var(--ink-faint);margin-bottom:2px;}

package/modules/public-landing/public/contact.html

@@ -5,7 +5,7 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <!-- Server-stamped like index.html and projects.html (task 1003251): the {{…}}
      tokens are filled by landingPage() (src/platform-server.js) from the
-     instance's own branding, and every <!--apex-only--> region is REMOVED off
+     instance's own branding, and every apex-only:start/end region is REMOVED off
      the hub — a claim about the platform must not ship in a child project's
      page (task 1002748). The baked values are the NEUTRAL pack's.
      Both doors here are token-stamped: a pack that names no repository loses

package/modules/public-landing/public/privacy.html

@@ -5,7 +5,7 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <!-- Server-stamped like index.html and projects.html (task 1003251): the {{…}}
      tokens are filled by landingPage() (src/platform-server.js) from the
-     instance's own branding, and every <!--apex-only--> region is REMOVED off
+     instance's own branding, and every apex-only:start/end region is REMOVED off
      the hub — a claim about the platform must not ship in a child project's
      page (task 1002748). The baked values are the NEUTRAL pack's. -->
 <title>{{productName}} — Privacy</title>

package/modules/public-landing/public/projects.html

@@ -303,6 +303,20 @@ summary{min-height:24px;padding:3px 0;}
 .addrConfirm details .inner{margin-top:6px;}
 .addrOpt{display:flex;align-items:flex-start;gap:12px;margin-top:14px;font-size:14px;font-weight:400;color:var(--warn);line-height:1.5;cursor:pointer;}
 .addrOpt input{margin-top:4px;accent-color:var(--accent);}
+/* the app step (task 1004351, ADR 0345): the hall line, then one row per place the app
+   can run. A radio per row so the choice is native; "soon" is a row that is shown but
+   cannot be picked yet, and says so in words rather than by colour alone. */
+.appHall{font-size:14.5px;font-weight:400;color:var(--ink-soft);line-height:1.5;max-width:62ch;margin:0 0 18px;}
+.appHall b{color:var(--ink);font-weight:500;}
+.appOpts{border:0;padding:0;margin:0 0 14px;border-top:1px solid var(--rule);}
+.appOpts legend{font-family:var(--label-face);font-size:var(--label-size);letter-spacing:var(--label-space);text-transform:uppercase;font-weight:400;color:var(--ink-faint);padding:0;margin:0 0 10px;}
+.appOpt{display:flex;align-items:flex-start;gap:12px;min-height:24px;padding:14px 0;border-bottom:1px solid var(--rule);cursor:pointer;}
+.appOpt input{flex:none;width:18px;height:18px;margin:3px 0 0;accent-color:var(--accent);}
+.appOpt b{display:block;font-family:var(--font-body);font-size:15px;font-weight:500;color:var(--ink);margin-bottom:2px;}
+.appOpt span span{display:block;font-size:14px;font-weight:400;color:var(--ink-soft);line-height:1.5;max-width:62ch;}
+.appOpt.soon{cursor:default;}
+.appOpt.soon b{color:var(--ink-soft);}
+.appOpt .soonTag{display:inline-block;margin-left:8px;padding:0 8px;border:1px solid var(--rule-soft);border-radius:999px;font-size:12px;font-weight:500;line-height:1.6;color:var(--ink-soft);vertical-align:1px;}
 
 /* GitHub repo picker (task 1002099): hairline rows, the chosen one marked on
    the accent; the private badge in the label face */
@@ -893,7 +907,7 @@ summary{min-height:24px;padding:3px 0;}
         <div id="mMods"><p class="finePrint">Reading the project…</p></div>
         <details class="finePrint" id="mModsWhat">
           <summary>What an extra is — and what is always on</summary>
-          <p>Extras are the optional parts a project can run — a shared dev box, a Discord mirror, and the rest. You picked a set when you created the project, or took the suggested set by skipping that step; this is where you change your mind. Switching one on or off saves straight away and changes nothing that is already running: nothing restarts, and no work is lost either way. The parts every project runs — the platform itself, the way it tracks work, the builders’ hall — were never part of the choice, so they are not listed here and cannot be switched off.</p>
+          <p>Extras are the optional parts a project can run — extra AI agents, a Discord mirror, and the rest. You picked a set when you created the project, or took the suggested set by skipping that step; this is where you change your mind. Switching one on or off saves straight away and changes nothing that is already running: nothing restarts, and no work is lost either way. The parts every project runs — the platform itself, the way it tracks work, the builders’ hall — were never part of the choice, so they are not listed here and cannot be switched off.</p>
         </details>
       </div>
 
@@ -1019,7 +1033,8 @@ summary{min-height:24px;padding:3px 0;}
         <li data-step="4"><span class="snum">4</span><span class="slbl">Modules</span></li>
         <li data-step="5"><span class="snum">5</span><span class="slbl">Home</span></li>
         <li data-step="6"><span class="snum">6</span><span class="slbl">Address</span></li>
-        <li data-step="7"><span class="snum">7</span><span class="slbl">Create</span></li>
+        <li data-step="7"><span class="snum">7</span><span class="slbl">App</span></li>
+        <li data-step="8"><span class="snum">8</span><span class="slbl">Create</span></li>
       </ol>
 
       <div class="createSplit">
@@ -1301,14 +1316,44 @@ summary{min-height:24px;padding:3px 0;}
             </form>
           </section>
 
-          <!-- step 7 · review + create -->
+          <!-- step 7 · where the app runs (task 1004351, ADR 0345). The hall is ours to
+               host, so this step is only about the owner's APP. Render is listed but
+               cannot be picked until the connect flow lands (task 1004352), which
+               removes the "soon" state; "decide later" is the owner's ruling and is
+               always the default, so nothing here can block a Create. -->
+          <section class="panel" id="panel-app" aria-labelledby="app-h">
+            <h1 id="app-h">Where your app will run</h1>
+            <p class="appHall"><b>We host your Builders' hall</b> — the place where the project gets built — at the address you just chose. There is nothing for you to set up.</p>
+            <p class="lede">Your app is the thing the project builds. Choose where it should run, or decide later.</p>
+            <form data-next="8">
+              <fieldset class="appOpts" id="appOpts">
+                <legend>Where your app runs</legend>
+                <label class="appOpt soon" id="appOptRender">
+                  <input type="radio" name="appPlatform" value="render" disabled aria-describedby="appRenderWhat">
+                  <span><b>Render <span class="soonTag">Coming soon</span></b>
+                    <span id="appRenderWhat">We set your app up on your own Render account. You lend us your Render key once, and Render bills you directly.</span></span>
+                </label>
+                <label class="appOpt">
+                  <input type="radio" name="appPlatform" value="later" checked>
+                  <span><b>Decide later</b>
+                    <span>Create the project now. You can choose where your app runs afterwards.</span></span>
+                </label>
+              </fieldset>
+              <div class="nav">
+                <button type="button" class="btn ghost" data-back="6">← Back</button>
+                <button type="submit" class="btn">Next →</button>
+              </div>
+            </form>
+          </section>
+
+          <!-- step 8 · review + create -->
           <section class="panel" id="panel-review" aria-labelledby="rev-h">
             <h1 id="rev-h">Ready to roll</h1>
             <p class="lede">One tap files the request and the platform starts standing your project up — server, database, address. Here's the beat you're about to drop:</p>
             <ul class="review" id="reviewList"></ul>
             <div class="alert" id="createAlert" role="alert"></div>
             <div class="nav">
-              <button type="button" class="btn ghost" data-back="6">← Back</button>
+              <button type="button" class="btn ghost" data-back="7">← Back</button>
               <button type="button" class="btn big" id="doCreate">Create my project</button>
             </div>
             <p class="finePrint">This files the request; the control plane does the real standup and nothing touches servers from this page. You'll get the few steps only you can do right after.</p>
@@ -3238,7 +3283,7 @@ summary{min-height:24px;padding:3px 0;}
        reinterpreted — a stale step 4 meant Address under v1 and Home under v3,
        and replaying it would land on the wrong panel with the rail already
        marking the skipped ones done. Bump this key on EVERY renumbering. */
-    var DRAFT_KEY = 'cb-create-draft-v4';
+    var DRAFT_KEY = 'cb-create-draft-v5';
     var CREATED_KEY = 'cb-created-instance';
     /* `description` + `teamShape` are the optional About step (task 1002334) —
        both legitimately stay empty, and empty is what the create request omits. */
@@ -3247,7 +3292,7 @@ summary{min-height:24px;padding:3px 0;}
        request omits the field), [] = the owner switched them all off, [...] =
        what they picked. Never seed it with the preselect — that would store an
        answer nobody gave. */
-    var state = { step: 0, name: '', projType: null, description: '', teamShape: null, modules: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
+    var state = { step: 0, name: '', projType: null, description: '', teamShape: null, modules: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false, appPlatform: 'later' };
     try { Object.assign(state, JSON.parse(sessionStorage.getItem(DRAFT_KEY) || '{}')); } catch (e) {}
     var authKnown = false;   /* flips true when the boot's /me settles, either way */
 
@@ -3261,7 +3306,7 @@ summary{min-height:24px;padding:3px 0;}
         state.name = handedName.trim().slice(0, 80);
         state.slug = deriveSlug(state.name); state.slugTouched = false;
         state.repo = deriveRepo(state.name); state.repoTouched = false;
-        state.step = state.step >= 1 && state.step <= 7 ? state.step : 1;
+        state.step = state.step >= 1 && state.step <= 8 ? state.step : 1;
         try { sessionStorage.setItem(DRAFT_KEY, JSON.stringify(state)); } catch (e) {}
       }
     } catch (e) {}
@@ -3453,18 +3498,18 @@ summary{min-height:24px;padding:3px 0;}
     }
 
     /* ── step navigation ──
-       Eight steps since task 1002339: gate 0 · name 1 · type 2 · about 3 ·
-       modules 4 · home 5 · address 6 · review 7 · done 8 (the rail shows 1-7;
-       done marks it all). About and Modules are the two steps Next can pass with
+       Nine steps since task 1004351: gate 0 · name 1 · type 2 · about 3 ·
+       modules 4 · home 5 · address 6 · app 7 · review 8 · done 9 (the rail shows
+       1-8; done marks it all). About and Modules are the two steps Next can pass with
        nothing filled in. */
-    var panels = { 0: 'panel-gate', 1: 'panel-name', 2: 'panel-type', 3: 'panel-detail', 4: 'panel-modules', 5: 'panel-home', 6: 'panel-address', 7: 'panel-review', 8: 'panel-done' };
+    var panels = { 0: 'panel-gate', 1: 'panel-name', 2: 'panel-type', 3: 'panel-detail', 4: 'panel-modules', 5: 'panel-home', 6: 'panel-address', 7: 'panel-app', 8: 'panel-review', 9: 'panel-done' };
     /* the rail at the done panel (task 1003244): "done" is the Create step
        still running — the marker stays on 5 until the project actually
        answers, and only then does the whole rail read finished. aria-current
        tells a screen reader the same thing. */
     function paintRail(step) {
-      var landed = step === 8 && !!(live && live.instStatus === 'active');
-      var cur = step === 8 ? 7 : step;
+      var landed = step === 9 && !!(live && live.instStatus === 'active');
+      var cur = step === 9 ? 8 : step;
       root.querySelectorAll('.steps li').forEach(function (li) {
         var n = Number(li.getAttribute('data-step'));
         var now = !landed && n === cur;
@@ -3475,7 +3520,7 @@ summary{min-height:24px;padding:3px 0;}
            the button role, the tab stop and the data-goto the delegated handler
            below reads. The done panel offers none — the project is filed, and
            there is nothing behind it to change. */
-        if (step < 8 && n < cur) {
+        if (step < 9 && n < cur) {
           li.setAttribute('role', 'button');
           li.setAttribute('tabindex', '0');
           li.setAttribute('data-goto', String(n));
@@ -3494,7 +3539,7 @@ summary{min-height:24px;padding:3px 0;}
       paintRail(step);
       saveDraft();
       /* the done step takes the whole card — the bongo pair steps aside */
-      root.querySelector('.createSplit').classList.toggle('wizDone', step === 8);
+      root.querySelector('.createSplit').classList.toggle('wizDone', step === 9);
       /* focus moves ONLY on a deliberate step (the hub rule setView already
          applies to this view: never on boot, never on a background settle) */
       if (moveFocus) {
@@ -3510,12 +3555,13 @@ summary{min-height:24px;padding:3px 0;}
       if (step === 5) { syncHome(); if (authKnown) ensureRepoAccess(); }
       /* a resumed draft can land PAST the Home step with the probe never run —
          Create would then file a repo it promised to make but never did */
-      else if (step > 5 && step < 8 && authKnown && repoAccess === null) ensureRepoAccess();
+      else if (step > 5 && step < 9 && authKnown && repoAccess === null) ensureRepoAccess();
       /* re-check on every entry, not just on typing: a resumed draft arrives here with
          a handle nobody has asked the server about, and a handle free ten minutes ago
          may not be now (task 1002898 N10) */
       if (step === 6) { checkSlugAvailable(); renderAddrPanel(); }
-      if (step === 7) renderReview();
+      if (step === 7) syncAppStep();
+      if (step === 8) renderReview();
     }
 
     /* One delegated pair on the rail, so paintRail can add and drop data-goto
@@ -3709,7 +3755,7 @@ summary{min-height:24px;padding:3px 0;}
        prevent, one screen before Create. */
     function repaintForBundles() {
       if (state.step === 4) renderModules();
-      else if (state.step === 7) renderReview();
+      else if (state.step === 8) renderReview();
     }
     /* The row for the declared type, or null before the read lands / for a type
        the table has no row for (including no type at all). */
@@ -3742,8 +3788,8 @@ summary{min-height:24px;padding:3px 0;}
 
        The fallback is the point (task 1003684). `adjustments` is a DELTA: a rule that
        fires without changing anything claims nothing (ADR 0243). So for a type whose
-       bundle ALREADY contains what the rule would add — game is [dev-box, discord] and
-       the small-team rule adds dev-box — the delta is empty and the owner was shown a
+       bundle ALREADY contains what the rule would add — game is [discord] and the
+       community rule adds discord — the delta is empty and the owner was shown a
        tailored preselect with no reason beside it at all. That is the state ADR 0237
        calls worse than no preselect: one the owner has to audit. Each bundle carries a
        curated summary authored for exactly this, served on every row, and until now
@@ -4201,6 +4247,28 @@ summary{min-height:24px;padding:3px 0;}
     });
 
     /* ── review ── */
+    /* the app step (task 1004351): a native radio group, so the draft only mirrors it.
+       An older draft has no appPlatform, and a value this page does not offer (a
+       platform still marked soon, or one that was removed) reads as 'later' — the
+       review must never name a platform the owner could not actually pick. */
+    function appPlatformChoice() {
+      var want = state.appPlatform;
+      var pick = Array.prototype.filter.call(root.querySelectorAll('#appOpts input[name=appPlatform]'), function (i) {
+        return i.value === want && !i.disabled;
+      })[0];
+      return pick ? pick.value : 'later';
+    }
+    function syncAppStep() {
+      var pick = appPlatformChoice();
+      root.querySelectorAll('#appOpts input[name=appPlatform]').forEach(function (i) { i.checked = i.value === pick; });
+    }
+    function appRow() {
+      return appPlatformChoice() === 'render' ? 'Render, on your own account' : 'Not chosen yet — you can decide later';
+    }
+    var appOptsEl = root.querySelector('#appOpts');
+    if (appOptsEl) appOptsEl.addEventListener('change', function (ev) {
+      if (ev.target && ev.target.name === 'appPlatform' && !ev.target.disabled) { state.appPlatform = ev.target.value; saveDraft(); }
+    });
     function renderReview() {
       /* every road back to this step gets a live button — the create path
          disables it and only the failure branch used to restore it, which
@@ -4227,9 +4295,10 @@ summary{min-height:24px;padding:3px 0;}
         ['Address', resolvedDomain()
           ? '<code>' + esc(resolvedDomain()) + '</code>'
           : '<em style="font-weight:600;color:var(--warn)">none — sign-in stays locked until it has one</em>'],
-        /* The wizard creates hosting_shape 'cloud-host' — we stand it up and run it for
-           them. Since task 1004182 the stored value IS the owner-facing name (ADR 0323). */
-        ['Shape', 'Cloud host — we stand it up and run it for you, on the platform’s current release']
+        /* The wizard creates hosting_shape 'cloud-host', which since ADR 0345 means the
+           HALL is hosted by us; where the owner's APP runs is its own row (task 1004351). */
+        ['Builders\' hall', 'Hosted by us, on the platform’s current release'],
+        ['App', appRow()]
       ];
       $('reviewList').innerHTML = rows.map(function (r) {
         return '<li><span class="k">' + r[0] + '</span><span class="v">' + r[1] + '</span></li>';
@@ -4362,7 +4431,7 @@ summary{min-height:24px;padding:3px 0;}
           sessionStorage.removeItem(DRAFT_KEY);
         } catch (e) {}
         renderDone();
-        show(8, true);
+        show(9, true);
         startProgress(data.instance && data.instance.id);
       }).catch(function (err) {
         if (String(err && err.message) === 'signing in') return;
@@ -4935,7 +5004,7 @@ summary{min-height:24px;padding:3px 0;}
                5s tick never clobbers an open dropdown or mid-flight button) */
             if (inst && inst.status !== live.instStatus) {
               live.instStatus = inst.status; renderSteps();
-              if (state.step === 8) paintRail(8);   /* the rail finishes only when the project answers */
+              if (state.step === 9) paintRail(9);   /* the rail finishes only when the project answers */
             }
             var terminal = renderProgress(inst);
             if (!terminal) pollTimer = setTimeout(tick, 5000);
@@ -4975,7 +5044,7 @@ summary{min-height:24px;padding:3px 0;}
          is three-valued and null is its "nothing said" sentinel; leaving the key out
          left it UNDEFINED, which is not null — so pickedModules() reached .slice()
          on it and the second project's Modules step threw. */
-      state = { step: 1, name: '', projType: null, description: '', teamShape: null, modules: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
+      state = { step: 1, name: '', projType: null, description: '', teamShape: null, modules: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false, appPlatform: 'later' };
       $('newName').value = ''; $('f-owner').value = ''; $('f-repo').value = ''; $('f-slug').value = ''; $('f-domain').value = '';
       $('f-noaddr').checked = false; $('f-desc').value = '';
       /* Re-seed the owner from the signed-in account for the next project. */
@@ -5044,17 +5113,17 @@ summary{min-height:24px;padding:3px 0;}
            another project" the only way out.
 
        The reset fires only when there is a SECOND DRAFT to lose, and the draft's own
-       step is what says so. A landed create clears DRAFT_KEY — but show(8) then
+       step is what says so. A landed create clears DRAFT_KEY — but show(9) then
        persists the done panel's own position straight back into it, so "is there a
        draft?" is always yes and would have skipped the reset forever, leaving the
-       finished project's name sitting in the fresh form. Only steps 1–7 are wizard
+       finished project's name sitting in the fresh form. Only steps 1–8 are wizard
        steps: anything else is the done panel's bookkeeping, not a project someone
        is part-way through typing. */
     function enterCreated(created, focus) {
       if (focus && !resumeIntent) {
         var draft = null;
         try { draft = JSON.parse(sessionStorage.getItem(DRAFT_KEY) || 'null'); } catch (e) {}
-        var at = draft && draft.step >= 1 && draft.step <= 7 ? draft.step : 0;
+        var at = draft && draft.step >= 1 && draft.step <= 8 ? draft.step : 0;
         if (!at) { resetForNewProject(); at = 1; }
         paintResumeOffer(created);
         /* step 1's own focus target is the name field, not the heading — the same
@@ -5078,7 +5147,7 @@ summary{min-height:24px;padding:3px 0;}
         manifestState = created.manifest_state; manifestPending = true;
       }
       renderDone();
-      show(8, !!focus);
+      show(9, !!focus);
       startProgress(created.id);
       resumePolls();
     }
@@ -5095,7 +5164,7 @@ summary{min-height:24px;padding:3px 0;}
       /* before identity settles, never render past the name step: deeper steps
          carry authenticated side effects (the Home-step repo probe), and onAuth()
          re-enters to the real draft step the moment /me answers */
-      var step = authKnown && state.step >= 1 && state.step <= 7 ? state.step : 1;
+      var step = authKnown && state.step >= 1 && state.step <= 8 ? state.step : 1;
       if (step === 1) {
         /* Pre-auth, step 1 is a PLACEHOLDER, not where the visitor is — but show()
            persists whatever step it renders, so it used to overwrite the draft's real
@@ -5104,7 +5173,7 @@ summary{min-height:24px;padding:3px 0;}
            step back after rendering the placeholder, in memory AND in the draft. */
         var resumeStep = state.step;
         show(1, false);
-        if (!authKnown && resumeStep >= 1 && resumeStep <= 7) { state.step = resumeStep; saveDraft(); }
+        if (!authKnown && resumeStep >= 1 && resumeStep <= 8) { state.step = resumeStep; saveDraft(); }
         if (focus) $('newName').focus();
       } else {
         show(step, !!focus);

package/modules/public-landing/public/projects.probes.json

@@ -159,10 +159,10 @@
       "steps": [["wait",900],["click","[data-disc-ask]"],["wait",200],["fill","#mDiscName","old-lantern"],["wait",100],["click","[data-disc-yes]"],["wait",900]],
       "expect": {"text":[["#mDisc .addr","This project is being disconnected."],["#mName","old-lantern"]],"hidden":["#mDiscName","[data-disc-ask]"]} },
     { "name": "the wizard driver (task 1003346): name, type, about, home (fresh; the stub grants repo access, so the new repository is named from the project), address (the handle's verdict), the review as a ledger, then the filing — the done panel with the standup rail and the human steps", "auth": true, "width": 1440, "url": "/projects?view=new",
-      "steps": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500]],
+      "steps": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#panel-app button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500]],
       "expect": {"visible":["#panel-done","#liveProgress .prog","#liveProgress .prog .stages li.now","#humanSteps li"],"hidden":["#panel-review","#panel-name"],"text":[["#done-h","The drums are rolling"]],"attr":[["#panel-done","class","panel on"]]} },
     { "name": "the wizard driver at 390: the rail folds to two rows of three and the walk still reaches the review", "auth": true, "width": 390, "url": "/projects?view=new",
-      "steps": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400]],
+      "steps": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#panel-app button[type=submit]"],["wait",400]],
       "expect": {"visible":["#panel-review","#reviewList li","#doCreate"],"hidden":["#panel-address"],"text":[["#rev-h","Ready to roll"]]} }
   ]
 }

package/modules/public-landing/public/projects.states.json

@@ -36,9 +36,10 @@
     "in-new-modules-search": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["fill","#modQ","discord"],["wait",200]], "expect": {"visible":["#panel-modules","#modQ"],"value":[["#modQ","discord"]],"count":[["#modCards .tpill",1],["#modCards .tpill[data-mod=\"discord\"]",1]],"text":[["#modFilterNote","Showing 1 of 3. 2 extras are switched on, including any this search is hiding."]]} },
     "in-new-home": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-home"],"hidden":["#panel-detail","#qWrap"]} },
     "in-new-address": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-address"],"hidden":["#panel-home","#qWrap"]} },
-    "in-new-review": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-review","#reviewList li"],"hidden":["#panel-address","#qWrap"]} },
-    "in-new-done": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500]], "expect": {"visible":["#panel-done","#liveProgress .prog","#humanSteps li"],"hidden":["#panel-review","#qWrap"]} },
-    "in-new-resume-offer": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500],["click","#projTrig"],["wait",350],["click","#menuProjects [data-nav=\"new\"]"],["wait",500]], "expect": {"visible":["#panel-name","#wizResume","#wizResumeGo"],"hidden":["#panel-done"],"text":[["#wizResumeName","Mercury"]]} },
+    "in-new-app": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-app","#appOpts","#appOptRender .soonTag"],"hidden":["#panel-address","#panel-review","#qWrap"]} },
+    "in-new-review": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#panel-app button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-review","#reviewList li"],"hidden":["#panel-address","#qWrap"]} },
+    "in-new-done": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#panel-app button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500]], "expect": {"visible":["#panel-done","#liveProgress .prog","#humanSteps li"],"hidden":["#panel-review","#qWrap"]} },
+    "in-new-resume-offer": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#panel-app button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500],["click","#projTrig"],["wait",350],["click","#menuProjects [data-nav=\"new\"]"],["wait",500]], "expect": {"visible":["#panel-name","#wizResume","#wizResumeGo"],"hidden":["#panel-done"],"text":[["#wizResumeName","Mercury"]]} },
     "out-map-projects": { "auth": false, "actions": [["click", "#projTrig"], ["wait", 350]], "expect": { "expanded": true, "hidden": ["#menuProjects [data-nav=\"mine\"]"] } },
     "card": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://example.com\"]"], ["wait", 900]], "expect": { "dialog": true, "hasClass": [["#projCard", "has-art"]], "visible": ["#cardArt", "#cardFaces", "#cardBuildersFig", "#cardShippedFig", "#cardOpen", "#cardHall"], "text": [["#cardBuilders", "11"], ["#cardShipped", "0"], ["#cardRel", "you build here"], ["#cardRuns", "example.com"], ["#cardFaces .facesMore", "+6"]], "count": [["#cardFaces img", 5]], "href": [["#cardHall", "https://builders.example.com/"]] } },
     "card-noart": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://emersonian-circles.cloudbongos.com\"]"], ["wait", 600]], "expect": { "dialog": true, "hasClass": [["#projCard", "has-art", false]], "hidden": ["#cardArt", "#cardFaces", "#cardHall"], "visible": ["#cardBuildersFig", "#cardShippedFig", "#cardOpen"], "text": [["#cardShipped", "30+"], ["#cardRel", "you build here"]] } },

package/modules/public-landing/public/terms.html

@@ -5,7 +5,7 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <!-- Server-stamped like index.html and projects.html (task 1003251): the {{…}}
      tokens are filled by landingPage() (src/platform-server.js) from the
-     instance's own branding, and every <!--apex-only--> region is REMOVED off
+     instance's own branding, and every apex-only:start/end region is REMOVED off
      the hub — a claim about the platform must not ship in a child project's
      page (task 1002748). The baked values are the NEUTRAL pack's. -->
 <title>{{productName}} — Terms</title>

package/modules/security/module.json

@@ -2,6 +2,7 @@
   "key": "security",
   "title": "Security (red-team · bounty)",
   "description": "The red-team / vulnerability-report intake and the bounty payout system (rank-gated Metic+): the /builder-redteam skill files a report, the Archon dashboard adjudicates (confirm/dispute/fix/link-fix), and the env-aware bounty table sets the per-severity drachmae payout. A core-domain module carved out of the GDS core in BV1.R79 (ADR 0093 §1; 02-module-map §5 — security-the-FEATURE, NOT security-the-property, which stays kernel). default-on because every instance can take red-team reports. Registers the `security` kernel PORT the core /public/bounty-table resolves for the payout schedule. Also owns the scan-before-install surface (goal 1000055): the artifact-scan engine (quarantine/manifest/mirror) and the security_tool_scans record — POST Metic+, GET every rank.",
+  "version": "1.0.0",
   "coreVersion": "^1.8.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/sessions/db.js

@@ -187,7 +187,7 @@ async function syncSessionDrachmaeEarnedTx(client, builderId, sessionId) {
 // safe, and lets a later, costlier ship in the same session book its increment.
 // task 1676: pass totalTokens so the reward can fall back to pricing the
 // session's real token total when modelUsage is empty/unpriceable — the
-// dev-box/CI agent path that historically paid $0 cost-plus (ADR 0097).
+// CI agent path that historically paid $0 cost-plus (ADR 0097).
 async function awardSessionTokenRewardTx(client, { builderId, sessionId, modelUsage, totalTokens }) {
   const reward = seams.resolveOptional('reward');
   if (!reward) return { drachmae: 0, trueCostUsd: 0, awarded: false, unknownModels: [], deferred: false };

package/modules/sessions/module.json

@@ -2,6 +2,7 @@
   "key": "sessions",
   "title": "Sessions & BFG (session corpus · efficiency eval)",
   "description": "The session-records corpus + its data plane (POST /sessions upload, the Archon-gated cross-builder /sessions/search + /sessions/:id deep-dive + /sessions/upload-health, the server-side signal that a builder's session uploads have silently stopped), the BFG 'read-the-room' cross-builder scorer (ADR 0026 §6B), and the session-pulse / stale-claim heartbeat helpers. A core-domain module carved out of the GDS core in BV1.R82 (ADR 0093 §1); default-on because every instance records its builders' sessions for the BFG. Like the memory module, sessions registers no port — core never calls back into it: the ship-time digest write is an HTTP POST to the module's own /sessions route, and the only outward dependency is the economy `reward` kernel PORT it resolves (session token reward + sumCreditsForTasks) at upload time.",
+  "version": "1.0.0",
   "coreVersion": "^1.10.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/specialities/module.json

@@ -2,6 +2,7 @@
   "key": "specialities",
   "title": "Role sub-specialities (harnesses)",
   "description": "Role SUB-SPECIALITIES — a named bundle of knowledge, skills and an interaction contract that sits UNDER a craft (task 1003855; ADR 0296). A craft says how you work (engineer / ideator / artist / ui); a speciality says what you work ON and how a subject-matter expert wants to be engaged inside it. Deliberately a thin layer over three surfaces that already exist — discipline-modes.json for craft->playbook, behavior_prefs.interaction for the per-session contract (a speciality contract rides that SAME GET /me -> Conductor path rather than adding a second one), and the ADR 0083 manifest for declared skills; the only new machinery is the knowledge bundle. Training is two-fold per the owner's 2026-09-17 ruling: documents the builder supplied, plus learnings captured from sessions worked in the speciality (pointing at existing `learnings` rows, never a second corpus). Owned per-builder OR per-project, each carrying its owner's sharing decision (private / project / public) and an explicit sellable flag — the flag records intent only, because ADR 0107 defers the marketplace and there is nothing to list on. default-on: a speciality is how an instance's expertise enters the platform, so it ships like the hall and the status page.",
+  "version": "1.0.0",
   "coreVersion": "^1.19.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/status-ui/module.json

@@ -2,6 +2,7 @@
   "key": "status-ui",
   "title": "Status dashboard (\"The Watch\")",
   "description": "The public build-status dashboard served at status.<apex> (status.example.com) — the live up/down banner, version-progress rollups, cost summary, recent ships, leaderboard, and the ecosystem fingerprint, all polling the read-only /api/bongos/public/* surface every 60s. A WEB-SURFACE core-domain module carved out of the GDS core in BV1.R84 (ADR 0093 §1; 02-module-map §6 — a web surface is first-class). default-on: a Cloud Bongos instance ships its status page like it ships its hall. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir) the loader hands serve-internal, which serves the module's public/ dir on the matching host exactly as it served public-status/ before. The public read endpoints it renders stay SHARED core in routes/public.js (the hall + the off-box mirror read them too).",
+  "version": "1.0.0",
   "coreVersion": "^1.11.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/ui-design/module.json

@@ -2,6 +2,7 @@
   "key": "ui-design",
   "title": "UI design (the design contract, its adapters and sync, the /design playbook, the kit, the skills, the styles)",
   "description": "The platform capability that lets any builder on any instance create and design good-looking, functional UIs in line with that instance's world (scoped with the owner 2026-08-28; task 1003324, ADR 0197). It ships METHOD and never a world: the neutral design contract of ADR 0081 with its tool adapters (Claude Design, Figma), their sync CLIs and the validator; the /design playbook for ui-discipline work; and the reserved homes for the look-before-you-ship kit (kit/), the vetted UI skills (skills/) and the style library (styles/) the sibling tasks land. The instance's world — its branding pack, config/design-tokens.*, config/design-sources.json and its DESIGN.md — stays in config/ and at the repo root as the host boundary this module reads and never owns (ADR 0062 §7). Cloud Bongos's own front door is this module's first customer, not its owner. default-on because every instance has a face. No routes, no migrations, no port: declaration-only like character-anim, so disabling it withdraws only the skills it contributes and touches no served surface.",
+  "version": "1.0.0",
   "coreVersion": "^1.19.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },