@bongos/core 1.19.116 → 1.19.118

package/modules/provisioning/tests/provisioning.mjs

@@ -228,5 +228,12 @@ await ta('claimNextOAuthManifest flips code_received→converting, gated on an A
   assert.match(sql, /m\.status = 'code_received' AND i\.status = 'active'/);
 });
 
+t('publicInstance projects the declared type — nullable, never silently dropped (task 1002772)', () => {
+  const p = P.publicInstance({ id: 1, slug: 'x', status: 'active', type: 'game' });
+  assert.equal(p.type, 'game', 'the allow-list projection must carry the declaration');
+  const q = P.publicInstance({ id: 2, slug: 'y', status: 'active' });
+  assert.equal(q.type, null, 'a row predating provisioning_007 projects null, not undefined');
+});
+
 console.log(`\nprovisioning module: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.116",
+  "version": "1.19.118",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.116",
+      "version": "1.19.118",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.116",
+  "version": "1.19.118",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -581,7 +581,11 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .tbl .colStatus{width:1%;white-space:nowrap;}
 .tbl .colGo{width:1%;white-space:nowrap;padding-left:8px;}
 .tbl .colName{width:auto;}
-@media (max-width:780px){.tbl .colTags{display:none;}}
+.tbl .colType{width:1%;white-space:nowrap;}
+/* the declared-type tag (task 1002772) — its own vocabulary: not the relationship
+   .pill, not the liveness .chip. Two different facts never wear the same chrome. */
+.typeTag{font-family:var(--font-mono);font-size:10.5px;font-weight:500;color:var(--ink-soft);border:1px solid var(--line);border-radius:999px;padding:2px 9px;white-space:nowrap;}
+@media (max-width:780px){.tbl .colTags,.tbl .colType{display:none;}}
 
 /* ── the living sky (task 1002762): camera, spotlight, hover card ──
    The camera is ONE transform on .skyCam; orbs carry only their own physics

package/public-landing/projects.html

@@ -58,7 +58,7 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
    over one, so both modes and a re-brand carry it for free (C1/C2/C4).
    Naming: the wizard's field wrapper is .wizField — cosmos owns .field (the
    orb map) — and its done checklist is .humanSteps — cosmos owns .steps
-   (the four-beat rail). Its inputs are scoped to the view so the glass
+   (the five-beat rail). Its inputs are scoped to the view so the glass
    search pills (#mapQ, #mineQ) keep their own look. */
 .panel{display:none;}
 .panel.on{display:block;animation:fadeStep .3s ease both;}
@@ -248,6 +248,22 @@ h1[tabindex="-1"]:focus{outline:none;}
    and faint ink only reaches 3.96:1 on it (task 1002749). */
 .ghrow .priv{margin-left:auto;font-size:11px;font-weight:600;color:var(--ink-soft);background:color-mix(in srgb,var(--ink) 8%,transparent);border-radius:5px;padding:1px 6px;}
 
+/* the type declaration (task 1002772): five selectable pills + a description
+   card themed per type via a component-scoped custom property (C1 — never a
+   page-local root token). No dark rules of its own: every surface is a token
+   or a color-mix over one, so both modes carry it (C2/C4). */
+.typeCards{display:flex;flex-wrap:wrap;gap:8px;margin-bottom:14px;}
+.tpill{cursor:pointer;font-family:var(--font-body);font-weight:700;font-size:13.5px;color:var(--ink-soft);
+  background:var(--bg-card);border:2px solid var(--line);border-radius:999px;padding:9px 16px;
+  transition:all .12s ease;}
+.tpill:hover{border-color:var(--accent);color:var(--accent-deep);}
+.tpill[aria-pressed=true]{background:var(--accent);border-color:var(--accent);color:#fff;}
+.typeCard{border:2px solid color-mix(in srgb,var(--type-acc) 35%,var(--bg-card));border-radius:18px;
+  padding:16px 18px;margin-bottom:6px;
+  background:linear-gradient(180deg,color-mix(in srgb,var(--type-acc) 9%,var(--bg-card)) 0%,var(--bg-card) 100%);}
+.typeCard b{display:block;font-family:var(--font-display);font-size:17px;color:color-mix(in srgb,var(--type-acc) 40%,var(--ink));margin-bottom:4px;}
+.typeCard p{font-size:13.5px;font-weight:500;color:var(--ink-soft);line-height:1.55;}
+
 /* 840px matches cosmos's createSplit collapse, the breakpoint the old /create
    used (860) — the two-up grids and the bongo cell fold together */
 @media (max-width:840px){.row2,.choices{grid-template-columns:1fr;}}
@@ -384,6 +400,7 @@ h1[tabindex="-1"]:focus{outline:none;}
       <thead>
         <tr>
           <th class="colName" data-sort="name" aria-sort="ascending">Project</th>
+          <th class="colType">Type</th>
           <th class="right" data-sort="builders">Builders</th>
           <th class="colTags">Runs</th>
           <th class="right colStatus">Status</th>
@@ -400,6 +417,7 @@ h1[tabindex="-1"]:focus{outline:none;}
           <td class="colName"><span class="pname"><span class="pdot" style="--acc:var(--accent)"></span>
             <span><span class="ptitle" data-brand-product-inline>Cloud Bongos</span><span id="selfPill"></span><br>
             <span class="ptag">this platform</span></span></span></td>
+          <td class="colType">—</td>
           <td class="right num" id="selfBuilders">—</td>
           <td class="colTags" id="selfTags">—</td>
           <td class="right colStatus"><span class="chip calm"><span class="cdot"></span>—</span></td>
@@ -439,6 +457,7 @@ h1[tabindex="-1"]:focus{outline:none;}
            authoritative-looking element of the page reads as broken, not
            honest (task 1002778). -->
       <dl class="cardMeta" id="cardMeta" hidden>
+        <dt id="cardTypeL" hidden>Type</dt><dd id="cardType" hidden></dd>
         <dt id="cardBuildersL" hidden>Builders</dt><dd id="cardBuilders" hidden></dd>
         <dt id="cardRunsL" hidden>Runs</dt><dd id="cardRuns" hidden></dd>
         <dt id="cardOwnerL" hidden>Owner</dt><dd id="cardOwner" hidden></dd>
@@ -507,7 +526,7 @@ h1[tabindex="-1"]:focus{outline:none;}
 
 <!-- ══════════════════ VIEW · NEW PROJECT ══════════════════════════════════
      The whole create wizard, absorbed from /create (task 1002763; direction
-     §4 — that route now 302s here). Six panels behind the four-beat rail; the
+     §4 — that route now 302s here). Seven panels behind the five-beat rail; the
      wizard block in the script below drives them. Same trust boundary as
      ever: every button here only ENQUEUES a provisioning request (ADR 0111).
      The name panel carries a static `on` so a no-script visitor still reads
@@ -517,9 +536,10 @@ h1[tabindex="-1"]:focus{outline:none;}
     <div class="card">
       <ol class="steps" aria-label="Creation steps">
         <li class="now" data-step="1"><span class="snum">1</span><span class="slbl">Name</span></li>
-        <li data-step="2"><span class="snum">2</span><span class="slbl">Home</span></li>
-        <li data-step="3"><span class="snum">3</span><span class="slbl">Address</span></li>
-        <li data-step="4"><span class="snum">4</span><span class="slbl">Create</span></li>
+        <li data-step="2"><span class="snum">2</span><span class="slbl">Type</span></li>
+        <li data-step="3"><span class="snum">3</span><span class="slbl">Home</span></li>
+        <li data-step="4"><span class="snum">4</span><span class="slbl">Address</span></li>
+        <li data-step="5"><span class="snum">5</span><span class="slbl">Create</span></li>
       </ol>
 
       <div class="createSplit">
@@ -566,11 +586,39 @@ h1[tabindex="-1"]:focus{outline:none;}
               and capture-resistant by design.</p>
           </section>
 
-          <!-- step 2 · home (repo + mode) -->
+          <!-- step 2 · type (task 1002772) — a DECLARATION, closed vocabulary
+               (owner decision 2026-08-13): Game / Research / Business /
+               Non-Profit / Not Sure, selectable buttons with a themed
+               description card. Not Sure is the escape hatch — nobody is
+               forced into a wrong answer, and it can change later. -->
+          <section class="panel" id="panel-type" aria-labelledby="type-h">
+            <h1 id="type-h">What kind of project is it?</h1>
+            <p class="lede">Pick the shape that fits best — it labels the project on the map. Not sure is a fine answer.</p>
+            <form data-next="3">
+              <div class="typeCards" id="typeCards" role="group" aria-label="Project type">
+                <button type="button" class="tpill" data-type="game" aria-pressed="false">Game</button>
+                <button type="button" class="tpill" data-type="research" aria-pressed="false">Research</button>
+                <button type="button" class="tpill" data-type="business" aria-pressed="false">Business</button>
+                <button type="button" class="tpill" data-type="non-profit" aria-pressed="false">Non-Profit</button>
+                <button type="button" class="tpill" data-type="not-sure" aria-pressed="false">Not Sure</button>
+              </div>
+              <div class="typeCard" id="typeCard" hidden aria-live="polite">
+                <b id="typeCardName"></b>
+                <p id="typeCardDesc"></p>
+              </div>
+              <div class="hint" id="h-projtype">&nbsp;</div>
+              <div class="nav">
+                <button type="button" class="btn ghost" data-back="1">← Back</button>
+                <button type="submit" class="btn">Next →</button>
+              </div>
+            </form>
+          </section>
+
+          <!-- step 3 · home (repo + mode) -->
           <section class="panel" id="panel-home" aria-labelledby="home-h">
             <h1 id="home-h">Where the code lives</h1>
             <p class="lede">Every project is a real GitHub repository that you own. Start from a clean slate, or bring a repo you already have.</p>
-            <form data-next="3">
+            <form data-next="4">
               <div class="choices" role="group" aria-label="Starting point">
                 <button type="button" class="choice" id="c-green" aria-pressed="true">
                   <!-- token-built, not platform orange — public-landing/ ships wholesale to
@@ -629,19 +677,19 @@ h1[tabindex="-1"]:focus{outline:none;}
               </div>
               <div class="hint" id="h-home">&nbsp;</div>
               <div class="nav">
-                <button type="button" class="btn ghost" data-back="1">← Back</button>
+                <button type="button" class="btn ghost" data-back="2">← Back</button>
                 <button type="submit" class="btn">Next →</button>
               </div>
             </form>
           </section>
 
-          <!-- step 3 · address — a CONFIRMATION, not a form (task 1002704: every project
+          <!-- step 4 · address — a CONFIRMATION, not a form (task 1002704: every project
                gets its slug subdomain assigned up front; opt-out lives in the disclosure).
                The domainless default was a proven dead-end (QA walk, task 1002702). -->
           <section class="panel" id="panel-address" aria-labelledby="addr-h">
             <h1 id="addr-h">Its address in the sky</h1>
             <p class="lede">The handle names your project on the platform — and its address comes with it. Sign-in, sharing, everything just works from the moment it stands up.</p>
-            <form data-next="4">
+            <form data-next="5">
               <label class="wizField"><span>Project handle</span>
                 <input type="text" id="f-slug" placeholder="mercury" autocomplete="off" maxlength="40" spellcheck="false">
                 <div class="hint" id="h-slug">&nbsp;</div>
@@ -663,13 +711,13 @@ h1[tabindex="-1"]:focus{outline:none;}
                 </details>
               </div>
               <div class="nav">
-                <button type="button" class="btn ghost" data-back="2">← Back</button>
+                <button type="button" class="btn ghost" data-back="3">← Back</button>
                 <button type="submit" class="btn">Next →</button>
               </div>
             </form>
           </section>
 
-          <!-- step 4 · review + create -->
+          <!-- step 5 · review + create -->
           <section class="panel" id="panel-review" aria-labelledby="rev-h">
             <h1 id="rev-h">Ready to roll</h1>
             <p class="lede">One tap files the request and the platform starts standing your project up — server, database, address. Here's the beat you're about to drop:</p>
@@ -677,7 +725,7 @@ h1[tabindex="-1"]:focus{outline:none;}
             <div class="alert" id="createAlert" role="alert"></div>
             <div class="nav" style="flex-direction:column;align-items:stretch;">
               <button type="button" class="btn big" id="doCreate">Create my project</button>
-              <button type="button" class="btn ghost" data-back="3" style="align-self:flex-start;margin-top:10px;">← Back</button>
+              <button type="button" class="btn ghost" data-back="4" style="align-self:flex-start;margin-top:10px;">← Back</button>
             </div>
             <p class="finePrint">This files the request; the control plane does the real standup and nothing touches servers from this page. You'll get the few steps only you can do right after.</p>
           </section>
@@ -1029,6 +1077,25 @@ h1[tabindex="-1"]:focus{outline:none;}
     if (tags.length > TAG_CAP) shown.push('<span>+' + (tags.length - TAG_CAP) + '</span>');
     return '<span class="tags">' + shown.join('') + '</span>';
   }
+  /* The declared-type vocabulary (task 1002772; owner decision 2026-08-13).
+     One formatter for the table cell + the card, like tagsHtml: null means
+     "not declared" and renders an em dash — never a guess. The per-type accent
+     reuses the ORB_ACCENTS five-token palette (component-scoped, C1). */
+  var TYPE_META = {
+    'game':       { label: 'Game',       acc: 'var(--accent)',     desc: 'A world to play in. Agents build the world, the rules, and the play itself.' },
+    'research':   { label: 'Research',   acc: 'var(--sea)',        desc: 'A question being worked. Agents gather the evidence, run the experiments, and write up what holds — the repo is the lab notebook.' },
+    'business':   { label: 'Business',   acc: 'var(--terracotta)', desc: 'A venture with customers. Agents build the product and the plumbing behind it.' },
+    'non-profit': { label: 'Non-Profit', acc: 'var(--gold-soft)',  desc: 'A cause, not a profit line. Agents build for a mission and the community around it.' },
+    'not-sure':   { label: 'Not Sure',   acc: 'var(--rule-soft)',  desc: 'Still finding its shape. Pick this now — nothing depends on it.' }
+  };
+  function typeLabel(t) {
+    var m = TYPE_META[t];
+    return m ? m.label : '';
+  }
+  function typeHtml(t) {
+    var l = typeLabel(t);
+    return l ? '<span class="typeTag">' + l + '</span>' : '—';
+  }
   function matchesMapQuery(p, q) {
     if (!q) return true;
     /* an owned entry also answers by slug and address — the same fields the
@@ -1116,6 +1183,7 @@ h1[tabindex="-1"]:focus{outline:none;}
            unreachable — and an em dash says exactly that. 0 is a real answer and
            renders as 0, because "nobody has joined yet" is a different fact from
            "we could not ask". */
+        '<td class="colType">' + typeHtml(p.type) + '</td>' +
         '<td class="right num">' + (p.builders == null ? '—' : esc(String(p.builders))) + '</td>' +
         '<td class="colTags">' + tagsHtml(p.tags) + '</td>' +
         /* liveness on a CATALOG row is NOT probed by this surface — a chip
@@ -1146,6 +1214,9 @@ h1[tabindex="-1"]:focus{outline:none;}
       var h = hostOf(p.origin);
       catalogHosts[h] = 1;
       p._inst = ownedByHost[h] || null;
+      /* the catalog may predate the declaration the owner filed with the
+         create — their own instance row is a truthful source, never a guess */
+      if (p.type == null && p._inst && p._inst.type) p.type = p._inst.type;
     });
     var browse = catalog.slice();
     ownedInstances.forEach(function (inst) {
@@ -1154,7 +1225,7 @@ h1[tabindex="-1"]:focus{outline:none;}
       browse.push({
         name: inst.slug, tagline: inst.domain || '',
         origin: inst.domain ? 'https://' + inst.domain : '',
-        builders: null, tags: null,
+        builders: null, tags: null, type: inst.type || null,
         _inst: inst, _acc: ORB_ACCENTS[slugAccent(inst.slug)]
       });
     });
@@ -1282,7 +1353,8 @@ h1[tabindex="-1"]:focus{outline:none;}
     /* builders: 0 is a real answer ("nobody has joined yet"), null is "we could
        not ask" and hides. runs: [] is a real answer too — the project declares
        nothing beyond the core set, which the owner voiced as "core". */
-    var any = cardFact('cardBuilders', p.builders == null ? '' : String(p.builders));
+    var any = cardFact('cardType', typeLabel(p.type));
+    any = cardFact('cardBuilders', p.builders == null ? '' : String(p.builders)) || any;
     any = cardFact('cardRuns', Array.isArray(p.tags) ? tagsHtml(p.tags) : '', true) || any;
     /* when the rel chip already says "yours", naming the viewer as Owner is
        noise — the fact answers strangers, not the person it describes */
@@ -1929,9 +2001,13 @@ h1[tabindex="-1"]:focus{outline:none;}
     var root = $('view-new');
 
     /* ── state ── */
-    var DRAFT_KEY = 'cb-create-draft';
+    /* -v2 since task 1002772: the step indices renumbered (Type joined as 2),
+       so a draft written under the five-step numbering must be ignored, not
+       reinterpreted — a stale step 4 would land on Address and skip the Type
+       gate with the rail already marking it done. */
+    var DRAFT_KEY = 'cb-create-draft-v2';
     var CREATED_KEY = 'cb-created-instance';
-    var state = { step: 0, name: '', mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
+    var state = { step: 0, name: '', projType: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
     try { Object.assign(state, JSON.parse(sessionStorage.getItem(DRAFT_KEY) || '{}')); } catch (e) {}
     var authKnown = false;   /* flips true when the boot's /me settles, either way */
 
@@ -1945,7 +2021,7 @@ h1[tabindex="-1"]:focus{outline:none;}
         state.name = handedName.trim().slice(0, 80);
         state.slug = deriveSlug(state.name); state.slugTouched = false;
         state.repo = deriveRepo(state.name); state.repoTouched = false;
-        state.step = state.step >= 1 && state.step <= 4 ? state.step : 1;
+        state.step = state.step >= 1 && state.step <= 5 ? state.step : 1;
         try { sessionStorage.setItem(DRAFT_KEY, JSON.stringify(state)); } catch (e) {}
       }
     } catch (e) {}
@@ -2044,8 +2120,10 @@ h1[tabindex="-1"]:focus{outline:none;}
       try { sessionStorage.setItem(DRAFT_KEY, JSON.stringify(state)); } catch (e) {}
     }
 
-    /* ── step navigation ── */
-    var panels = { 0: 'panel-gate', 1: 'panel-name', 2: 'panel-home', 3: 'panel-address', 4: 'panel-review', 5: 'panel-done' };
+    /* ── step navigation ──
+       Six steps since task 1002772: gate 0 · name 1 · type 2 · home 3 ·
+       address 4 · review 5 · done 6 (the rail shows 1-5; done marks it all). */
+    var panels = { 0: 'panel-gate', 1: 'panel-name', 2: 'panel-type', 3: 'panel-home', 4: 'panel-address', 5: 'panel-review', 6: 'panel-done' };
     function show(step, moveFocus) {
       state.step = step;
       Object.keys(panels).forEach(function (k) {
@@ -2054,11 +2132,11 @@ h1[tabindex="-1"]:focus{outline:none;}
       root.querySelectorAll('.steps li').forEach(function (li) {
         var n = Number(li.getAttribute('data-step'));
         li.classList.toggle('now', n === step);
-        li.classList.toggle('done', n < step || step === 5);
+        li.classList.toggle('done', n < step || step === 6);
       });
       saveDraft();
       /* the done step takes the whole card — the bongo pair steps aside */
-      root.querySelector('.createSplit').classList.toggle('wizDone', step === 5);
+      root.querySelector('.createSplit').classList.toggle('wizDone', step === 6);
       /* focus moves ONLY on a deliberate step (the hub rule setView already
          applies to this view: never on boot, never on a background settle) */
       if (moveFocus) {
@@ -2068,9 +2146,9 @@ h1[tabindex="-1"]:focus{outline:none;}
       /* the repo probe is authenticated — never fire it before /me settles
          (a pre-auth probe 401s for strangers and, worse, could seed the
          draft's owner with myLogin()'s placeholder) */
-      if (step === 2) { syncHome(); if (authKnown) ensureRepoAccess(); }
-      if (step === 3) renderAddrPanel();
-      if (step === 4) renderReview();
+      if (step === 3) { syncHome(); if (authKnown) ensureRepoAccess(); }
+      if (step === 4) renderAddrPanel();
+      if (step === 5) renderReview();
     }
 
     /* ── field wiring ── */
@@ -2118,8 +2196,35 @@ h1[tabindex="-1"]:focus{outline:none;}
     $('c-adopt').addEventListener('click', function () { setMode('adopt'); });
     setMode(state.mode);
 
+    /* ── the type declaration (task 1002772) ── selecting a pill fills the
+       description card, themed per type via --type-acc (component-scoped, C1) */
+    function paintType(t) {
+      root.querySelectorAll('#typeCards .tpill').forEach(function (b) {
+        b.setAttribute('aria-pressed', String(b.getAttribute('data-type') === t));
+      });
+      var card = $('typeCard');
+      var m = t && TYPE_META[t];
+      if (m) {
+        card.hidden = false;
+        card.style.setProperty('--type-acc', m.acc);
+        $('typeCardName').textContent = m.label;
+        $('typeCardDesc').textContent = m.desc;
+      } else {
+        card.hidden = true;
+      }
+    }
+    root.querySelectorAll('#typeCards .tpill').forEach(function (b) {
+      b.addEventListener('click', function () {
+        state.projType = b.getAttribute('data-type');
+        $('h-projtype').innerHTML = '&nbsp;'; $('h-projtype').className = 'hint';
+        paintType(state.projType);
+        saveDraft();
+      });
+    });
+    paintType(state.projType || null);
+
     /* ── GitHub-integrated repo picker (adopt) + auto-create (fresh) — task 1002099 / ADR 0143.
-          Progressive enhancement: probe GET /github/repos once we reach step 2.
+          Progressive enhancement: probe GET /github/repos once we reach the Home step.
             200 → we hold repo access → show the picker (adopt) / name field (fresh);
             403 → offer to grant repo access (a ?repos=1 re-sign-in);
             503 (server can't store the token) or any error → the manual inputs.
@@ -2134,7 +2239,7 @@ h1[tabindex="-1"]:focus{outline:none;}
 
     function connectRepos(e) {
       if (e) e.preventDefault();
-      /* Same-tab navigation so the sessionStorage draft round-trips back to step 2. */
+      /* Same-tab navigation so the sessionStorage draft round-trips back to the Home step. */
       window.location.assign(API + '/auth/web/start?return=/projects%3Fview%3Dnew&repos=1');
     }
     $('ghConnectBtn').addEventListener('click', connectRepos);
@@ -2292,6 +2397,14 @@ h1[tabindex="-1"]:focus{outline:none;}
         return true;
       }
       if (step === 2) {
+        if (!state.projType) {
+          $('h-projtype').textContent = 'Pick one — Not Sure is a fine answer.';
+          $('h-projtype').className = 'hint err';
+          return false;
+        }
+        return true;
+      }
+      if (step === 3) {
         var homeErr = function (msg) { $('h-home').textContent = msg; $('h-home').className = 'hint err'; return false; };
         if (repoAccess === 'need-connect') return homeErr('Allow GitHub repo access to pick or create your repository — or choose “enter it manually”.');
         if (repoAccess === true && state.mode !== 'adopt') {
@@ -2306,7 +2419,7 @@ h1[tabindex="-1"]:focus{outline:none;}
         $('h-home').innerHTML = '&nbsp;'; $('h-home').className = 'hint';
         return true;
       }
-      if (step === 3) {
+      if (step === 4) {
         if (!validSlug(state.slug)) {
           $('h-slug').textContent = '2–40 lowercase letters, numbers, or dashes; no leading/trailing/double dash.';
           $('h-slug').className = 'hint err'; $('f-slug').classList.add('bad');
@@ -2347,6 +2460,7 @@ h1[tabindex="-1"]:focus{outline:none;}
       cb.disabled = false; cb.textContent = 'Create my project';
       var rows = [
         ['Project', esc(state.name)],
+        ['Type', typeLabel(state.projType) || 'Not declared'],
         ['Starting from', state.mode === 'adopt' ? 'A repo you already have' : 'A fresh, empty repo'],
         ['Repository', '<code>' + esc(state.owner + '/' + state.repo) + '</code>'],
         ['Handle', '<code>' + esc(state.slug) + '</code>'],
@@ -2415,6 +2529,7 @@ h1[tabindex="-1"]:focus{outline:none;}
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({
             slug: state.slug,
+            type: state.projType || undefined,
             hosting_shape: 'standalone',
             domain: resolvedDomain() || undefined,
             target_ref: state.owner + '/' + state.repo,
@@ -2444,7 +2559,7 @@ h1[tabindex="-1"]:focus{outline:none;}
           sessionStorage.removeItem(DRAFT_KEY);
         } catch (e) {}
         renderDone();
-        show(5, true);
+        show(6, true);
         startProgress(data.instance && data.instance.id);
       }).catch(function (err) {
         if (String(err && err.message) === 'signing in') return;
@@ -2452,7 +2567,7 @@ h1[tabindex="-1"]:focus{outline:none;}
         if (err && err.gotoHome) {
           /* A repo-creation problem (name taken / reconnect) — bounce back to the Home
              step with the reason, so the user fixes it where the repo is chosen. */
-          show(2, true);
+          show(3, true);
           $('h-home').textContent = err.homeMsg || 'Please revisit the repository step.';
           $('h-home').className = 'hint err';
           return;
@@ -2828,12 +2943,13 @@ h1[tabindex="-1"]:focus{outline:none;}
         live = { instStatus: null, manifest: null, manifestMsg: '' };
         lastStepsHtml = '';
         try { sessionStorage.removeItem(CREATED_KEY); sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
-        state = { step: 1, name: '', mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
+        state = { step: 1, name: '', projType: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
         $('newName').value = ''; $('f-owner').value = ''; $('f-repo').value = ''; $('f-slug').value = ''; $('f-domain').value = '';
         $('f-noaddr').checked = false;
         /* Re-seed the owner from the signed-in account for the next project. */
         if (me && me.github_login) { state.owner = me.github_login; $('f-owner').value = state.owner; }
         $('h-name').innerHTML = '&nbsp;';
+        paintType(null);
         setMode('greenfield');
         show(1, true);
       });
@@ -2858,15 +2974,15 @@ h1[tabindex="-1"]:focus{outline:none;}
         state.name = created.name || created.slug; state.slug = created.slug || '';
         state.domain = created.domain || ''; state.mode = created.mode || 'greenfield';
         renderDone();
-        show(5, !!focus);
+        show(6, !!focus);
         startProgress(created.id);
         resumePolls();
         return;
       }
       /* before identity settles, never render past the name step: deeper steps
-         carry authenticated side effects (the step-2 repo probe), and onAuth()
+         carry authenticated side effects (the Home-step repo probe), and onAuth()
          re-enters to the real draft step the moment /me answers */
-      var step = authKnown && state.step >= 1 && state.step <= 4 ? state.step : 1;
+      var step = authKnown && state.step >= 1 && state.step <= 5 ? state.step : 1;
       if (step === 1) {
         show(1, false);
         if (focus) $('newName').focus();

package/scripts/gds/provision.js

@@ -1007,7 +1007,9 @@ async function federateInstance(inst, deps) {
     ownerGithubId = rows[0] ? rows[0].github_id : null;
   } catch { /* non-fatal */ }
   await platformIdentity.registerClient(
-    { clientId, secret: clientSecret, name: inst.slug, redirectUris, origin, ownerGithubId },
+    // type: the owner's declaration rides the instance row from the create
+    // wizard (task 1002772) and lands on the catalog row here — never guessed.
+    { clientId, secret: clientSecret, name: inst.slug, redirectUris, origin, ownerGithubId, type: inst.type },
     { pool: db },
   );
   log(`  [federate] registered client '${clientId}' on the hub (origin ${origin})`);

package/src/module-api.js

@@ -659,8 +659,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.114 with no explicit bump. run 31825824596. (task 1002620)
 //   1.19.116 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.115 with no explicit bump. run 31827642395. (task 1002620)
+//   1.19.117 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.116 with no explicit bump. run 31830559253. (task 1002620)
+//   1.19.118 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.117 with no explicit bump. run 31833658900. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.116'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.118'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/ui/adapters/claude-design/index.js

@@ -20,6 +20,18 @@ const os = require('node:os');
 
 const ID = 'claude-design';
 
+// Fallback when a caller-supplied token tree omits colors.accent — resolved from
+// the neutral token file so the adapter never carries a brand literal of its own;
+// the catch value is the neutral pack's accent, kept equal by
+// tests/design_tokens_sync.mjs (task 1002752).
+const FALLBACK_ACCENT = (() => {
+  try {
+    return JSON.parse(fs.readFileSync(
+      path.resolve(__dirname, '..', '..', '..', '..', 'config', 'design-tokens.neutral.json'), 'utf8',
+    )).colors.accent || '#ce4806';
+  } catch { return '#ce4806'; }
+})();
+
 // ── token helpers ─────────────────────────────────────────────────────────────
 
 function camelToKebab(s) {
@@ -159,7 +171,7 @@ label{display:block;font-size:10px;color:#888;text-transform:uppercase;letter-sp
 function spacingHtml(tokens) {
   const scale = tokens.scale || {};
   const colors = tokens.colors || {};
-  const accent = colors.accent || '#f97316';
+  const accent = colors.accent || FALLBACK_ACCENT;
   const rows = Object.entries(scale).map(([k, v]) => `
     <tr>
       <td><code>${k}</code></td>
@@ -182,7 +194,7 @@ code{font-size:12px;}
 
 function radiiHtml(tokens) {
   const radius = tokens.radius || {};
-  const accent = (tokens.colors && tokens.colors.accent) || '#f97316';
+  const accent = (tokens.colors && tokens.colors.accent) || FALLBACK_ACCENT;
   const boxes = Object.entries(radius).map(([k, v]) => `
     <div style="display:inline-block;margin:8px;">
       <div style="width:64px;height:64px;background:${accent};border-radius:${v};"></div>

package/tests/cosmos_token_contrast.mjs

@@ -178,6 +178,13 @@ const PAIRS = [
   // alone do not cover them
   ['?view=new .ghrow .priv 11px',       'var(--ink-soft)',      'color-mix(in srgb,var(--ink) 8%,var(--bg-deep))', 4.5],
   ['--on-ok on an --ok fill',           'var(--on-ok)',         'var(--ok)',            4.5],
+  // the wizard's per-type description card (task 1002772): heading ink is a
+  // 40%-accent ink mix over the card's own 9%-accent tint — one row per type
+  ['typeCard heading · game',           'color-mix(in srgb,var(--accent) 40%,var(--ink))',     'color-mix(in srgb,var(--accent) 9%,var(--bg-card))',     4.5],
+  ['typeCard heading · research',       'color-mix(in srgb,var(--sea) 40%,var(--ink))',        'color-mix(in srgb,var(--sea) 9%,var(--bg-card))',        4.5],
+  ['typeCard heading · business',       'color-mix(in srgb,var(--terracotta) 40%,var(--ink))', 'color-mix(in srgb,var(--terracotta) 9%,var(--bg-card))', 4.5],
+  ['typeCard heading · non-profit',     'color-mix(in srgb,var(--gold-soft) 40%,var(--ink))',  'color-mix(in srgb,var(--gold-soft) 9%,var(--bg-card))',  4.5],
+  ['typeCard heading · not-sure',       'color-mix(in srgb,var(--rule-soft) 40%,var(--ink))',  'color-mix(in srgb,var(--rule-soft) 9%,var(--bg-card))',  4.5],
   ['?view=new input ::placeholder',     'var(--ink-faint)',     CARD,                   4.5],
   ['?view=new .ghlist .hint on deep',   'var(--ink-faint)',     'var(--bg-deep)',       4.5],
   ['--chrome-accent wordmark',          'var(--chrome-accent)', 'var(--page-bg)',       4.5],