@bongos/core 1.19.108 → 1.19.109

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.108",
-  "core_contract": "1.19.108",
-  "source_commit": "bafad9a6b64800aa591f105f14a5a67cf39a54d9",
+  "core_version": "1.19.109",
+  "core_contract": "1.19.109",
+  "source_commit": "9e8a3444891adec77e52aecda57d21cd47e0e408",
   "source_ref": "HEAD",
-  "built_at": "2026-08-14T13:14:28.346Z",
+  "built_at": "2026-08-14T14:23:16.828Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 301,
+    "docs_redacted": 302,
     "agent_docs_stubbed": 21,
     "functional_verbatim": 1236,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1558,
-  "tree_sha256": "7130b0e01712f13175140a4ddc52041177b8f660fab0029699212a445ebf59ad",
+  "file_count": 1559,
+  "tree_sha256": "68310c0ca0be28e5eff0b8b223ba78bf5edbd24e7dd79018d6ac283656eaeef1",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1324,10 +1324,15 @@
       "mode": "0000644",
       "sha256": "fe1c4b38b9b3eef60ecd00ecc35eb6086690350a022d2c376d1432c95c9452f7"
     },
+    {
+      "path": "docs/adr/0170-featured-projection-honest-facts.md",
+      "mode": "0000644",
+      "sha256": "165324f1fe4fe9a532b5a068a2713bd127d1d9e5926d3964869808ee1af1db47"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "529d997cf39669fe80bf0fb9a02c546adbb6ba139d4f8dad8de4f59932c47a95"
+      "sha256": "f9bba0779b60b4a9f3014e63d49f4d5518439021f02cbab2e08d02d574edd108"
     },
     {
       "path": "docs/api-reference.md",
@@ -3747,7 +3752,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "2b3b1fe16be0653d498452d560521ef8ad48e359f13a1f76227f9ed94ece6f2d"
+      "sha256": "2a0ee2667f79cbe8eaeb1dfb47b0c518bd969e80a60e42e0f709fa83365f908e"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -3757,7 +3762,7 @@
     {
       "path": "modules/platform-identity/project-stats.js",
       "mode": "0000644",
-      "sha256": "6ce71a9bd387a2b79d4c57a6669f028a807ef88ff205f65c20c55ce3d9889214"
+      "sha256": "f3d8b2ed8bc5a32dabcbdd628fd4a504a8d91e2e2ea282a2ad2c88083f88b4e8"
     },
     {
       "path": "modules/platform-identity/routes/my-projects.js",
@@ -3767,7 +3772,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "188583ffb979d305c57a8f0958806ee0bd813007df158d74e45a0d415a3ff6aa"
+      "sha256": "3222e294691563874be9b19dda57fe879b29d0bd174edef06f6db0f483863b11"
     },
     {
       "path": "modules/platform-identity/routes/scouting.js",
@@ -3782,7 +3787,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "ead831bcf55ddf1adb247028be011d8a5a8020757e5e0e7ca49d633cecac91b0"
+      "sha256": "7766d918d22a2d73f9275ab07d6273b66fc0cdcdc6d2952986e01bab265344d2"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -4147,12 +4152,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f205db41eab8846e667c61aad6739b8194db55326d38562f0e6a674ecb0cd8ce"
+      "sha256": "0ad9780c25eeea40f124f750d54beeafdb191b1c6ae104754b482eae04766059"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "afc15cf17f555b46d2e616cea755061e6d6751e06b582ad9253ff9dc257a203d"
+      "sha256": "0654f3a21beb49226093259215e4baaaeb1616230b7cb86223338d41b79cf546"
     },
     {
       "path": "public-docs/index.html",
@@ -4392,7 +4397,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "e5bfd01db8cca1cb28c2d5c2382a401a2ee882cb1a219ed5553d578f2e3952b6"
+      "sha256": "caaae45a551f60c501f68d188b2163819fd93c4aff45e341c41098865e413c03"
     },
     {
       "path": "public-landing/buddha.png",
@@ -4412,7 +4417,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "e6e951af6fc202a2d90accef69e32da7d8a3456b80a6fcdbce469274edb49bce"
+      "sha256": "11d478f2f60c4cafba0eed25e4d56a561fc9d2aef4edb4c7a568040109caf191"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5727,7 +5732,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "309c33b07e1c5391726d8bf73d2c0d595cab3b9624244df0f7cd8fcbe068e3a5"
+      "sha256": "5bda15ba1c10ee2642f8db5e3d1411eb4dfeefa1858eb74af2aa5f84b37d497f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6892,7 +6897,7 @@
     {
       "path": "tests/landing_page.mjs",
       "mode": "0000644",
-      "sha256": "be7364e749e00920e65f16ca685bee1e068d62adf9dc9ed0817381f2d0af4c7e"
+      "sha256": "89a9d21ee1c5b00ee09de2d888873fa13c1b2b6d15ab05a6bfeb7e7a5d016a03"
     },
     {
       "path": "tests/lifecycle-card.mjs",
@@ -7247,12 +7252,12 @@
     {
       "path": "tests/project_stats.mjs",
       "mode": "0000644",
-      "sha256": "21bd2a2d0ebb234cd3b9770d126e77ce48f5c630fe7deee2585706d4eb072b53"
+      "sha256": "6bd78c47b6dbbdd81f862df8afdc0b514e27f0ffb71d14161ac8feb19f9fbe19"
     },
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "6ddec55050ca5864670d02caad6ede76e5e0753afb1e5636036b75d4185e9427"
+      "sha256": "9a4de4c40bf9272143e3098c80fa8d8473ae2b441a0f8f6746c50431bfb12d9f"
     },
     {
       "path": "tests/provision.mjs",

package/docs/adr/0170-featured-projection-honest-facts.md

@@ -0,0 +1,24 @@
+# 0170 — The featured projection tells time honestly: `created_at` in, `updated_at` out, owner from the project's own archon
+
+- **Status:** Accepted
+- **Date:** 2026-08-14
+- **Task:** [#1002778](https://cloudbongos.com/builders#/task/1002778) (goal 1000061 — the front door and the project hub)
+- **Extends:** the C6 honesty rule ([`docs/design/projects-hub-direction.md`](../design/projects-hub-direction.md) §7) and the self-report enrichment pattern of task 1002771 (`project-stats.js`).
+
+## Context
+
+Task 1002778 enriches the hub's project card with real metadata. Its brief listed `updated_at` under "already available, no new plumbing: add it to the public projection", and offered two owner options: "resolve it to a real login + avatar via the project's own API, or omit the field until it can be answered." Implementation surfaced facts that changed both calls, and this ADR records the deviations so they are decisions, not drift.
+
+## Decision
+
+**1. `created_at` joins the public `/projects/featured` projection, labelled "Listed" — never "Created".** The column is set once by `DEFAULT now()` on INSERT and never touched again: it is the moment the hub first catalogued the row, not when the project began (Example predates its row by months). The card wears the honest label, and the C6 card test bans the word "Created" outright.
+
+**2. `updated_at` stays OUT of the projection, deviating from the task brief.** Reading the code showed the column is bumped by `upsertProject`'s ON CONFLICT branch — which fires on **every client re-registration and secret rotation** — and by `setProjectFeatured`, the Archon's own curation toggle. As a public "last updated" it would claim project activity while actually reporting curation noise: a project's timestamp would refresh because someone clicked "feature". Publishing it would be the same class of lie the em-dash rules exist to prevent. The projection test now pins the SELECT list itself (`updated_at` may sort, never project; `SELECT *` is banned — the route is CORS-open and rank:public, so a star projection would leak `owner_github_id` and `status`).
+
+**3. The owner fact is the project's own archon row — `owner_github_id` stays unread.** The catalog's `owner_github_id` calls itself "advisory attribution (not an authority)" in its own migration, is NULL on most live rows, and the design contract forbids reading it. But the leaderboard payload `project-stats.js` already downloads for the builders count carries `rank`, `github_login`, and `avatar_url` per row — and this platform's own vocabulary defines the archon as the instance's owner (`selfRel()`: "Archon is the instance's owner"). So the enrichment surfaces the archon row's login + avatar: the project's own authority answering for itself, zero extra requests, the 2-fetch-per-origin pin intact. Values are type-checked and length-capped server-side (third-party payload), and the avatar URL is scheme-checked again client-side before it becomes an `<img>`.
+
+## Consequences
+
+- Every card fact is something some authority actually asserted; unknowns hide rather than dash. A "last updated" fact can return later if a project's **own** API ever reports real activity recency (e.g. newest `shipped_at` from `/public/recent-shipped`) — that would be a third fetch and needs the test pin moved deliberately.
+- On a multi-archon instance the top-credits archon is named; a zero-credit archon on a page-capped leaderboard can fall off, which renders as **no owner shown**, never a wrong one.
+- The hub republishes a login the source project already serves unauthenticated at `/api/bongos/public/leaderboard` — aggregation, not new disclosure (grader-reviewed).

package/docs/adr/README.md

@@ -243,5 +243,6 @@ This keeps the decision history honest and traceable.
 | 0168 | [**The scaffold vendors the hub's RUNNING core (`npm pack` of the installed package); registry-default deferred to the go-public step** ([task 1002706](https://cloudbongos.com/builders#/task/1002706); gap 13 of the project-creation audit). Two collided facts: children were born pinned to a frozen `file:vendor/bongos-core-1.19.2.tgz` (installedCoreTarball reuses the hub's own file: pin — task 1002275 — and the hub's pin sat at 1.19.2), and the task-1002621 registry cutover (hub pin now `"@bongos/core": "1.19.56"`, verified on the box) made installedCoreTarball return null — dropping the scaffold into the package-core.js source rebuild that ABORTS on a consumer instance (empty core set → empty child repo, the 1002275 failure resurrected). Fix: a three-rung ladder — file:-pin reuse → NEW `installedCorePackDir()` + `npm pack` of the hub's installed core (child pins the SAME, CURRENT core, stays file:-pinned, owner needs no token) → source rebuild. The brief's "make registry the default now that the package is public" was verified FALSE (both npm scopes 404 anonymously; ADR 0134 keeps them private until go-public) — a registry-default child would be born UNINSTALLABLE for a tokenless owner. Registry-default is deferred to the go-public step (idea 1000700); the gap-13 "flip the box env" ops leg is explicitly a no-op until then; child freshness rides this ladder + the hub-pin lane (task 1002708). Rejected: registry-default now, dropping NPM_TOKEN, vendoring from the npm cacache.](<redacted>.md) | provisioning / distribution |
 | 0167 | [**The /create gate trust link defaults to the AGPL-3.0 license text, not the npm package page** ([task 1002705](https://cloudbongos.com/builders#/task/1002705); gap 1 of the project-creation audit). The gate's "open source" link pointed at a nonexistent repo (404); the task brief's suggested default — the npm package page — is ALSO dead for the gate's actual audience (signed-out visitors): `@cloudbongos/core` and `@bongos/core` both 404 anonymously (private scopes, ADR 0134), and the ADR 0099 public mirror stays dormant until ~2026-11. The license text is the one live, instance-neutral artifact behind the claim today. The browsable-code upgrade is the owner's filed choice (idea 1000700): public repo now (forfeits the ADR 0065 §4 redaction window) / public npm package / wait for the mirror. Rejected: the npm link (verified dead), flipping the repo public (not a builder's call), plain unlinked text (less information, same cost).](<redacted>.md) | public landing / governance |
 | 0169 | [**`bongos serve`: the `bongos dev` boot path, on a real host** ([task 1002398](https://cloudbongos.com/builders#/task/1002398), goal 1000052). [ADR 0149](<redacted>.md) gave an owner one command to stand an instance up on their laptop; "now put it on a server" had no equally good answer — Docker serves the *vanilla* brand on `:3000`, `bongos onboard` provisions a whole droplet through the control plane, and [`instance-deploy.md`](../recipes/instance-deploy.md) left the systemd unit as a hand-written prose step. The six steps (deps → Postgres → createdb → migrate → env → server → health) were already right for a host; only four *decisions inside them* were laptop-shaped. So: a `--server` **mode** on the same script (`bongos serve`), never a second boot path, so the two can't drift. (1) **Supervision** — a systemd unit (`Restart=always`, `WantedBy=multi-user.target`) instead of a pid file that dies on reboot, falling back to the pid-managed process where systemd is absent rather than refusing. (2) **Bind address, derived from the origin** — `https://…` means a proxy terminates TLS, so bind `127.0.0.1`; plain `http://` on a public host means nothing is in front, so bind `0.0.0.0`. The common misconfiguration (app publicly reachable on its raw port behind a proxy) becomes impossible by default. (3) **Peer-auth bootstrap** — a fresh `apt-get install postgresql` cluster has only the `postgres` role, so a deploy user's `createdb` fails with `role "deploy" does not exist`; that reads like a broken install and is really an unbootstrapped cluster, so we create the login role as the superuser. (4) **Health means the PUBLIC origin** — the loopback probe proves the app; DNS/proxy/TLS are where a host actually fails, so it probes the advertised origin too and names the missing layer (advisory — DNS may legitimately not be wired). Secrets go to a root-owned `0600` `EnvironmentFile`, never `Environment=` (`systemctl show` leaks those, and the laptop path's `buildEnv()` spreads the caller's whole shell). Every decision is a pure injectable in `dev-lib.js`, proved in `tests/dev_lib.mjs` with no host. Rejected: a separate `deploy.sh` (drift — the point is the *same* six steps), Docker-on-the-host (makes brand+port a compose override), always binding `0.0.0.0` (exposes the raw port), refusing without systemd (breaks containers/BSD).](<redacted>.md) | onboarding / deploy |
+| 0170 | [**The featured projection tells time honestly: `created_at` in, `updated_at` out, owner from the project's own archon** ([task 1002778](https://cloudbongos.com/builders#/task/1002778), goal 1000061). The hub card's metadata pass added `created_at` to the public `/projects/featured` projection, labelled **Listed** — it is the moment the hub catalogued the row, never when the project began, and the C6 card test bans the word "Created". Two recorded deviations: (1) the task brief said `updated_at` was ready to add, but the column is bumped by every client re-registration AND the Archon's feature toggle, so as a public "last updated" it would report curation noise as project activity — it may sort, never project, and the test pins the SELECT list itself (`SELECT *` banned: the route is CORS-open rank:public and a star would leak `owner_github_id`/`status`). (2) The owner fact reads the project's OWN leaderboard archon row (login + avatar, type-checked and capped) from the payload project-stats already fetches — zero extra requests, the 2-fetch pin intact, the advisory `owner_github_id` column still unread per the design contract. Multi-archon: top-credits archon is named; a fallen-off-the-page archon renders as no owner shown, never a wrong one. Rejected: projecting `updated_at` as asked (it lies), reading `owner_github_id` (advisory, contract-banned), a third per-origin fetch for activity recency (moves the test pin for a fact nobody asked for yet).](<redacted>.md) | platform identity / public surface |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/modules/platform-identity/platform-identity.js

@@ -238,10 +238,14 @@ async function getProject(id, { pool = defaultPool } = {}) {
 }
 
 // The PUBLIC Explore listing — featured + active projects only, public projection
-// (no owner_github_id, no status). Newest first.
+// (no owner_github_id, no status). Newest first. created_at is the LISTED date —
+// when the hub first catalogued the row, not when the project began — and the
+// card labels it "Listed" for exactly that reason (task 1002778). updated_at may
+// sort but is never projected: feature toggles and client re-registration bump
+// it, so as a public "last updated" it would lie.
 async function listFeaturedProjects({ pool = defaultPool } = {}) {
   const { rows } = await pool.query(
-    `SELECT origin, name, tagline, art_url
+    `SELECT origin, name, tagline, art_url, created_at
        FROM platform_identity_projects
       WHERE featured = true AND status = 'active'
       ORDER BY updated_at DESC`,

package/modules/platform-identity/project-stats.js

@@ -136,8 +136,26 @@ async function fetchStats(origin) {
   ]);
 
   let builders = null;
+  let owner = null;
+  let ownerAvatar = null;
   if (lb.status === 'fulfilled' && Array.isArray(lb.value?.leaderboard)) {
-    builders = lb.value.leaderboard.filter((b) => !isSystemAccount(b?.github_login)).length;
+    const people = lb.value.leaderboard.filter((b) => !isSystemAccount(b?.github_login));
+    builders = people.length;
+    // The archon row IS the instance's owner — the project's own authority
+    // answering for itself, from a payload already in hand (ADR 0170). The
+    // catalog's owner_github_id ("advisory attribution (not an authority)")
+    // stays unread. Caveat: the leaderboard is credits-ordered and page-capped,
+    // so a zero-credit archon on a very large instance can fall off it — that
+    // renders as no owner shown, never as a wrong one.
+    // The payload is third-party: accept only a plausible login string (GitHub
+    // caps logins at 39 chars; 64 leaves headroom without hosting a novel),
+    // and only an http(s) avatar URL — the client scheme-checks again before
+    // it becomes an <img>.
+    const arch = people.find((b) => b?.rank === 'archon');
+    const login = arch?.github_login;
+    owner = typeof login === 'string' && login ? login.slice(0, 64) : null;
+    const av = arch?.avatar_url;
+    ownerAvatar = owner && typeof av === 'string' && /^https?:\/\//.test(av) ? av.slice(0, 300) : null;
   }
 
   let tags = null;
@@ -149,7 +167,7 @@ async function fetchStats(origin) {
       .sort();
   }
 
-  return { builders, tags };
+  return { builders, tags, owner, owner_avatar: ownerAvatar };
 }
 
 function refresh(origin) {
@@ -163,7 +181,7 @@ function refresh(origin) {
       // Remember the FAILURE for a full TTL too. Without this a permanently
       // unreachable project is re-fetched on every request and pays the timeout
       // every time — the exact way one dead project slows the whole page.
-      const stats = { builders: null, tags: null };
+      const stats = { builders: null, tags: null, owner: null, owner_avatar: null };
       _cache.set(origin, { at: Date.now(), stats });
       return stats;
     })
@@ -197,7 +215,7 @@ async function getProjectStats(origins = []) {
   // null-prototype: an origin literally equal to '__proto__' would otherwise
   // retarget the object's prototype instead of adding a key
   const out = Object.create(null);
-  for (const origin of origins) out[origin] = _cache.get(origin)?.stats || { builders: null, tags: null };
+  for (const origin of origins) out[origin] = _cache.get(origin)?.stats || { builders: null, tags: null, owner: null, owner_avatar: null };
   return out;
 }
 

package/modules/platform-identity/routes/projects.js

@@ -119,6 +119,8 @@ module.exports = function projectsRoutes() {
           ...p,
           builders: stats[p.origin]?.builders ?? null,
           tags: stats[p.origin]?.tags ?? null,
+          owner: stats[p.origin]?.owner ?? null,
+          owner_avatar: stats[p.origin]?.owner_avatar ?? null,
         })),
       });
     } catch (err) {

package/modules/platform-identity/tests/platform-identity.mjs

@@ -198,12 +198,22 @@ await ta('upsertProject upserts on normalized origin; update preserves tagline/a
 });
 
 await ta('listFeaturedProjects returns a PUBLIC projection (featured+active only, no owner/status)', async () => {
-  const pool = mockPool([{ rows: [{ origin: 'https://p', name: 'Proj', tagline: 't', art_url: null }] }]);
+  const pool = mockPool([{ rows: [{ origin: 'https://p', name: 'Proj', tagline: 't', art_url: null, created_at: '2026-08-01T00:00:00Z' }] }]);
   const out = await P.listFeaturedProjects({ pool });
   assert.equal(out.length, 1);
   const c = pool.calls[0];
   assert.match(c.text, /WHERE featured = true AND status = 'active'/);
+  // Pin the SELECT LIST itself, not the whole query — an ORDER BY mention must
+  // not satisfy a projection guard, and SELECT * must never sneak owner/status
+  // onto a CORS-open rank:public route.
+  const sel = (c.text.match(/SELECT([\s\S]*?)FROM/i) || [, ''])[1];
+  assert.ok(sel.trim(), 'the projection is an explicit SELECT list');
+  assert.doesNotMatch(sel, /\*/, 'no star projection on a public route');
+  assert.match(sel, /created_at/, 'the LISTED date (when the row was catalogued) is public');
   assert.doesNotMatch(c.text, /owner_github_id/, 'public projection must not leak owner id');
+  // updated_at may sort (ORDER BY) but never project: it is bumped by feature
+  // toggles and client re-registration, so as a public fact it would lie.
+  assert.doesNotMatch(sel, /updated_at/, 'updated_at is curation noise — never projected');
 });
 
 await ta('setProjectFeatured flips the flag (Archon curation)', async () => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.108",
+  "version": "1.19.109",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.108",
+      "version": "1.19.109",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.108",
+  "version": "1.19.109",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -581,6 +581,17 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   border-radius:999px;background:var(--accent-soft);color:var(--accent-deep);margin-bottom:18px;}
 :root[data-mode="dark"] .projCard .cardRel{color:var(--sun-lit);}
 @media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .projCard .cardRel{color:var(--sun-lit);}}
+/* the facts strip (task 1002778): a label/value grid, centered as a block but
+   read left-aligned. A hidden pair leaves no gap — the grid row collapses. */
+.projCard .cardMeta{display:grid;grid-template-columns:auto auto;justify-content:center;
+  gap:6px 14px;margin-bottom:18px;text-align:left;}
+.projCard .cardMeta dt{font-family:var(--font-mono);font-size:11px;letter-spacing:.04em;
+  text-transform:uppercase;color:var(--ink-faint);align-self:center;}
+.projCard .cardMeta dd{font-size:13.5px;color:var(--ink-soft);font-weight:600;}
+.projCard .cardMeta .ownerAv{width:16px;height:16px;border-radius:50%;vertical-align:-3px;margin-right:6px;}
+.projCard .cardMeta .tags{display:flex;gap:6px;flex-wrap:wrap;}
+.projCard .cardMeta .tags span{font-family:var(--font-mono);font-size:10.5px;padding:2px 8px;
+  border-radius:999px;border:1px solid var(--line);color:var(--ink-faint);white-space:nowrap;}
 .projCard .cardActions{display:flex;gap:10px;justify-content:center;flex-wrap:wrap;}
 .projCard .cardX{position:absolute;top:10px;right:12px;width:30px;height:30px;border-radius:50%;
   border:none;background:none;cursor:pointer;font-size:14px;color:var(--ink-faint);line-height:1;}

package/public-landing/projects.html

@@ -213,6 +213,19 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       <h3 id="cardName"></h3>
       <p class="cardTag" id="cardTag"></p>
       <p class="cardRel" id="cardRel" hidden></p>
+      <!-- The facts strip. A definition list, never nested block wrappers, on
+           purpose: the C6 card test slices the card non-greedily up to the
+           first adjacent pair of closing wrapper tags, and a nested wrapper
+           would silently shorten what that test guards. A fact with no answer
+           hides, label and value together, because "Owner: dash" on the most
+           authoritative-looking element of the page reads as broken, not
+           honest (task 1002778). -->
+      <dl class="cardMeta" id="cardMeta" hidden>
+        <dt id="cardBuildersL" hidden>Builders</dt><dd id="cardBuilders" hidden></dd>
+        <dt id="cardRunsL" hidden>Runs</dt><dd id="cardRuns" hidden></dd>
+        <dt id="cardOwnerL" hidden>Owner</dt><dd id="cardOwner" hidden></dd>
+        <dt id="cardListedL" hidden>Listed</dt><dd id="cardListed" hidden></dd>
+      </dl>
       <div class="cardActions" id="cardActions"></div>
     </div>
   </div>
@@ -511,8 +524,10 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
      The public catalog: GET /projects/featured is the PUBLIC projection
      (featured + active only, no auth), which is what lets a signed-out visitor
      land on the map at all. The richer GET /projects needs project.curate and
-     would 401 them. It carries origin/name/tagline/art_url and nothing else —
-     so builders, type and tags render as "—" rather than as invented values.
+     would 401 them. It carries origin/name/tagline/art_url/created_at plus
+     the builders/tags/owner each project's OWN public API reports (task
+     1002778) — anything a project could not report renders as a dash or hides,
+     never as an invented value.
      The orbs are placed on fixed slots: where things sit is this pass; how the
      sky moves is goal 1000031. ══ */
 
@@ -604,11 +619,14 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
   /* A tag is a module the project RUNS beyond the core set — a fact it declares
      about itself, not a guess about what it is. Capped so one heavily-moduled
      project cannot blow the column open; the overflow is counted, never hidden
-     silently. null = we could not ask (em dash); [] = asked, runs nothing beyond
-     core, which is a real answer and still reads as a dash in the cell. */
+     silently. null = we could not ask (em dash); [] = asked, runs nothing
+     beyond core — a real answer, voiced as "core" (the owner's call,
+     2026-08-14) so a vanilla instance stops reading as a fetch failure. One
+     formatter, two views: the table cell and the card must never disagree. */
   var TAG_CAP = 3;
   function tagsHtml(tags) {
-    if (!Array.isArray(tags) || !tags.length) return '—';
+    if (!Array.isArray(tags)) return '—';
+    if (!tags.length) return 'core';
     var shown = tags.slice(0, TAG_CAP).map(function (t) { return '<span>' + esc(t) + '</span>'; });
     if (tags.length > TAG_CAP) shown.push('<span>+' + (tags.length - TAG_CAP) + '</span>');
     return '<span class="tags">' + shown.join('') + '</span>';
@@ -791,11 +809,14 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
      2026-08-13. The card is layered OVER the links rather than replacing them,
      so ctrl/middle-click still opens a project's site directly.
 
-     It states only what the public catalog actually carries — name, tagline,
-     your relationship, a door — because /projects/featured selects four columns
-     and cannot answer anything richer for a catalog row (task 1002744 owns that
-     data path). A card that showed builders or liveness here would be inventing
-     both, the same C6 lie the table's em dashes exist to avoid. ══ */
+     It states what the catalog and the project ITSELF can answer: name,
+     tagline, your relationship, a door — and, when known, builders, runs,
+     owner and the Listed date (task 1002778). Builders/runs/owner are each
+     project's own public API answering for itself (project-stats.js); Listed
+     is created_at, when the hub catalogued the row — NOT when the project
+     began, which is why the label is never "Created". Liveness stays out: a
+     catalog row is never probed, and a chip here would be the C6 lie the
+     table's em dashes exist to avoid. An unanswerable fact hides. ══ */
 
   var cardReturn = null;   /* the element focus came from, to hand it back */
 
@@ -804,6 +825,26 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     return null;
   }
 
+  /* The owner fact is a login and, when the project reported one, an avatar.
+     Both arrive from a third-party payload: the login is escaped, the avatar
+     URL scheme-checked (a javascript: URL must never become an img src). */
+  function ownerHtml(p) {
+    if (!p.owner) return '';
+    var av = safeHttpUrl(p.owner_avatar);
+    return (av ? '<img class="ownerAv" src="' + esc(av) + '" alt="" loading="lazy">' : '') +
+      '<span>' + esc(String(p.owner)) + '</span>';
+  }
+
+  /* A fact either has an answer or takes no space: value and label hide as a
+     pair. Every field is re-written on every open — closeCard() clears nothing,
+     so a stale value would otherwise survive into the next project's card. */
+  function cardFact(id, value, isHtml) {
+    var dd = $(id);
+    if (isHtml) dd.innerHTML = value || ''; else dd.textContent = value || '';
+    dd.hidden = $(id + 'L').hidden = !value;
+    return !!value;
+  }
+
   function openCard(p, rel, returnTo) {
     var href = p.isSelf ? '/' : safeHttpUrl(p.origin);
     $('cardDot').style.setProperty('--acc', p.isSelf ? 'var(--accent)' : accentOf(p));
@@ -812,6 +853,16 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     var label = rel === 'owner' ? 'yours' : rel === 'builder' ? 'you build here' : '';
     $('cardRel').textContent = label;
     $('cardRel').hidden = !label;
+    /* builders: 0 is a real answer ("nobody has joined yet"), null is "we could
+       not ask" and hides. runs: [] is a real answer too — the project declares
+       nothing beyond the core set, which the owner voiced as "core". */
+    var any = cardFact('cardBuilders', p.builders == null ? '' : String(p.builders));
+    any = cardFact('cardRuns', Array.isArray(p.tags) ? tagsHtml(p.tags) : '', true) || any;
+    /* when the rel chip already says "yours", naming the viewer as Owner is
+       noise — the fact answers strangers, not the person it describes */
+    any = cardFact('cardOwner', rel === 'owner' ? '' : ownerHtml(p), true) || any;
+    any = cardFact('cardListed', p.created_at ? listedDate(p.created_at) : '') || any;
+    $('cardMeta').hidden = !any;
     /* the platform's door is same-tab: / is this site, and a new tab for the
        page you are already on is a bug, not a courtesy */
     $('cardActions').innerHTML = href
@@ -909,6 +960,15 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
         if (!rows.length) return;
         var real = rows.filter(function (b) { return !/-system$/.test(String(b.github_login || '')); });
         $('selfBuilders').textContent = String(real.length);
+        /* the card reads these too: the same payload answers the platform's
+           builder count and its owner — the archon row — by the same rule the
+           server-side enrichment applies to every other project */
+        SELF_PROJECT.builders = real.length;
+        var arch = real.filter(function (b) { return b.rank === 'archon'; })[0];
+        if (arch && arch.github_login) {
+          SELF_PROJECT.owner = String(arch.github_login);
+          SELF_PROJECT.owner_avatar = arch.avatar_url || null;
+        }
       })
       .catch(function () { /* unreachable → the dash already in the markup stands */ });
   }
@@ -1092,6 +1152,11 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
   function shortDate(iso) {
     return iso ? new Date(iso).toLocaleDateString(undefined, { month: 'short', day: 'numeric' }) : '';
   }
+  /* the year matters on the card: catalogue entries sit years apart, and
+     "Aug 13" with no year reads as recent activity, not a date of record */
+  function listedDate(iso) {
+    return iso ? new Date(iso).toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' }) : '';
+  }
   /* "since 14:02" today, "since Aug 7" earlier — for the unreachable chip */
   function clockOrDate(ts) {
     var d = new Date(ts);

package/src/module-api.js

@@ -643,8 +643,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.106 with no explicit bump. run 31762781737. (task 1002620)
 //   1.19.108 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.107 with no explicit bump. run 31803763842. (task 1002620)
+//   1.19.109 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.108 with no explicit bump. run 31809188532. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.108'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.109'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/landing_page.mjs

@@ -262,8 +262,9 @@ test('the proof band ships hidden so a failed or empty feed leaves no orphan hea
 const CODE = HTML.split('<script>').pop().replace(/\/\*[\s\S]*?\*\//g, '');
 
 test('the catalog claims no liveness the public feed cannot back', () => {
-  // listFeaturedProjects projects {origin, name, tagline, art_url} — no status,
-  // so a verification chip here would be a claim nothing checked.
+  // listFeaturedProjects projects {origin, name, tagline, art_url, created_at}
+  // plus self-reported stats — still no status, so a verification chip here
+  // would be a claim nothing checked.
   assert.doesNotMatch(CODE, /chip (live|maybe|down)/);
   assert.doesNotMatch(CODE, /ago/);
 });

package/tests/project_stats.mjs

@@ -58,6 +58,76 @@ test('system accounts are excluded — they are machines, not builders', async (
   assert.equal(out['https://8.8.8.8'].builders, 2, 'four rows, two of them machines');
 });
 
+test("the owner is the project's own archon row, never the advisory catalog column", async () => {
+  // platform_identity_projects.owner_github_id is "advisory attribution (not an
+  // authority)" and stays out of every public projection. The project's own
+  // leaderboard — already fetched for the builders count — carries rank, and its
+  // archon row IS the instance's owner, reported by the one authority that knows.
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [
+        { github_login: 'zed', rank: 'metic' },
+        { github_login: 'amy', rank: 'archon', avatar_url: 'https://avatars.example.com/amy.png' },
+      ],
+      enabled: {},
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].owner, 'amy');
+  assert.equal(out['https://8.8.8.8'].owner_avatar, 'https://avatars.example.com/amy.png');
+});
+
+test('a non-http avatar from a third-party payload is dropped, the owner kept', async () => {
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [{ github_login: 'amy', rank: 'archon', avatar_url: 'javascript:alert(1)' }],
+      enabled: {},
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].owner, 'amy');
+  assert.equal(out['https://8.8.8.8'].owner_avatar, null);
+});
+
+test('no archon on the page means no owner claimed', async () => {
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [{ github_login: 'zed', rank: 'metic' }],
+      enabled: {},
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].owner, null, 'unknown must stay unknown, not guessed');
+});
+
+test('a machine account is never an owner, even wearing the archon rank', async () => {
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [{ github_login: 'bfg-system', rank: 'archon' }],
+      enabled: {},
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].owner, null);
+});
+
+test('a project whose fetches reject answers a null owner', async () => {
+  // allSettled means a rejecting fetch still travels the fulfilled path —
+  // owner stays its initialized null, and null is what reaches the wire
+  globalThis.fetch = () => Promise.reject(new Error('down'));
+  const out = await stats.getProjectStats(['https://9.9.9.9']);
+  assert.equal(out['https://9.9.9.9'].owner, null);
+});
+
+test('every failure fallback carries the owner key — dead answers are null, never undefined', async () => {
+  // a bad-scheme origin makes publicUrl throw synchronously — the ONE path
+  // that reaches the cached-failure literal (a rejecting fetch never does)
+  const out = await stats.getProjectStats(['file:///etc/passwd']);
+  assert.ok('owner' in out['file:///etc/passwd'], 'the failure literal must carry the key');
+  assert.equal(out['file:///etc/passwd'].owner, null);
+  assert.ok('owner_avatar' in out['file:///etc/passwd'], 'both fallback literals share one shape');
+});
+
 test('a tag is a NON-core module — core modules carry no information', async () => {
   // every instance runs the core set, so including it would print the same
   // fifteen tags on every row

package/tests/projects_hub.mjs

@@ -166,8 +166,9 @@ test('catalog origins are scheme-checked before they become hrefs', () => {
 });
 
 test('liveness is never claimed for a catalog row the hub did not probe (C6)', () => {
-  // the public feed carries origin/name/tagline/art_url and nothing else — a
-  // chip saying "live" here would assert more than anything verified
+  // the public feed carries identity, the Listed date and self-reported stats
+  // (builders/tags/owner) — still no liveness, so a chip saying "live" here
+  // would assert more than anything verified
   assert.match(SCRIPT, /chip calm/, 'an unprobed catalog row gets the calm chip');
   assert.doesNotMatch(SCRIPT, /chip live[^']*'\s*\+\s*esc\(p\./,
     'no catalog row may be rendered as live');
@@ -360,12 +361,21 @@ test('focus enters the card and is handed back on close', () => {
   assert.match(SCRIPT, /cardReturn\.focus\(\)/);
 });
 
-test('the card claims nothing the public catalog cannot answer (C6)', () => {
+test('the card claims only what the catalog and the project itself answer (C6)', () => {
   const card = (HUB.match(/<div class="cardScrim"[\s\S]*?<\/div>\s*<\/div>/) || [''])[0];
-  // /projects/featured selects origin, name, tagline, art_url — and nothing else
-  for (const invented of [/Builders/i, /\blive\b/i, /uptime/i, /\btags\b/i]) {
+  // /projects/featured serves origin, name, tagline, art_url, created_at, and the
+  // builders/tags/owner enrichment each project's OWN public API reports about
+  // itself (task 1002778). The card may state those. It still may not claim
+  // liveness nothing probed, and the catalogued date must never masquerade as a
+  // creation date — created_at is when the hub first heard of the project.
+  for (const invented of [/\blive\b/i, /uptime/i, /\bCreated\b/]) {
     assert.doesNotMatch(card, invented, `the card must not invent ${invented}`);
   }
+  for (const id of ['cardBuilders', 'cardRuns', 'cardOwner', 'cardListed']) {
+    assert.match(card, new RegExp(`id="${id}"`), `the ${id} fact must be real markup (C7)`);
+  }
+  assert.match(card, />Listed</, 'the catalogue date wears its honest label');
+  assert.doesNotMatch(card, /—/, 'an unanswerable card fact hides; it never dashes');
 });
 
 test('the row keeps its own Open link working underneath the card', () => {
@@ -421,7 +431,8 @@ test('Type left no styling behind, and the live columns kept theirs', () => {
 /* ── Real Builders + Runs (task 1002771) ────────────────────────────────────
    The columns came back only once something could fill them: each project's
    OWN public API. The distinction these pin is between "we could not ask"
-   (null → em dash) and "we asked, the answer is none" (0 / []). ── */
+   (null → em dash) and "we asked, the answer is none" (0 builders; tags []
+   voiced as "core" since task 1002778 — the owner's call, 2026-08-14). ── */
 
 test('unknown and zero are rendered as different things', () => {
   // 0 builders is a real answer — "nobody has joined yet". null is not an
@@ -435,6 +446,33 @@ test('a project that cannot be reached degrades to a dash, not to a wrong number
   assert.ok(fn, 'tagsHtml() must exist');
   assert.match(fn, /Array\.isArray\(tags\)/, 'a non-array (null) must not be spread into the cell');
   assert.match(fn, /return '—'/);
+  // [] is a different fact from null and reads differently: the project WAS
+  // asked and declares nothing beyond the core set. One formatter serves the
+  // table cell and the card, so the two views cannot disagree (task 1002778).
+  assert.match(fn, /return 'core'/, 'an empty list is a real answer, never a dash');
+});
+
+test('each card fact is wired to its data, not just present in the markup', () => {
+  // Mutation-found gap: the C6 test pins the markup ids, but nothing bound
+  // them to openCard's data — the whole facts strip could be deleted from the
+  // JS with every test green. These pin the wire, one fact at a time.
+  assert.match(SCRIPT, /function cardFact/, 'the card fact writer must exist');
+  assert.match(SCRIPT, /dd\.hidden = \$\(id \+ 'L'\)\.hidden = !value/,
+    'a fact with no answer hides label and value together — never a dash');
+  assert.match(SCRIPT, /cardFact\('cardBuilders', p\.builders == null \? '' : String\(p\.builders\)\)/,
+    'builders: 0 is a real answer, null hides');
+  assert.match(SCRIPT, /cardFact\('cardRuns', Array\.isArray\(p\.tags\) \? tagsHtml\(p\.tags\) : ''/,
+    'runs go through the one shared formatter');
+  assert.match(SCRIPT, /cardFact\('cardOwner', rel === 'owner' \? '' : ownerHtml\(p\), true\)/,
+    'owner comes from the enrichment and yields to the rel chip saying "yours"');
+  const oh = (SCRIPT.match(/function ownerHtml\(p\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(oh, 'ownerHtml() must exist');
+  assert.match(oh, /safeHttpUrl\(p\.owner_avatar\)/,
+    'a third-party avatar URL is scheme-checked before it becomes an img src');
+  assert.match(oh, /esc\(String\(p\.owner\)\)/, 'the login is escaped');
+  assert.match(SCRIPT, /cardFact\('cardListed', p\.created_at \? listedDate\(p\.created_at\) : ''\)/,
+    'listed is the catalogued date through the year-bearing formatter');
+  assert.match(SCRIPT, /year: 'numeric'/, 'a date of record carries its year');
 });
 
 test('the tag list is capped, and the overflow is counted rather than hidden', () => {
@@ -520,6 +558,15 @@ test('the table body is a sibling of the sky wrapper, not nested inside it', ()
     'the table must not sit inside the sky wrapper. open: ' + ancestors.join(' > '));
 });
 
+test('the card metadata block lives inside the card, not a hideable sub-view', () => {
+  const ancestors = openAncestorsAt(HUB, 'id="cardMeta"');
+  assert.ok(ancestors.includes('projCard'), 'the facts belong to the card dialog');
+  for (const hidden of ['sub-sky-body', 'sub-table-body']) {
+    assert.ok(!ancestors.includes(hidden),
+      '#' + hidden + ' is toggled hidden — the facts cannot live inside it. open: ' + ancestors.join(' > '));
+  }
+});
+
 /* ── The self row's Open goes somewhere (task 1002777) ──────────────────────
    Task 1002760's static self row shipped its action cell as href="#" with a
    `data-self-open` hook nobody ever wired. The row-click handler deliberately