@bongos/core 1.19.114 → 1.19.116

package/scripts/gds/audit-authorship.sh

@@ -202,10 +202,6 @@ ALLOWLIST=(
   'tests/auth_anthropic_identity.mjs'
   'modules/dev-box/app/test/unit.mjs'
 
-  # The public landing page links the open-source repo by URL — repo-hosting
-  # identity (the provision-staging.sh class), not a builder identity.
-  'public-landing/create.html'
-
   # The mirror-redaction floor: PRIOR_INSTANCE_FLOOR carries the prior
   # instance's owner literal precisely so packaging can SCRUB it from every
   # published core — the anti-leak spec, not a runtime hardcode (task 1002640).

package/scripts/gds/onboard.js

@@ -23,7 +23,7 @@ const oauth = require(path.join(__dirname, 'oauth-secret.js'));     // validateC
 // ── PURE core (exported for tests) ───────────────────────────────────────────
 
 // The canonical step sequence now lives in ONE place — the provisioning module — so the
-// CLI (here), the branded /create page, and the hall wizard can't drift (task 2085; goal
+// CLI (here) and the hub's ?view=new wizard can't drift (task 2085; goal
 // 35 / criterion 165: "the canonical step sequence is the source of truth; skill/CLI/hall
 // are forms over it"). The web forms read it over GET /provisioning/onboard-plan; the CLI
 // requires it directly. Re-exported below so `bongos onboard` + tests keep the same API.

package/scripts/gds/seed-bv1-profile-page-tasks.js

@@ -0,0 +1,161 @@
+// Seed the delta tasks the profile-page spike (task 1002783) surfaced, under
+// goal 1000045 "Public builder profiles" (BONGOS-V1, internal).
+//
+// Source of truth: docs/specs/bongos-v1-builder-profile-page.md (status: final).
+// The Phase-1 spine (R01-R06) was already seeded by seed-bv1-profiles-tasks.js;
+// this file adds ONLY what that spec found on top of it, so the two seeders are
+// disjoint and both stay re-runnable.
+//
+// Idempotent on (source, source_ref) — re-running resolves to the existing rows
+// and re-asserts the dependency edges.
+//
+// Run: node scripts/gds/seed-bv1-profile-page-tasks.js
+
+const { apiCall } = require('./cli-lib');
+
+const VER = 'BONGOS-V1';
+const GOAL = 1000045;
+const SRC = 'planning-session';
+const SPEC = 'docs/specs/bongos-v1-builder-profile-page.md';
+
+// Tasks that already exist and that these depend on — referenced by id, since
+// they were seeded by the sibling seeder (or by the wave task 1002781).
+const R01 = 1002277;   // spike · design profile↔rollup join + consent model
+const R02 = 1002278;   // feature · profile API returns cross-project record
+const R03 = 1002279;   // feature · hide flag
+const R05 = 1002281;   // feature · shareable-by-login profile URL
+const SETTINGS_SPIKE = 1002784;   // spike · account settings page — inventory + placement
+const PRIVACY_SPIKE = 1002785;    // spike · account privacy model + invite inbox
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// Throttled + 429-aware wrapper. The seeder makes ~20 writes in a burst, which
+// is exactly the shape the per-IP limiter is there to catch.
+async function api(method, path, body, _tries = 0) {
+  await sleep(400);
+  const r = await apiCall(method, `/api/gds${path}`, body);
+  if (r.status === 429 && _tries < 8) {
+    const wait = (r.data?.error?.details?.retry_after_seconds || 30) + 1;
+    console.log(`  …rate-limited, waiting ${wait}s`);
+    await sleep(wait * 1000);
+    return api(method, path, body, _tries + 1);
+  }
+  return r;
+}
+
+// deps entries are either a local ref ('P01') or a numeric id of an existing task.
+const TASKS = [
+  {
+    ref: 'P01', kind: 'feature', disc: 'engineer', prio: 5, est: 180, crit: ['C1'], deps: [R01],
+    title: 'P01 · Builder handle on platform accounts (seed, dedupe, reserved list, rename)',
+    desc: `Add a \`handle\` column to platform_identity_accounts: seeded from github_login at creation, deduped with a numeric suffix on collision, validated against a small reserved list (me, new, edit, settings, admin, api, u), builder-editable at a low rate limit, previous handle retained for a 301 window. github_id stays the join key everywhere — the handle is presentation only. WHY: github_login is mutable, so hanging the canonical profile URL on it means every GitHub rename silently 404s that builder's shared links. Namespaced module migration (ADR 0083). Spec: ${SPEC} (Decision 3).`,
+  },
+  {
+    ref: 'P02', kind: 'feature', disc: 'engineer', prio: 5, est: 180, crit: ['C1'], deps: [R01],
+    title: 'P02 · Profile fields: bio + typed links on the platform account',
+    desc: `Add \`bio\` (plain text, ~280 chars, NO markdown and no auto-linking) and \`links\` (a TYPED, capped set — website, X, LinkedIn, Discord; max 4) to platform_identity_accounts, plus the authenticated write. Server-side validation must enforce https-only AND reject non-http(s) schemes and userinfo/host tricks — do not rely on the client. Render with rel="nofollow ugc noopener". WHY typed-and-capped rather than a free-form link list: a public, indexable page with user-controlled links is an SEO-spam magnet, and this removes the incentive without a moderation queue. Spec: ${SPEC} (Decision 4).`,
+  },
+  {
+    ref: 'P03', kind: 'decision', disc: 'engineer', prio: 5, est: 60, crit: ['C1'], deps: [], ready: true,
+    title: 'P03 · Owner decision: provisional vs active profile state for check-in-created accounts',
+    desc: `Goal 1000045 justifies "public by default" as tied to having a platform account, "which already carries platform T&C consent". That premise is not currently true for every account: POST /sso/membership/check-in and POST /sso/activity/rollup cause the hub to upsert an account for a builder who has never visited the hub and never saw a platform T&C. Under auto-create (see task 1002783) those people would get a public, indexable, cross-project profile from a sign-in they performed on someone else's instance. RECOMMENDATION: a profile_state of 'provisional' (created by check-in — still counted in aggregates, but not publicly listed, not at the handle URL, not in the sitemap, not in hub search) vs 'active' (has signed in at the hub at least once). One column, one branch. This is an owner product/consent call, and it changes the shape of P09. Spec: ${SPEC}.`,
+  },
+  {
+    ref: 'P04', kind: 'feature', disc: 'ui', prio: 4, est: 180, crit: ['C1'], deps: ['P01', 'P02', SETTINGS_SPIKE],
+    title: 'P04 · Settings → Profile rail group (the single profile-edit surface)',
+    desc: `One edit surface for the profile, as a new rail group in the hall Settings page (the RAIL_GROUPS pattern in modules/hall-ui/public/settings.js) — not a separate edit page. Holds handle, bio, links alongside the display-name and disciplines controls that already live there. Account-global fields must be edited where they are stored; final hub-vs-per-project placement is task ${SETTINGS_SPIKE}'s call, which is why this waits on it. Spec: ${SPEC} (Decision 4).`,
+  },
+  {
+    ref: 'P05', kind: 'verify', disc: 'engineer', prio: 5, est: 120, crit: ['C1'], deps: [R02],
+    title: 'P05 · Leak test for the hub profile read (mirror of tests/profile_route.mjs)',
+    desc: `The instance route GET /builders/:id/profile projects an explicit public column whitelist and tests/profile_route.mjs proves the private columns (anthropic_email, anthropic_user_id, monthly_budget_usd, system_role, box_blocked*, deactivated_reason) never appear anywhere in the serialized response. The new cross-project read needs its OWN mirror test over the account + rollup projection before it is public — same sentinel-string technique, same 404-on-unknown-id assertion. Never spread a raw row. Spec: ${SPEC} (Constraints §1).`,
+  },
+  {
+    ref: 'P06', kind: 'feature', disc: 'ui', prio: 3, est: 120, crit: ['C1'], deps: ['P02'],
+    title: 'P06 · "Complete your profile" needs-attention inbox line item (dismissible)',
+    desc: `When bio or preferred_disciplines are empty, nudge the builder — as a DISMISSIBLE line item in the needs-attention inbox (goal-inbox.js / #attention-scroll), never a new Home card. That is the hall placement rule (modules/hall-ui/CLAUDE.md → Placement): an action awaiting the builder is an inbox line. This is the replacement for the profile-setup wizard that task 1002783 rejected. Spec: ${SPEC} (Decision 2).`,
+  },
+  {
+    ref: 'P07', kind: 'feature', disc: 'engineer', prio: 3, est: 210, crit: ['C1'], deps: [R02],
+    title: 'P07 · Hub recent works via push — recent_ships[] on the activity rollup',
+    desc: `The hub has no tasks table for other projects, so "recent works" cannot render there today. The existing PULL pattern (modules/platform-identity/project-stats.js) fans out to each project's public API — right for a builder count on a catalog page, wrong per-profile-view, and it cannot serve a CLI-only project at all. Extend the POST /sso/activity/rollup payload (which already carries credits/ships/karma/rank/disciplines per project) with a capped recent_ships[] — 3 per project: title, id, shipped_at, and a link into that instance — plus the instance-side reporter in core auth.js. Reuses a table and a reporter that already exist; costs no fan-out read; stays descriptive-analytics-only. Spec: ${SPEC} (page spec, section 4).`,
+  },
+  {
+    ref: 'P08', kind: 'feature', disc: 'ui', prio: 4, est: 150, crit: ['C1'], deps: ['P01', R05],
+    title: 'P08 · Canonical profile URL wiring (instance rel=canonical → hub; numeric id redirects)',
+    desc: `One canonical public profile, two render paths: the hub's server-rendered handle URL is canonical, and the hall's own profile page stays the LOCAL view and emits rel=canonical to it when the builder has a platform account. The numeric ?id= form never dies — it is stable and rename-proof, so keep it as a permanent fallback that redirects to the canonical handle URL. Coordinate with goal 1000048 R14 (public builder-profile SEO page) so only ONE page gets built. Spec: ${SPEC} (Decision 1).`,
+  },
+  {
+    ref: 'P09', kind: 'feature', disc: 'engineer', prio: 3, est: 150, crit: ['C1'], deps: ['P01', PRIVACY_SPIKE],
+    title: 'P09 · noindex until first ship + sitemap consent gate for builder profiles',
+    desc: `A public, indexable profile that anyone can mint is a backlink-farming surface. Gate indexing on the builder having at least one shipped work, and gate sitemap inclusion on consent (private accounts and — if the owner accepts P03 — provisional accounts are excluded). Coordinates with goal 1000048 R15 (builder profiles in sitemap, consent-gated). Shape depends on the P03 decision. Spec: ${SPEC} (Visibility rules).`,
+  },
+  {
+    ref: 'P10', kind: 'verify', disc: 'engineer', prio: 3, est: 90, crit: ['C2'], deps: [PRIVACY_SPIKE, R03],
+    title: 'P10 · PROOF: a private account\'s profile 404s to a stranger and renders to its owner',
+    desc: `Verify the profile page honours the privacy model: a private account's handle URL returns 404 — NOT 403, because a 403 confirms the handle exists — to everyone except the account itself, which sees its own profile with a "private" banner. Also assert the stats-hidden case renders no partial numbers (a count beside a hidden total is a leak by subtraction). The authoritative model is task ${PRIVACY_SPIKE}'s; if it lands a different rule, this proof follows it and the spec is the thing that is wrong. Spec: ${SPEC} (Visibility rules).`,
+  },
+];
+
+(async () => {
+  const idByRef = {};
+  let created = 0;
+  let existing = 0;
+  console.log(`Seeding ${TASKS.length} tasks under goal ${GOAL} (${VER})…`);
+  for (const t of TASKS) {
+    const r = await api('POST', '/tasks', {
+      version_id: VER,
+      goal_id: GOAL,
+      title: t.title,
+      description: t.desc,
+      kind: t.kind,
+      discipline: t.disc,
+      priority: t.prio,
+      est_minutes: t.est,
+      criterion_ids: t.crit,
+      source: SRC,
+      source_ref: `bv1-profile-page-${t.ref}`,
+    });
+    if (!r.ok) {
+      console.log(`  ${t.ref}: FAILED ${r.status} ${JSON.stringify(r.data)}`);
+      continue;
+    }
+    const task = r.data.task || r.data;
+    idByRef[t.ref] = task.id;
+    if (r.data.idempotent || r.data.existing) existing++; else created++;
+    console.log(`  ${t.ref} → task ${task.id} (${t.kind}/${t.disc}, P${t.prio}, [${t.crit.join(',')}])`);
+  }
+
+  console.log('Wiring dependencies…');
+  let edges = 0;
+  for (const t of TASKS) {
+    if (!t.deps.length) continue;
+    const id = idByRef[t.ref];
+    // A dep is either a local ref (resolved from this run) or a literal task id.
+    const depIds = t.deps.map((d) => (typeof d === 'number' ? d : idByRef[d])).filter(Boolean);
+    if (!id || depIds.length !== t.deps.length) {
+      console.log(`  ${t.ref}: dep resolve gap, skipping`);
+      continue;
+    }
+    // PUT replaces the full set, so a re-run converges instead of erroring on
+    // an edge that already exists.
+    const r = await api('PUT', `/tasks/${id}/dependencies`, { depends_on_task_ids: depIds });
+    if (!r.ok) {
+      console.log(`  ${t.ref}: dep FAILED ${r.status} ${JSON.stringify(r.data)}`);
+      continue;
+    }
+    edges += depIds.length;
+    console.log(`  ${t.ref} depends on ${t.deps.join(',')}`);
+  }
+
+  console.log('Promoting zero-dep roots to ready…');
+  for (const t of TASKS.filter((x) => x.ready)) {
+    const id = idByRef[t.ref];
+    if (!id) continue;
+    const r = await api('POST', `/tasks/${id}/promote`, {});
+    console.log(`  ${t.ref} (task ${id}): ${r.ok ? 'ready' : 'promote note ' + JSON.stringify(r.data).slice(0, 120)}`);
+  }
+
+  console.log(`\nDONE. created=${created} existing=${existing} depEdges=${edges}.`);
+  console.log('ref→id:', JSON.stringify(idByRef));
+})();

package/src/module-api.js

@@ -655,8 +655,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.112 with no explicit bump. run 31816239246. (task 1002620)
 //   1.19.114 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.113 with no explicit bump. run 31816599678. (task 1002620)
+//   1.19.115 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.114 with no explicit bump. run 31825824596. (task 1002620)
+//   1.19.116 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.115 with no explicit bump. run 31827642395. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.114'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.116'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/platform-server.js

@@ -184,13 +184,21 @@ function buildPlatformApp() {
     if (!html) return next();
     res.type('html').send(html);
   });
-  // The branded project-creation experience (goal 35, task 2081) — a sibling
-  // landing page at a clean /create URL, branding-injected like the landing.
+  // The create wizard was absorbed into the hub's ?view=new view (task 1002763;
+  // direction §4 — "/create redirects to ?view=new"). This route only carries
+  // visitors — and any ?name= seed the old links still send — into it. 302, not
+  // 301: /create is an OAuth return target in the wild, and a browser-cached
+  // permanent redirect would outlive any future change of shape.
   app.get('/create', (req, res, next) => {
     if (!isApexHost(req)) return next();
-    const html = landingPage('create.html');
-    if (!html) return next();
-    res.type('html').send(html);
+    // rebuilt, not spliced: an inbound ?view= must not ride along (the hub
+    // reads the FIRST view param — a duplicate would bet the route on that
+    // parser detail), and an empty query must not leave a bare trailing '&'
+    const qi = req.url.indexOf('?');
+    const rest = new URLSearchParams(qi >= 0 ? req.url.slice(qi + 1) : '');
+    rest.delete('view');
+    const tail = rest.toString();
+    res.redirect(302, '/projects?view=new' + (tail ? '&' + tail : ''));
   });
   // THE PROJECT HUB (task 1002743) — one surface holding every project-shaped
   // action: the map of what exists (the orb sky the gate used to own, plus the

package/tests/cosmos_token_contrast.mjs

@@ -144,8 +144,9 @@ const PAIRS = [
   ['.btn.ghost:hover label',            'var(--accent-deep)',   CARD,                   4.5],
   ['.btn.danger label',                 'var(--err)',           CARD,                   4.5],
   // Inline links: cosmos.css recolors its own to --sun-lit in dark (:179-262), but
-  // create.html has ELEVEN --accent-deep consumers and zero dark CSS rules (its only
-  // data-mode hits are the JS toggle), so there the token itself must carry dark.
+  // the ?view=new wizard styles (absorbed from create.html, task 1002763) carry
+  // eleven --accent-deep consumers and zero dark rules of their own, so there the
+  // token itself must carry dark.
   ['inline link on a card',             'var(--accent-deep)',   CARD,                   4.5],
   ['inline link on the page ground',    'var(--accent-deep)',   'var(--bg)',            4.5],
   ['code chip on --bg-deep',            'var(--accent-deep)',   'var(--bg-deep)',       4.5],
@@ -172,11 +173,13 @@ const PAIRS = [
   ['.projMsg.ok',                       'var(--ok)',            CARD,                   4.5],
   ['.projMsg.err / .confirmRow',        'var(--err)',           CARD,                   4.5],
   // chrome: wordmark + footer sit on the page ground, not on a card
-  // create.html page-local grounds — it carries its own <style> and its own
-  // darkest tints, so cosmos.css's pairs alone do not cover /create
-  ['create.html .ghrow .priv 11px',     'var(--ink-soft)',      'color-mix(in srgb,var(--ink) 8%,var(--bg-deep))', 4.5],
-  ['create.html ::placeholder',         'var(--ink-faint)',     CARD,                   4.5],
-  ['create.html .ghlist .hint on deep', 'var(--ink-faint)',     'var(--bg-deep)',       4.5],
+  // wizard grounds (projects.html ?view=new, absorbed from create.html in task
+  // 1002763) — its panels carry their own darkest tints, so cosmos.css's pairs
+  // alone do not cover them
+  ['?view=new .ghrow .priv 11px',       'var(--ink-soft)',      'color-mix(in srgb,var(--ink) 8%,var(--bg-deep))', 4.5],
+  ['--on-ok on an --ok fill',           'var(--on-ok)',         'var(--ok)',            4.5],
+  ['?view=new input ::placeholder',     'var(--ink-faint)',     CARD,                   4.5],
+  ['?view=new .ghlist .hint on deep',   'var(--ink-faint)',     'var(--bg-deep)',       4.5],
   ['--chrome-accent wordmark',          'var(--chrome-accent)', 'var(--page-bg)',       4.5],
   ['--chrome-ink',                      'var(--chrome-ink)',    'var(--page-bg)',       4.5],
   ['--foot-ink footer copy',            'var(--foot-ink)',      'var(--page-bg)',       4.5],

package/tests/module-scope-map.mjs

@@ -127,7 +127,7 @@ test('platform-identity joined the roster (task 1002322) — the catalog territo
     'modules/platform-identity/routes/projects.js',     // the feed + invite routes
     'modules/status-ui/public/explore.js',              // orb render-type surface
     'modules/hall-ui/public/my-projects.js',            // owner settings / applications queue
-    'public-landing/create.html',                       // the project-detail creation step
+    'public-landing/projects.html',                     // the creation step, ?view=new since task 1002763
     'modules/provisioning/',                            // module-bundle selection at provision time
   ]) {
     assert.equal(covers(touch), true, `wall does not cover ${touch}`);

package/tests/onboard.mjs

@@ -86,18 +86,19 @@ test('every render surface carries the terminal hall step (task 1002703)', () =>
   const cli = read('scripts/gds/onboard.js');
   assert.match(cli, /builders hall/i, 'the CLI walkthrough ends at the hall');
   assert.match(cli, /bongos dev/, 'the CLI offers the local-hall one-liner when no domain');
-  const createHtml = read('public-landing/create.html');
-  const enterHall = createHtml.match(/data-onboard-step="enter-hall"[^]*?<\/li>/g) || [];
-  assert.ok(enterHall.length >= 1, '/create tags the enter-hall step');
-  assert.match(enterHall.join(''), /\/builders/, '/create points at the hall address');
-  assert.match(enterHall.join(''), /bongos dev/, '/create offers the local hall when no domain');
+  const hubHtml = read('public-landing/projects.html');
+  const enterHall = hubHtml.match(/data-onboard-step="enter-hall"[^]*?<\/li>/g) || [];
+  assert.ok(enterHall.length >= 1, 'the ?view=new wizard tags the enter-hall step');
+  assert.match(enterHall.join(''), /\/builders/, 'the wizard points at the hall address');
+  assert.match(enterHall.join(''), /bongos dev/, 'the wizard offers the local hall when no domain');
 });
 
-test('the /create done panel is plan-driven, manifest-driven, and owner-honest (task 1002694)', () => {
+test('the wizard done panel is plan-driven, manifest-driven, and owner-honest (task 1002694)', () => {
   // Gaps 2/3/4/14 of the project-creation audit (docs/audits/project-creation-gap-list.md).
+  // The wizard lives inside the hub page since task 1002763.
   const { readFileSync } = require('node:fs');
   const path = require('node:path');
-  const src = readFileSync(path.join(import.meta.dirname, '..', 'public-landing/create.html'), 'utf8');
+  const src = readFileSync(path.join(import.meta.dirname, '..', 'public-landing/projects.html'), 'utf8');
   // gap 2 (idea 1000675): the checklist renders FROM the canonical plan endpoint
   assert.match(src, /provisioning\/onboard-plan/, 'the done panel fetches the canonical plan');
   // gap 3 (idea 1000676): the ADR 0133 one-click manifest flow has a UI caller again
@@ -105,12 +106,14 @@ test('the /create done panel is plan-driven, manifest-driven, and owner-honest (
   assert.match(src, /github-app\/status/, 'and polls its progress to reflect live state');
   // gap 4: the operator-only control-plane command never reaches a new owner
   assert.doesNotMatch(src, /oauth-secret place/, 'owners are never handed the control-plane placement command');
-  // gap 14 (idea 1000684): repo visibility is stated, with the private path named
-  assert.match(src, /public/, 'visibility is stated');
-  assert.match(src, /adopt/i, 'the private path (adopt your own private repo) is named');
+  // gap 14 (idea 1000684): repo visibility is stated, with the private path named.
+  // Landmarks unique to the wizard — bare /public/ and /adopt/i match hub copy
+  // that has nothing to do with it, which would leave this guard vacuous.
+  assert.match(src, /public stays public, private stays private/, 'visibility is stated');
+  assert.match(src, /id="c-adopt"/, 'the private path (adopt your own private repo) is named');
 });
 
-test('the /create gate trust link points at a live artifact, not the dead private-repo URL (task 1002705)', () => {
+test('the wizard gate trust link points at a live artifact, not the dead private-repo URL (task 1002705)', () => {
   // Gap 1 of the project-creation audit: the gate linked a nonexistent private repo
   // (404 even authenticated — ADR 0167 names it). No public code artifact exists yet
   // (the ADR 0099 mirror is dormant until ~2026-11, and both npm scopes 404 anonymously
@@ -118,7 +121,7 @@ test('the /create gate trust link points at a live artifact, not the dead privat
   // "open source" is the license itself.
   const { readFileSync } = require('node:fs');
   const path = require('node:path');
-  const src = readFileSync(path.join(import.meta.dirname, '..', 'public-landing/create.html'), 'utf8');
+  const src = readFileSync(path.join(import.meta.dirname, '..', 'public-landing/projects.html'), 'utf8');
   assert.doesNotMatch(src, /Claude-OTB/, 'the dead repo link is gone');
   assert.match(src, /https:\/\/www\.gnu\.org\/licenses\/agpl-3\.0/, 'the trust link resolves (the AGPL-3.0 license text)');
 });
@@ -168,19 +171,20 @@ test('onboardPlan is the SAME function the provisioning module owns (single sour
   assert.equal(ob.onboardPlan, canonical, 'scripts/gds/onboard.js must re-export the module’s onboardPlan');
 });
 
-test('the web form (/create) declares EXACTLY the canonical human steps — drift guard', () => {
+test('the web form (?view=new) declares EXACTLY the canonical human steps — drift guard', () => {
   // goal 35 / criterion 165: "the canonical step sequence is the source of truth;
   // skill/CLI/web are forms over it." The web form tags its human-step <li>s with
   // data-onboard-step="<key>"; this asserts that set equals the plan's human-step keys,
   // so adding/removing/renaming a human step in the single source fails CI until every
   // form is updated (and vice-versa) — the sequence can no longer drift between forms.
-  // (The hall new-project wizard was removed in task 1002675 — project creation lives
-  // on the apex /create flow; the skill + CLI + /create remain the canonical forms.)
+  // (The hall new-project wizard was removed in task 1002675, and the apex /create
+  // page was absorbed into the hub's ?view=new view in task 1002763; the skill +
+  // CLI + the hub wizard remain the canonical forms.)
   const { readFileSync } = require('node:fs');
   const path = require('node:path');
   const humanKeys = ob.onboardPlan().filter((s) => s.kind === 'human').map((s) => s.key).sort();
   const surfaces = {
-    '/create landing page': 'public-landing/create.html',
+    '/projects?view=new wizard': 'public-landing/projects.html',
   };
   for (const [name, rel] of Object.entries(surfaces)) {
     const src = readFileSync(path.join(import.meta.dirname, '..', rel), 'utf8');

package/tests/platform_boot.mjs

@@ -121,16 +121,29 @@ test('the apex host serves the landing page — not the game — on a game-less
   assert.doesNotMatch(res.body, /Create a project/);
 });
 
-test('the apex host serves the branded /create page (goal 35, task 2081)', async () => {
-  // The project-creation experience is a platform-level page on the apex,
-  // branding-injected exactly like the landing (same landingPage memo).
+test('/create redirects into the hub wizard, seed intact (task 1002763)', async () => {
+  // The wizard was absorbed into /projects?view=new (direction §4); /create
+  // survives only as a 302 so old links and OAuth returns keep working. The
+  // query string rides along — /create?name= was the seeding entry point.
   const res = await request('/create', 'game.test.local');
-  assert.equal(res.status, 200);
-  assert.match(res.headers['content-type'] || '', /text\/html/);
-  assert.match(res.body, /window\.__BRANDING__=/);
-  assert.match(res.body, /Create a project/);
+  assert.equal(res.status, 302);
+  assert.equal(res.headers.location, '/projects?view=new');
+  // the query is rebuilt (URLSearchParams re-encodes space as '+', which the
+  // hub's URLSearchParams reading decodes right back), and an inbound view=
+  // never rides along to fight the one this route asserts
+  const seeded = await request('/create?name=Sky%20Farm&view=mine', 'game.test.local');
+  assert.equal(seeded.status, 302);
+  assert.equal(seeded.headers.location, '/projects?view=new&name=Sky+Farm');
+  const empty = await request('/create?', 'game.test.local');
+  assert.equal(empty.headers.location, '/projects?view=new');
+  // the branded wizard itself now ships inside the hub page
+  const hub = await request('/projects', 'game.test.local');
+  assert.equal(hub.status, 200);
+  assert.match(hub.headers['content-type'] || '', /text\/html/);
+  assert.match(hub.body, /window\.__BRANDING__=/);
+  assert.match(hub.body, /Create a project/);
   // the wizard files the request against the provisioning API, nothing else
-  assert.match(res.body, /provisioning\/instances/);
+  assert.match(hub.body, /provisioning\/instances/);
 });
 
 test('R51: an API-shaped 404 still gets a self-describing JSON body', async () => {

package/tests/projects_hub.mjs

@@ -212,17 +212,85 @@ test('the gate is retired — no route, no files, no links into it', () => {
   assert.doesNotMatch(HUB, /href="\/gate/);
 });
 
-test('/create still answers — the hub links it rather than absorbing it', () => {
-  // Task 1002743's Part 3 was AMENDED by the owner on 2026-08-13 to move the
-  // "/create redirects into the hub" clause to task 1002763, which carries the
-  // port that makes it safe. ?view=new is step 1 of the four-beat rail, so
-  // redirecting /create here before the wizard lives in the hub would let a
-  // visitor name a project and then go nowhere — creation would break. The
-  // wizard also has four id collisions with this page and a replaceState that
-  // strips the query string. Until 1002763 lands, /create must keep answering.
-  assert.ok(fs.existsSync(path.join(ROOT, 'public-landing', 'create.html')));
-  assert.match(SCRIPT, /location\.assign\('\/create'/);
-  assert.match(HUB, /href="\/create"/, 'the empty state must still point at the wizard');
+test('/create is absorbed — the wizard lives here and the route only redirects (task 1002763)', () => {
+  // Task 1002743 stopped at step 1: the hub named a project and navigated to
+  // /create?name=. This task carries the absorption the owner amended into it
+  // (direction §4: "/create redirects to ?view=new"): the wizard's six panels
+  // are real markup inside the new view (C7), create.html is deleted — the
+  // gate precedent above: express.static would keep serving the raw file —
+  // and the name handoff became an in-page step advance.
+  assert.equal(fs.existsSync(path.join(ROOT, 'public-landing', 'create.html')), false,
+    'create.html must be gone: express.static would keep serving it raw and unbranded');
+  assert.doesNotMatch(SCRIPT, /location\.assign\('\/create'/,
+    'naming a project advances the wizard in place — no navigation');
+  assert.doesNotMatch(HUB, /href="\/create"/, 'no link may point at the retired route');
+  assert.match(HUB, /href="\?view=new"/, 'in-page links carry the view query instead');
+  const server = fs.readFileSync(path.join(ROOT, 'src', 'platform-server.js'), 'utf8');
+  assert.match(server, /res\.redirect\(302, '\/projects\?view=new'/,
+    '/create must 302 into the hub (302, not 301: the URL is an OAuth return target in the wild)');
+  for (const id of ['panel-gate', 'panel-name', 'panel-home', 'panel-address', 'panel-review', 'panel-done']) {
+    assert.match(HUB, new RegExp(`id="${id}"`), `the wizard's ${id} ships as real markup (C7)`);
+  }
+});
+
+test('the absorbed wizard sheds its two URL landmines — /gate/ and the whole-query strip', () => {
+  // create.html carried a document-level Escape that navigated to the retired
+  // /gate/ (a 404 the href-only guard above cannot see: it was a
+  // location.assign, not an href) and a replaceState that rewrote the URL to
+  // location.pathname — which on this page would destroy ?view=new on load.
+  assert.doesNotMatch(SCRIPT, /['"]\/gate\//,
+    'no code path may navigate into the retired gate');
+  assert.doesNotMatch(SCRIPT, /history\.replaceState\(null, '', location\.pathname\)/,
+    "the hub's '?view=' + v rewrite is the only URL writer on this page");
+});
+
+test('no id is declared twice — the wizard merge had four collisions to clear', () => {
+  // modeToggle, who, signin, gateAlert all existed on BOTH pages; a duplicate
+  // id makes the second node unreachable by getElementById and the first
+  // silently wins. Scan the real markup only (JS builds ids like `dom-<iid>`
+  // from fragments that would false-positive here).
+  const afterHead = HUB.slice(HUB.indexOf('</script>') + '</script>'.length);
+  const markup = afterHead.slice(0, afterHead.indexOf('<script>'));
+  assert.ok(markup.includes('id="view-new"'), 'the markup slice must span the views');
+  const ids = [...markup.matchAll(/\sid="([^"]+)"/g)].map((m) => m[1]);
+  const seen = new Set();
+  const dupes = ids.filter((id) => (seen.has(id) ? true : (seen.add(id), false)));
+  assert.deepEqual(dupes, [], `duplicate ids in the hub markup: ${dupes}`);
+});
+
+test('the new view balances its own tree — the map-only walkers never covered it', () => {
+  // div-balance (:535) counts view-map only, and every openAncestorsAt needle
+  // lives there too; a lopsided div in the wizard block would be caught by
+  // nothing else while silently reparenting the footer.
+  const start = HUB.indexOf('<section id="view-new"');
+  const end = HUB.indexOf('<div class="foot"');
+  assert.ok(start !== -1 && end > start, 'need the view-new span');
+  const wiz = HUB.slice(start, end);
+  assert.equal((wiz.match(/<div\b/g) || []).length, (wiz.match(/<\/div>/g) || []).length,
+    'every div opened in #view-new closes in #view-new');
+  assert.equal((wiz.match(/<section\b/g) || []).length, (wiz.match(/<\/section>/g) || []).length,
+    'every section opened in #view-new closes in #view-new');
+});
+
+test('C8 — the wizard polls stop dead off the new view, like the sky off the map', () => {
+  // create.html's progress watch (5s) and manifest poll (4s/8s) had NO view
+  // guard — merged unguarded they would poll a hidden view for up to 33
+  // minutes. Both ticks must consult the same gate the sky consults.
+  assert.match(SCRIPT, /function wizPollActive\(\)/, 'the wizard needs its own stage guard');
+  assert.match(SCRIPT, /!document\.hidden && currentView === 'new'/,
+    'the guard is hidden-tab aware and view-scoped');
+  const gatedTicks = (SCRIPT.match(/if \(!wizPollActive\(\)\)/g) || []).length;
+  assert.ok(gatedTicks >= 2, `both wizard ticks (progress + manifest) must check the guard, found ${gatedTicks}`);
+  assert.match(SCRIPT, /if \(v === 'new'\) wizard\.enter\(focus\); else wizard\.leave\(\);/,
+    'setView hands the view to the wizard exactly like it starts/stops the sky');
+});
+
+test('the wizard never steals focus on boot — focus moves only on deliberate steps', () => {
+  // create.html's show() unconditionally focused each panel's h1, and its boot
+  // always called show() — merged as-is, every hub load would rip focus into a
+  // hidden view. The hub rule (setView's `focus` flag) now reaches show() too.
+  assert.match(SCRIPT, /function show\(step, moveFocus\)/, 'show() must carry the focus flag');
+  assert.match(SCRIPT, /if \(moveFocus\)/, 'and only focus when it is set');
 });
 
 /* ── The platform's own entry (task 1002760) ────────────────────────────────

package/tests/public_landing_projects.mjs

@@ -14,8 +14,9 @@
 //     intent_conflict, not_teardownable, bad_domain, domain_taken,
 //     domain_already_set, domain_not_attachable are all SAID, never swallowed)
 //   • an instance with no domain gets an HONEST no-address state, not a blank
-//   • create.html's poll give-up now points at /projects — the false "the hall
-//     has it" stop (the hall my-projects card was removed in task 1002675) is gone
+//   • the wizard's poll give-up points at the projects view — the false "the
+//     hall has it" stop (the hall card was removed in task 1002675) is gone.
+//     (create.html itself was absorbed into ?view=new in task 1002763.)
 //
 // Run:  node --test tests/public_landing_projects.mjs
 
@@ -106,17 +107,20 @@ test('a domainless instance gets an honest no-address state', async () => {
   assert.match(body, /[Nn]o address yet/);
 });
 
-test('the empty state points a new owner at /create — never at a hall', async () => {
+test('the empty state points a new owner at the wizard view — never at a hall', async () => {
   const { body } = await request('/projects', 'game.test.local');
-  assert.match(body, /href="\/create"/);
+  // /create was absorbed into ?view=new (task 1002763); the CTA moves in-page
+  assert.match(body, /href="\?view=new"/);
+  assert.doesNotMatch(body, /href="\/create"/, 'no link may point at the retired route');
   // the hall my-projects card was REMOVED (task 1002675; hall my-projects is
   // federation-only) — this page must not send an owner there
   assert.doesNotMatch(body, /Enter the Hall/i);
 });
 
-test('create.html: the poll give-up points at /projects — "the hall has it" is dead', async () => {
-  const { body } = await request('/create', 'game.test.local');
-  assert.match(body, /\/projects/, 'the give-up path must hand the owner the projects page');
+test('the watch give-up hands the owner their projects view — "the hall has it" is dead', async () => {
+  // the wizard (and its 33-minute watch cap) lives on /projects now
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /your projects page/, 'the give-up path must hand the owner the projects view');
   assert.doesNotMatch(body, /the hall has it/, 'the false poll-stop copy must be gone');
 });
 
@@ -151,7 +155,8 @@ test('the stamp is derived from CONTENT, so it changes only when the file does',
 });
 
 test('every landing surface is stamped, not just the one that broke', async () => {
-  for (const p of ['/', '/projects', '/create']) {
+  // /create dropped from the loop: it 302s since task 1002763 (no body to stamp)
+  for (const p of ['/', '/projects']) {
     const res = await request(p);
     if (res.status !== 200) continue;
     assert.doesNotMatch(res.body, /(href|src)="\/assets\/[^"?]+"/,
@@ -163,8 +168,8 @@ test('routes and API paths are never mistaken for assets', async () => {
   // stamping resolves the URL against public-landing/ — a route names no file,
   // so it must come back untouched rather than acquiring a meaningless ?v=
   const res = await request('/projects');
-  assert.match(res.body, /href="\/create"/, '/create is a route, not an asset');
-  assert.doesNotMatch(res.body, /href="\/create\?v=/);
+  assert.match(res.body, /href="\/"/, "'/' is a route, not an asset");
+  assert.doesNotMatch(res.body, /href="\/\?v=/);
   assert.doesNotMatch(res.body, /href="\/projects\?v=/);
   assert.doesNotMatch(res.body, /\/api\/bongos\/[^"]*\?v=[0-9a-f]{8}/,
     'API paths must never be stamped');