@bongos/core 1.19.261 → 1.19.263

package/modules/hall-ui/public/goals-page.js

@@ -23,6 +23,14 @@
 (function () {
   'use strict';
   const { escapeHtml, $, fmtNum, fmtDate, toast, rankLabel } = window.OTB;
+  // Shared task-domain helpers (task 1002463). These lived in two copies here and
+  // in the other board and had already drifted — goals-page.js had silently lost
+  // friendlyBatchReason's MODULE_CONFLICT case. Destructured so every call site
+  // below reads exactly as before; the single copy lives in task-lib.js.
+  const {
+    priorityRank, touchesConflict, rankTagHtml, deHashRefs,
+    creditsPerMinute, buildPromptForTask, friendlyBatchReason,
+  } = window.OTBTaskLib;
   // Shared component kit (hall-kit.js, task 2166): pager, filter bar, tabs,
   // empty/skeleton states — adopted here by task 2171.
   const { makePager, paginate, wirePager, pagerBarHtml, makeTabs, makeFilterBar,
@@ -497,40 +505,10 @@
   // ===================================================================
 
   // Board-identical numeric helpers (work.js:214-240).
-  function creditsPerMinute(t) {
-    const c = Number(t.credits_reward); const m = Number(t.est_minutes);
-    if (!c || !m || m <= 0) return -Infinity;
-    return c / m;
-  }
-  function priorityRank(p) {
-    if (!p) return 99;
-    const m = /^P(\d+)/i.exec(String(p));
-    return m ? Number(m[1]) : 99;
-  }
   // Two tasks can't run in parallel if their touches[] overlap (exact path or a
   // directory-prefix either way); empty touches never conflict. Powers the
   // filter bar's "Run mode" control (work.js:230-239).
-  function touchesConflict(aList, bList) {
-    const norm = (p) => String(p).replace(/\/+$/, '');
-    for (const a of (Array.isArray(aList) ? aList : [])) {
-      const na = norm(a);
-      for (const b of (Array.isArray(bList) ? bList : [])) {
-        const nb = norm(b);
-        if (na === nb || na.startsWith(nb + '/') || nb.startsWith(na + '/')) return true;
-      }
-    }
-    return false;
-  }
   // Per-task rank floor tag (work.js:247-254).
-  function rankTagHtml(requiresRank) {
-    const rr = (requiresRank || 'xenos').toLowerCase();
-    if (rr === 'xenos') {
-      return '<span class="task__tag task__tag--rank-open" title="No rank floor — any builder can claim this task">Any rank</span>';
-    }
-    const label = rr === 'archon' ? 'Archon' : rr.charAt(0).toUpperCase() + rr.slice(1) + '+';
-    return `<span class="task__tag task__tag--rank" title="Minimum rank required to claim this task">${escapeHtml(label)}</span>`;
-  }
-
   // Free-text search over the goal's todo list (work.js:261-274, minus the
   // goal-title match — a single goal makes that redundant).
   function todoSearchQuery() {
@@ -548,21 +526,6 @@
 
   // Copy-prompt (work.js:454-503). deHashRefs stops a bare #NNN autolinking to
   // GitHub in a pasted session; the prompt points the builder at the hall task URL.
-  function deHashRefs(text) {
-    return String(text == null ? '' : text).replace(/#(\d{1,5})\b/g, 'task $1');
-  }
-  function buildPromptForTask(t) {
-    const desc = deHashRefs((t.description || '').trim());
-    const hallBase = location.hostname.startsWith('builders.') ? location.origin : `${location.origin}/builders`;
-    const hallUrl = `${hallBase}#/task/${t.id}`;
-    return [
-      `I am working on GDS task ${t.id} (${t.title}) — ${hallUrl}`,
-      `Read the task description, follow its acceptance criteria, stay strictly within touches[], and ship via /builder-ship when done.`,
-      ``,
-      `Task description:`,
-      desc || '(no description)',
-    ].join('\n');
-  }
   async function copyPromptForTask(taskId, btn) {
     const t = state.work.todo.find((x) => String(x.id) === String(taskId));
     if (!t) return;
@@ -697,21 +660,6 @@
     }
   }
   // A single batch-item failure reason → a readable fragment (work.js:545-562).
-  function friendlyBatchReason(item) {
-    switch (item && item.reason) {
-      case 'TASK_NOT_FOUND': return 'no longer exists';
-      case 'TASK_NOT_READY': return `no longer ready${item.currentStatus ? ` (${item.currentStatus})` : ''}`;
-      case 'ALREADY_CLAIMED': return 'already claimed';
-      case 'TOUCHES_CONFLICT': return `overlaps ${item.conflictTaskTitle || 'an active claim'}`;
-      case 'BATCH_TOUCHES_CONFLICT': return `overlaps task #${item.conflictsWithTaskId} in this selection`;
-      case 'DEPS_NOT_SHIPPED': return 'waits on unshipped dependencies';
-      case 'rank_too_low_for_task':
-      case 'XENOS_RESTRICTED':
-      case 'INSUFFICIENT_RANK': return 'rank too low';
-      case 'BUILDER_INACTIVE': return 'account inactive';
-      default: return (item && item.reason) || 'not claimable';
-    }
-  }
   // Bulk claim the selected ready cards (work.js doBulkClaim, claims/batch is
   // all-or-nothing: a 409 batch_failed means nothing was claimed). Reloads the
   // goal's tasks either way so the cards reflect fresh truth.

package/modules/hall-ui/public/goals.html

@@ -194,6 +194,8 @@
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <!-- shared component kit (window.OTBKit) — pager, filter bar, tabs, empty/skeleton (task 2166). -->
 <script src="/builders/hall-kit.js"></script>
+<!-- shared TASK-DOMAIN helpers (window.OTBTaskLib) — priority/touches/prompt/refusal-copy, one copy for both boards (task 1002463). -->
+<script src="/builders/task-lib.js"></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>
 <script src="/builders/brand-apply.js?v=2026-06-27-r75"></script>
 <script src="/builders/goals-page.js?v=2026-07-10-goals5"></script>

package/modules/hall-ui/public/task-lib.js

@@ -0,0 +1,136 @@
+// modules/hall-ui/public/task-lib.js — the hall's shared TASK-DOMAIN helpers
+// (task 1002463, from idea 1000567).
+//
+// WHY A SIBLING OF hall-kit.js RATHER THAN PART OF IT. hall-kit.js is explicitly
+// "the SIX primitives every page redesign adopts" — pager, ledger, filter bar,
+// tabs, section rail, empty/skeleton/collapsible. Those are UI *markup* factories,
+// and modules/hall-ui/CLAUDE.md's "no bespoke pager / filter / tab / rail markup"
+// rule is scoped to exactly that. The functions below are task-DOMAIN logic
+// (how a task is ranked, whether two touches[] collide, what a refusal means in
+// English). Folding them into the kit would blur a contract that is currently
+// crisp, so they get their own namespace instead.
+//
+// Contract, mirrored from hall-kit.js so load order only needs "before the page
+// script": dependency-free (own esc(), no window.OTB use), no eval-time DOM, and
+// everything hangs off one global. Node-require-safe so it can be unit-tested.
+//
+// WHAT THIS FIXES. Before extraction these lived in TWO copies (work.js and
+// goals-page.js) and had already drifted: goals-page.js's friendlyBatchReason had
+// silently lost the MODULE_CONFLICT case that work.js handles, so a batch-claim
+// refused for a module collision showed the raw code "MODULE_CONFLICT" to the
+// builder on the Goals page and a sentence on the Tasks board. One copy, one
+// behaviour, and the drift cannot re-open.
+(() => {
+  'use strict';
+
+  // Local HTML-escape — deliberately NOT window.OTB.escapeHtml, so this file
+  // keeps hall-kit's dependency-free property (same reasoning, same duplication
+  // of ~4 lines being cheaper than a load-order constraint).
+  function esc(s) {
+    return String(s ?? '').replace(/[&<>"']/g, (c) => ({
+      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
+    }[c]));
+  }
+
+  // Sort key for a "P3"-style priority string. Unparseable/absent sorts last.
+  function priorityRank(p) {
+    if (!p) return 99;
+    const m = /^P(\d+)/i.exec(String(p));
+    return m ? Number(m[1]) : 99;
+  }
+
+  // Do two touches[] lists collide? A path collides with itself and with anything
+  // under it, so "src/" conflicts with "src/gds/db.js". Trailing slashes are
+  // normalised first so "src" and "src/" are the same path.
+  function touchesConflict(aList, bList) {
+    const norm = (p) => String(p).replace(/\/+$/, '');
+    for (const a of (Array.isArray(aList) ? aList : [])) {
+      const na = norm(a);
+      for (const b of (Array.isArray(bList) ? bList : [])) {
+        const nb = norm(b);
+        if (na === nb || na.startsWith(nb + '/') || nb.startsWith(na + '/')) return true;
+      }
+    }
+    return false;
+  }
+
+  // The rank-floor chip. 'xenos' means no floor at all, which reads as an
+  // invitation ("Any rank") rather than a restriction.
+  function rankTagHtml(requiresRank) {
+    const rr = (requiresRank || 'xenos').toLowerCase();
+    if (rr === 'xenos') {
+      return '<span class="task__tag task__tag--rank-open" title="No rank floor — any builder can claim this task">Any rank</span>';
+    }
+    const label = rr === 'archon' ? 'Archon' : rr.charAt(0).toUpperCase() + rr.slice(1) + '+';
+    return `<span class="task__tag task__tag--rank" title="Minimum rank required to claim this task">${esc(label)}</span>`;
+  }
+
+  // Strip bare "#NNN" GDS refs from prose we are about to paste elsewhere: on
+  // GitHub a bare #NNN autolinks to an ISSUE, and our ids are not GitHub's, so
+  // the link 404s. (Same rule the repo enforces in committed markdown.)
+  // VERBATIM from the two originals — do not "tidy" either detail:
+  //  • `\d{1,5}` (not `\d+`) is load-bearing by omission: a 6+ digit run never
+  //    matches at all, so long numerics are left untouched rather than rewritten.
+  //  • `text == null ? '' : text` (not `text || ''`) keeps falsy-but-real inputs:
+  //    deHashRefs(0) must render "0", not "". `|| ''` would swallow it.
+  // Both were silently changed in an earlier draft of this extraction and the
+  // regression escaped an equivalence pass whose inputs were all strings/null.
+  function deHashRefs(text) {
+    return String(text == null ? '' : text).replace(/#(\d{1,5})\b/g, 'task $1');
+  }
+
+  // Reward density, for the "best value" sort. -Infinity (not 0) for anything
+  // unpriced or unestimated so those sink below every real ratio instead of
+  // tying with a genuinely zero-value task.
+  function creditsPerMinute(t) {
+    const c = Number(t.credits_reward);
+    const m = Number(t.est_minutes);
+    if (!c || !m || m <= 0) return -Infinity;
+    return c / m;
+  }
+
+  // The paste-into-your-agent prompt for one task.
+  function buildPromptForTask(t) {
+    const desc = deHashRefs((t.description || '').trim());
+    const hallBase = location.hostname.startsWith('builders.') ? location.origin : `${location.origin}/builders`;
+    const hallUrl = `${hallBase}#/task/${t.id}`;
+    return [
+      `I am working on GDS task ${t.id} (${t.title}) — ${hallUrl}`,
+      `Read the task description, follow its acceptance criteria, stay strictly within touches[], and ship via /builder-ship when done.`,
+      ``,
+      `Task description:`,
+      desc || '(no description)',
+    ].join('\n');
+  }
+
+  // Turn a batch-claim refusal into a sentence. THE DEFAULT MATTERS: an unmapped
+  // code falls through to the raw string, which is how the missing MODULE_CONFLICT
+  // case leaked a machine code into the Goals page UI. Adding a server-side reason
+  // without adding it here degrades quietly rather than loudly, so keep this in
+  // step with the claim route's refusal codes.
+  function friendlyBatchReason(item) {
+    switch (item && item.reason) {
+      case 'TASK_NOT_FOUND': return 'no longer exists';
+      case 'TASK_NOT_READY': return `no longer ready${item.currentStatus ? ` (${item.currentStatus})` : ''}`;
+      case 'ALREADY_CLAIMED': return 'already claimed';
+      case 'TOUCHES_CONFLICT': return `overlaps ${item.conflictTaskTitle || 'an active claim'}`;
+      case 'BATCH_TOUCHES_CONFLICT': return `overlaps task #${item.conflictsWithTaskId} in this selection`;
+      case 'MODULE_CONFLICT': return item.conflictsWithTaskId
+        ? `shares module "${item.module_key}" with task #${item.conflictsWithTaskId} in this selection`
+        : `shares module "${item.module_key}" with an active claim`;
+      case 'DEPS_NOT_SHIPPED': return 'waits on unshipped dependencies';
+      case 'rank_too_low_for_task':
+      case 'XENOS_RESTRICTED':
+      case 'INSUFFICIENT_RANK': return 'rank too low';
+      case 'BUILDER_INACTIVE': return 'account inactive';
+      default: return (item && item.reason) || 'not claimable';
+    }
+  }
+
+  const api = {
+    priorityRank, touchesConflict, rankTagHtml, deHashRefs,
+    creditsPerMinute, buildPromptForTask, friendlyBatchReason,
+  };
+  if (typeof window !== 'undefined') window.OTBTaskLib = api;
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+})();

package/modules/hall-ui/public/work.html

@@ -135,6 +135,8 @@
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils" defer></script>
 <!-- shared component kit (window.OTBKit) — tabs, pager, filter bar (task 2166). -->
 <script src="/builders/hall-kit.js" defer></script>
+<!-- shared TASK-DOMAIN helpers (window.OTBTaskLib) — priority/touches/prompt/refusal-copy, one copy for both boards (task 1002463). -->
+<script src="/builders/task-lib.js" defer></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail" defer></script>
 <script src="/builders/brand-apply.js?v=2026-06-19-r56" defer></script>
 <script src="/builders/work.js?v=2026-07-03-workboard3" defer></script>

package/modules/hall-ui/public/work.js

@@ -36,6 +36,14 @@
   // file's exact variants (date-only fmtDate; a 2200ms clearing toast).
   // fmtAgo / toAuth / getJSON / postJSON stay local below.
   const { escapeHtml, $, fmtNum } = window.OTB;
+  // Shared task-domain helpers (task 1002463). These lived in two copies here and
+  // in the other board and had already drifted — goals-page.js had silently lost
+  // friendlyBatchReason's MODULE_CONFLICT case. Destructured so every call site
+  // below reads exactly as before; the single copy lives in task-lib.js.
+  const {
+    priorityRank, touchesConflict, rankTagHtml,
+    creditsPerMinute, buildPromptForTask, friendlyBatchReason,
+  } = window.OTBTaskLib;   // deHashRefs is not called here — it is used inside buildPromptForTask
   // Shared component kit (hall-kit.js, task 2166): tabs, pager, filter bar.
   const { makePager, paginate, wirePager, pagerBarHtml, makeTabs, makeFilterBar } = window.OTBKit;
   const fmtDate = (iso) => window.OTB.fmtDate(iso);
@@ -211,48 +219,14 @@
   const sequentialCache = { key: '', order: null };
   let sequentialDebounce = null;
 
-  function creditsPerMinute(t) {
-    const c = Number(t.credits_reward);
-    const m = Number(t.est_minutes);
-    if (!c || !m || m <= 0) return -Infinity;
-    return c / m;
-  }
-
-  function priorityRank(p) {
-    if (!p) return 99;
-    const m = /^P(\d+)/i.exec(String(p));
-    return m ? Number(m[1]) : 99;
-  }
-
   // task 1756: two tasks can't run in parallel if their touches[] overlap — exact
   // path match or a directory-prefix either way (mirrors the server's touchesOverlap
   // / the goals-page conflict estimate). Empty touches never conflict.
-  function touchesConflict(aList, bList) {
-    const norm = (p) => String(p).replace(/\/+$/, '');
-    for (const a of (Array.isArray(aList) ? aList : [])) {
-      const na = norm(a);
-      for (const b of (Array.isArray(bList) ? bList : [])) {
-        const nb = norm(b);
-        if (na === nb || na.startsWith(nb + '/') || nb.startsWith(na + '/')) return true;
-      }
-    }
-    return false;
-  }
-
   // task 1752 (+ 1498 / ADR 0084): the minimum rank to claim a task, as a tag shown
   // on EVERY task row. 'xenos' is the open default → a muted "Any rank" tag (open to
   // all, not a warning); 'archon' shows bare; other ranks show 'Rank+'. Kept here for
   // now; the shared task-detail view (task 1753) will lift this into the common
   // toolkit so every task surface renders rank identically.
-  function rankTagHtml(requiresRank) {
-    const rr = (requiresRank || 'xenos').toLowerCase();
-    if (rr === 'xenos') {
-      return '<span class="task__tag task__tag--rank-open" title="No rank floor — any builder can claim this task">Any rank</span>';
-    }
-    const label = rr === 'archon' ? 'Archon' : rr.charAt(0).toUpperCase() + rr.slice(1) + '+';
-    return `<span class="task__tag task__tag--rank" title="Minimum rank required to claim this task">${escapeHtml(label)}</span>`;
-  }
-
   // task 1829: free-text search over the claimable/backlog lists. Matches the
   // query (case-insensitive substring) against the task id (with or without a
   // leading '#'), the title, and the goal title (taskState.goalTitles — the
@@ -455,23 +429,6 @@
   // our records number tasks separately from GitHub. So the scroll we hand the
   // builder must never carry a bare "#NNN": write "task NNN" + the clickable hall
   // URL, and strip "#NNN" out of the (free-text) task description too.
-  function deHashRefs(text) {
-    return String(text == null ? '' : text).replace(/#(\d{1,5})\b/g, 'task $1');
-  }
-
-  function buildPromptForTask(t) {
-    const desc = deHashRefs((t.description || '').trim());
-    const hallBase = location.hostname.startsWith('builders.') ? location.origin : `${location.origin}/builders`;
-    const hallUrl = `${hallBase}#/task/${t.id}`;
-    return [
-      `I am working on GDS task ${t.id} (${t.title}) — ${hallUrl}`,
-      `Read the task description, follow its acceptance criteria, stay strictly within touches[], and ship via /builder-ship when done.`,
-      ``,
-      `Task description:`,
-      desc || '(no description)',
-    ].join('\n');
-  }
-
   async function copyPromptForTask(taskId, btn) {
     const t = taskState.all.find((x) => String(x.id) === String(taskId));
     if (!t) return;
@@ -546,25 +503,6 @@
   // /claims/batch/validate) to a builder-readable fragment. Distinct from
   // friendlyActionError above because a batch item's shape differs (reason,
   // not error; extra fields like conflictsWithTaskId/module_key).
-  function friendlyBatchReason(item) {
-    switch (item && item.reason) {
-      case 'TASK_NOT_FOUND': return 'no longer exists';
-      case 'TASK_NOT_READY': return `no longer ready${item.currentStatus ? ` (${item.currentStatus})` : ''}`;
-      case 'ALREADY_CLAIMED': return 'already claimed';
-      case 'TOUCHES_CONFLICT': return `overlaps ${item.conflictTaskTitle || 'an active claim'}`;
-      case 'BATCH_TOUCHES_CONFLICT': return `overlaps task #${item.conflictsWithTaskId} in this selection`;
-      case 'MODULE_CONFLICT': return item.conflictsWithTaskId
-        ? `shares module "${item.module_key}" with task #${item.conflictsWithTaskId} in this selection`
-        : `shares module "${item.module_key}" with an active claim`;
-      case 'DEPS_NOT_SHIPPED': return 'waits on unshipped dependencies';
-      case 'rank_too_low_for_task':
-      case 'XENOS_RESTRICTED':
-      case 'INSUFFICIENT_RANK': return 'rank too low';
-      case 'BUILDER_INACTIVE': return 'account inactive';
-      default: return (item && item.reason) || 'not claimable';
-    }
-  }
-
   async function copyText(text) {
     try { await navigator.clipboard.writeText(text); return true; }
     catch (_) {

package/modules/provisioning/provisioning.js

@@ -235,6 +235,28 @@ function publicInstance(row) {
 // The instance's EFFECTIVE settings: the defaults overlaid with the stored,
 // on-vocabulary keys. An off-vocabulary or unknown stored value falls back to
 // its default rather than leaking into the read surface. PURE.
+// The web.env lines that carry this instance's settings, as the runner writes them
+// at standup (task 1003139). PURE (row + prefix in, string out) and owned HERE, next
+// to SETTINGS_VOCAB, rather than in provision.js — the vocabulary and the thing that
+// transmits it must not be able to drift. Values come from effectiveSettings, so a
+// row with no stored settings emits today's behavior EXPLICITLY rather than nothing:
+// an instance must never have to infer a policy from an absent variable.
+//
+// This is the standup leg only. Changing a setting on an ALREADY-RUNNING instance
+// needs a push (re-write web.env + restart, since the branding pack is memoized for
+// the process lifetime) — that is the 'settings-apply' intent, still to be built.
+function settingsEnvLines(row, prefix) {
+  const s = effectiveSettings(row);
+  return `# Per-project policy the platform decides and this instance obeys (task
+# 1003139). Written at standup from the platform's provisioning_instances.settings;
+# src/branding.js ENV_OVERRIDES maps these onto project.*. Changing one on a RUNNING
+# instance still needs a push (re-write + restart) — not built yet, so today a change
+# takes effect on the next provision run.
+${prefix}_PLATFORM_VISIBILITY=${s.platform_visibility}
+${prefix}_JOINABILITY=${s.joinability}
+`;
+}
+
 function effectiveSettings(row) {
   const stored = row && row.settings && typeof row.settings === 'object' && !Array.isArray(row.settings)
     ? row.settings : {};
@@ -783,6 +805,7 @@ async function costLedger(db, { limit = 500 } = {}) {
 module.exports = {
   // constants
   INSTANCE_STATES, HOSTING_SHAPES, ONBOARD_MODES, PROJECT_TYPES, INTENT_ACTIONS, TEARDOWN_FROM,
+  settingsEnvLines,
   PROVISION_ENQUEUE_FROM, DOMAIN_ATTACH_FROM, TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
   SETTINGS_VOCAB, DEFAULT_SETTINGS,
   // pure

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.261",
+  "version": "1.19.263",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.261",
+      "version": "1.19.263",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.261",
+  "version": "1.19.263",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision.js

@@ -1157,7 +1157,7 @@ function provisionedEnvPrefix() {
 // stays at neutral localhost and the hall never loads (task 1972). No domain yet
 // (bring-your-own deferred, ADR 0111 §4) ⇒ origins stay neutral until one is set.
 function webEnvBody(inst, { clientId = '', clientSecret = '', appId = null, appPem = null, federation = null } = {}) {
-  const prefix = provisionedEnvPrefix();
+  const prefix = provisionedEnvPrefix(), { settingsEnvLines } = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
   const origin = inst.domain ? `https://${inst.domain}` : '';
   const originLines = origin
     ? `# Single-host origins (task 1972): the hall serves on THIS host + OAuth/redirects
@@ -1234,7 +1234,7 @@ ${prefix}_GITHUB_CLIENT_SECRET=${clientSecret || ''}
 ${firstAdminLine}GDS_BRANDING_FILE=${PROVISIONED_BRANDING_FILE}
 ${originLines}${appLines}PORT=${inst.port}
 PGDATABASE=${dbName(inst)}
-${fedLines}`;
+${fedLines}${settingsEnvLines(inst, prefix)}`;
 }
 function webEnvPath(inst, { etcBase = CONFIG.etcBase } = {}) {
   return path.posix.join(etcBase, inst.slug, 'web.env');

package/src/branding.js

@@ -54,6 +54,12 @@ const ENV_OVERRIDES = [
   // front door with one env var and no instance branding.json — cloudbongos.com
   // sets <PREFIX>_POST_LOGIN_LANDING=/gate/ (the orbs). Task 1002240.
   ['POST_LOGIN_LANDING', ['landing', 'postLogin']],
+  // Per-project policy pushed by the provisioning runner (task 1003139). The pack
+  // ships today's behavior, so an instance that never receives a push is unchanged.
+  // Read through branding, which is memoized + deep-frozen for the process lifetime
+  // — which is exactly why applying a change RESTARTS the instance.
+  ['PLATFORM_VISIBILITY', ['project', 'platformVisibility']],
+  ['JOINABILITY', ['project', 'joinability']],
 ];
 
 const isObj = (v) => v && typeof v === 'object' && !Array.isArray(v);

package/src/module-api.js

@@ -949,8 +949,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.259 with no explicit bump. run 32289043893. (task 1002620)
 //   1.19.261 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.260 with no explicit bump. run 32295699354. (task 1002620)
+//   1.19.262 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.261 with no explicit bump. run 32298063660. (task 1002620)
+//   1.19.263 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.262 with no explicit bump. run 32305228786. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.261'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.263'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_criterion_confirm_ui.mjs

@@ -32,6 +32,11 @@ import { makeRunner } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goals-page.js'), 'utf8');
+// task 1002463: goals-page.js now pulls its task-domain helpers from the shared
+// window.OTBTaskLib (task-lib.js) instead of holding its own drifted copies. Run
+// the REAL file in the same context rather than stubbing it — stubbing would let
+// the extraction rot without this, the only test that executes either board.
+const TASK_LIB_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/task-lib.js'), 'utf8');
 
 const { test, summary } = makeRunner();
 
@@ -126,6 +131,7 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
   const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Set, Map, Number, String, Array, Object, JSON, Math, encodeURIComponent, Promise };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
+  vm.runInContext(TASK_LIB_SRC, sandbox, { filename: 'task-lib.js' });
   vm.runInContext(SRC, sandbox, { filename: 'goals-page.js' });
 
   // Let boot()'s promise chain settle (me → goals → details → route → render).

package/tests/provisioning_settings_env.mjs

@@ -0,0 +1,121 @@
+// tests/provisioning_settings_env.mjs
+//
+// The standup leg of the platform->instance settings channel (task 1003139, goal
+// 1000058): a per-project setting the PLATFORM stores must reach the INSTANCE that
+// has to obey it.
+//
+// The gap this closes: PATCH /provisioning/instances/:id/settings wrote
+// platform_visibility / joinability to the platform's jsonb and pushed nothing, and a
+// standalone instance never federates — it holds no hub credential and has no
+// authenticated path back to the platform to pull one. The settings were write-only
+// state. The transport that DOES exist is /etc/<slug>/web.env, read through the
+// branding pack, so the runner now writes them there at standup and src/branding.js
+// resolves them onto project.*.
+//
+// NOT covered here because it is NOT built: pushing a CHANGED setting to an
+// already-running instance (the branding pack is memoized + deep-frozen for the
+// process lifetime, so that needs a re-write + restart — the deferred
+// 'settings-apply' intent). These tests assert the standup leg only, and one of them
+// pins that the generated file does not CLAIM the push exists.
+//
+// DB-free and hermetic: pure builders + a child process with env set. No network.
+//
+// Run:  node tests/provisioning_settings_env.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const linesOf = (s) => s.split('\n').filter((l) => l && !l.startsWith('#'));
+const varsOf = (s) => Object.fromEntries(linesOf(s).map((l) => l.split('=')));
+
+console.log('settingsEnvLines — the platform\'s stored settings, as the instance reads them:');
+
+t('a stored setting is carried verbatim under the pack\'s env prefix', () => {
+  const v = varsOf(provisioning.settingsEnvLines(
+    { settings: { platform_visibility: 'gated', joinability: 'invite_only' } }, 'CLOUDBONGOS'));
+  assert.equal(v.CLOUDBONGOS_PLATFORM_VISIBILITY, 'gated');
+  assert.equal(v.CLOUDBONGOS_JOINABILITY, 'invite_only');
+});
+
+t('a row with NO stored settings emits today\'s behavior EXPLICITLY, never nothing', () => {
+  const v = varsOf(provisioning.settingsEnvLines({}, 'CLOUDBONGOS'));
+  // an instance must never have to infer a policy from an absent variable
+  assert.equal(v.CLOUDBONGOS_PLATFORM_VISIBILITY, 'public');
+  assert.equal(v.CLOUDBONGOS_JOINABILITY, 'apply');
+  assert.equal(linesOf(provisioning.settingsEnvLines({}, 'X')).length, 2, 'both keys always present');
+});
+
+t('an off-vocabulary stored value falls back to the default, never reaches the instance', () => {
+  const v = varsOf(provisioning.settingsEnvLines(
+    { settings: { platform_visibility: 'sort-of-public', joinability: 'whenever' } }, 'CLOUDBONGOS'));
+  assert.equal(v.CLOUDBONGOS_PLATFORM_VISIBILITY, 'public');
+  assert.equal(v.CLOUDBONGOS_JOINABILITY, 'apply');
+});
+
+t('the prefix is the pack\'s, not a guess — a wrong prefix silently never fires', () => {
+  const v = varsOf(provisioning.settingsEnvLines({}, 'MERCURY'));
+  assert.ok('MERCURY_PLATFORM_VISIBILITY' in v);
+  assert.ok(!('CLOUDBONGOS_PLATFORM_VISIBILITY' in v));
+});
+
+t('every emitted key is in SETTINGS_VOCAB — the two lists cannot drift', () => {
+  const keys = linesOf(provisioning.settingsEnvLines({}, 'X')).map((l) => l.split('=')[0].replace(/^X_/, '').toLowerCase());
+  assert.deepEqual(keys.sort(), Object.keys(provisioning.SETTINGS_VOCAB).sort(),
+    'a key added to the vocabulary must be carried, or the instance never learns it');
+});
+
+console.log('\nThe generated file tells the truth about what it is:');
+
+t('it does NOT claim a live push exists — that intent is not built', () => {
+  const s = provisioning.settingsEnvLines({}, 'X');
+  assert.doesNotMatch(s, /settings-apply/,
+    'no comment may name an intent action the runner cannot dispatch');
+  assert.match(s, /next provision run/i, 'it says when a change actually takes effect');
+});
+
+console.log('\nwebEnvBody — the settings ride the real per-instance env file:');
+
+t('the runner writes them into web.env alongside PORT and PGDATABASE', () => {
+  const provision = require('../scripts/gds/provision.js');
+  const body = provision.webEnvBody(
+    { slug: 'spike-harbor', port: 3010, db_name: 'spike-harbor', target_ref: 'jaxri/spike-harbor',
+      hosting_shape: 'standalone', settings: { platform_visibility: 'gated' } }, {});
+  assert.match(body, /_PLATFORM_VISIBILITY=gated/);
+  assert.match(body, /_JOINABILITY=apply/);
+  assert.match(body, /PORT=3010/, 'the rest of the file is untouched');
+});
+
+console.log('\nsrc/branding.js — the value actually reaches code:');
+
+t('the neutral pack ships today\'s behavior, so an un-pushed instance is unchanged', () => {
+  const pack = require('../config/branding.neutral.json');
+  assert.equal(pack.project.platformVisibility, 'public');
+  assert.equal(pack.project.joinability, 'apply');
+});
+
+t('the env override resolves onto project.* in a real process', () => {
+  const read = (env) => JSON.parse(execFileSync(process.execPath, ['-e',
+    "const b=require('./src/branding.js');const r=(b.branding||b)();console.log(JSON.stringify({v:r.project.platformVisibility,j:r.project.joinability}))"],
+    { cwd: ROOT, encoding: 'utf8', env: { ...process.env, ...env } }));
+  assert.deepEqual(read({}), { v: 'public', j: 'apply' }, 'no env → the pack default');
+  assert.deepEqual(
+    read({ CLOUDBONGOS_PLATFORM_VISIBILITY: 'gated', CLOUDBONGOS_JOINABILITY: 'invite_only' }),
+    { v: 'gated', j: 'invite_only' },
+    'the web.env the runner writes is what the instance reads');
+});
+
+console.log(`\nprovisioning_settings_env: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);