@bongos/core 1.19.368 → 1.19.370

package/modules/dev-box/routes/box.js

@@ -55,6 +55,17 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..', '..');
 const PUBLIC_ORIGIN = process.env.GDS_PUBLIC_ORIGIN
   || (() => { try { return api.branding().domains.publicOrigin; } catch { return 'http://localhost:3000'; } })();
 
+// Task-scoping PAUSE (task 1003285 / ADR 0193 — owner decision, 2026-08-25).
+// While paused, the claim-derived slice is never resolved: scopeKeys stays
+// undefined and decideSourceAccess takes its documented rank fallback — full
+// repo for Metic+, the starter surface below. Rank floor, ADR 0016 live-rank
+// checks, and the ADR 0055 read-only credential are all unchanged; only the
+// module BREADTH stops narrowing. Paused by default; set BOX_TASK_SCOPE=on
+// to re-enable the ADR 0148 claim-driven slice.
+function taskScopingPaused() {
+  return String(process.env.BOX_TASK_SCOPE || '').trim().toLowerCase() !== 'on';
+}
+
 // The instance's world name + dev-box apex + SSH zone come from the branding pack
 // (ADR 0062 §3), never a hardcoded host brand — a non-OTB instance uses its own
 // configured identity/domains. Passed into the PURE box-onboard renderers.
@@ -444,10 +455,12 @@ module.exports = function buildBoxRouter() {
       //   - undefined     → decideSourceAccess falls back to the RANK scope (the
       //                     pre-ADR-0148 behavior, so a port-less instance is unchanged).
       // NEVER fail the source fetch on a scope-read hiccup — degrade to rank scope.
+      // While task-scoping is paused (taskScopingPaused above), skip the claim
+      // resolution entirely: undefined scopeKeys IS the rank-fallback signal.
       const lifecycle = api.resolveOptional('lifecycle');
       let scopeKeys;
       let hasActiveClaims;
-      if (lifecycle && typeof lifecycle.moduleScopeForActiveClaims === 'function') {
+      if (!taskScopingPaused() && lifecycle && typeof lifecycle.moduleScopeForActiveClaims === 'function') {
         try {
           scopeKeys = await lifecycle.moduleScopeForActiveClaims(req.builder.id);
         } catch (scopeErr) {
@@ -560,11 +573,13 @@ module.exports = function buildBoxRouter() {
       const status = builder ? builder.status : 'inactive';
 
       // Resolve the claim-driven module scope exactly as source-access does
-      // (optional lifecycle port; degrade to rank scope on any hiccup).
+      // (optional lifecycle port; degrade to rank scope on any hiccup; skipped
+      // entirely while task-scoping is paused, so this read-only companion can
+      // never report a slice the real fetch would no longer grant).
       const lifecycle = api.resolveOptional('lifecycle');
       let scopeKeys;
       let hasActiveClaims;
-      if (lifecycle && typeof lifecycle.moduleScopeForActiveClaims === 'function') {
+      if (!taskScopingPaused() && lifecycle && typeof lifecycle.moduleScopeForActiveClaims === 'function') {
         try {
           scopeKeys = await lifecycle.moduleScopeForActiveClaims(req.builder.id);
         } catch (scopeErr) {
@@ -593,8 +608,9 @@ module.exports = function buildBoxRouter() {
       }
       const meta = boxAccess.scopeMetadata({ decision, scopeKeys });
       // task_scope true only when a claim actually drove the breadth (scopeKeys is
-      // an array). false → the rank fallback (no active claim / no lifecycle port).
-      return res.json({ ...meta, task_scope: Array.isArray(scopeKeys) });
+      // an array). false → the rank fallback (no active claim / no lifecycle port /
+      // task-scoping paused — the paused flag says which, so the app can explain).
+      return res.json({ ...meta, task_scope: Array.isArray(scopeKeys), task_scoping_paused: taskScopingPaused() });
     } catch (err) {
       log.error('[gds] GET /box/scope', err);
       res.fail('box_scope_failed', { status: 500, message: 'internal error' });
@@ -1088,3 +1104,4 @@ module.exports = function buildBoxRouter() {
 // (tests/box_terminal_ssrf.mjs) without a server, DB, or network.
 module.exports.isSafeTerminalUrl = isSafeTerminalUrl;
 module.exports.isTunnelReadyStatus = isTunnelReadyStatus;
+module.exports.taskScopingPaused = taskScopingPaused;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.368",
+  "version": "1.19.370",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.368",
+      "version": "1.19.370",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.368",
+  "version": "1.19.370",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -56,6 +56,11 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
 .backRow{margin:14px 0;font-weight:700;}
 #view-manage .empty{text-align:left;}
 #view-manage .empty p{margin-bottom:0;}
+#view-manage .visOpt{display:flex;gap:10px;align-items:flex-start;padding:10px 12px;border:1px solid var(--rule);border-radius:10px;margin-bottom:8px;cursor:pointer;}
+#view-manage .visOpt:has(input:checked){border-color:var(--accent);}
+#view-manage .visOpt input{margin-top:4px;flex:none;}
+#view-manage .visOpt b{display:block;font-size:15px;}
+#view-manage .visOpt span{display:block;font-size:13px;color:var(--ink-soft);line-height:1.45;}
 
 /* The bongo pair on the New-project view. Component-scoped custom properties,
    never :root (C1). The drum head is SKIN — using --bg-card would turn it black
@@ -657,13 +662,24 @@ summary{min-height:24px;padding:3px 0;}
         </details>
       </div>
 
-      <!-- the two settings the sibling tasks (1003043 / 1003044) fill in — placed
-           BELOW the sections that work, so a founder meets controls before promises -->
+      <!-- live since task 1003043: the platform-visibility toggle. The choice
+           shown is the platform's REQUEST (its settings row); what the project
+           actually RUNS is read back from the project's own public manifest
+           (brand.project) — never from the save's reply, which is a receipt:
+           a change reaches a live project only by the restart the runner
+           performs (ADR 0190). The fold is a SIBLING of the volatile slot (the
+           #mRepoVisWhy shape) so no re-render can drop it. -->
       <div class="card" id="mVisibility">
         <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Who can see it</h2>
-        <div class="empty"><p>Choosing who can open this project’s pages — everyone, or only people signed in to it — isn’t wired up here yet. For now, every project’s pages are open to everyone.</p></div>
+        <div id="mVis"><p class="finePrint">Reading the project’s settings…</p></div>
+        <details class="finePrint" id="mVisWhat">
+          <summary>What “only signed-in members” changes</summary>
+          <p>Visitors who aren’t signed in meet a sign-in door instead of the project’s pages — its front page, its status page, and its hall. The door itself stays open, so members can always get in, and members see everything either way. It is separate from the repository’s visibility above: the code on GitHub is its own setting. Changing it restarts the project to pick it up — the line under the choice says what the project is running right now.</p>
+        </details>
       </div>
 
+      <!-- the setting the sibling task (1003044) fills in — placed BELOW the
+           sections that work, so a founder meets controls before promises -->
       <div class="card" id="mJoinability">
         <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">How people join</h2>
         <div class="empty"><p>Choosing how new people join — walk right in, apply first, or invite only — isn’t wired up here yet. For now, people apply to join and you invite them.</p></div>
@@ -4360,6 +4376,9 @@ summary{min-height:24px;padding:3px 0;}
        it: the delete section reads only status + open_intent, both already in
        hand, and a queued teardown must show up without a reload */
     renderDelete(inst);
+    /* same contract: the visibility section's in-flight line reads open_intent
+       only, so a queued settings push shows up on the tick without a reload */
+    renderVisState(inst);
     /* the page names its project — in the heading and in the tab */
     $('mTitle').textContent = inst.slug || 'Manage';
     document.title = (inst.slug ? inst.slug + ' — ' : '') + BASE_TITLE;
@@ -4462,6 +4481,9 @@ summary{min-height:24px;padding:3px 0;}
         /* the SECOND, GitHub-backed read — fired only here (entry + tab
            return), never from renderManage, which the fetch-free tick calls */
         if (!keepRepo) loadRepoVisibility(inst);
+        /* the settings row + the project's own manifest — the same cadence as
+           the GitHub read: entry + tab return, never the in-flight tick */
+        if (!keepRepo) loadVisibility(inst);
       })
       .catch(function (err) {
         var m = String(err && err.message);
@@ -4607,6 +4629,182 @@ summary{min-height:24px;padding:3px 0;}
     if (t.hasAttribute('data-repo-public-no')) { if (manageRepo) renderRepoVis(manageRepo); }
   });
 
+  /* ── who can see it (task 1003043): the platform-visibility toggle. Two
+     reads, kept apart on purpose: the CHOICE comes from the platform's own
+     settings row (what the owner asked for), and the line under it reads what
+     the project's server actually RUNS from its public manifest (brand.project,
+     ADR 0190 §9). The save's reply is a receipt — its push.message is shown
+     verbatim, and its `saved` is never painted as the live state, because a
+     change reaches a running project only by the restart the runner performs.
+     What the project runs is only ever what its own manifest answered. ── */
+
+  var VIS_OPTIONS = {
+    public: { label: 'Everyone', blurb: 'Anyone can open this project’s pages. Signing in is only needed to take part.' },
+    gated: { label: 'Only signed-in members', blurb: 'Visitors meet a sign-in door first. The project’s pages open only to people signed in to it.' }
+  };
+  var mVisSettings = null;  /* the platform row's last answer: { value, options } */
+  var mVisRunsHtml = '';    /* what the project's manifest last said it runs */
+  var mVisPushSeen = false; /* a settings push was open — re-read the manifest once it settles */
+
+  function visMsg(html) { $('mVis').innerHTML = html; }
+
+  function renderVis() {
+    var s = mVisSettings;
+    if (!s) return;
+    var opts = (s.options || []).filter(function (v) { return !!VIS_OPTIONS[v]; });
+    visMsg('<div role="radiogroup" aria-label="Who can see it">' + opts.map(function (v) {
+      var o = VIS_OPTIONS[v];
+      return '<label class="visOpt"><input type="radio" name="mVisPick" value="' + esc(v) + '"' +
+        (v === s.value ? ' checked' : '') + '><span><b>' + esc(o.label) + '</b>' + esc(o.blurb) + '</span></label>';
+    }).join('') + '</div>' +
+      '<div class="actions"><button type="button" class="btn small" data-vis-save>Save</button></div>' +
+      '<div class="projMsg" id="mVisMsg" role="status" aria-live="polite"></div>' +
+      '<p class="finePrint" id="mVisRuns">' + mVisRunsHtml + '</p>');
+    renderVisState(manageInst);
+  }
+
+  function visRuns(html) {
+    mVisRunsHtml = html;
+    var el = $('mVisRuns');
+    if (el) el.innerHTML = html;
+  }
+
+  /* fetch-free, from open_intent only (renderManage calls it on every repaint):
+     while a push is open the line says so; the moment it settles, the manifest
+     is asked again — the only source that can say the value took */
+  function visPushOpen(inst) {
+    return !!(inst && inst.open_intent && inst.open_intent.action === 'settings-apply');
+  }
+
+  function renderVisState(inst) {
+    if (!inst || !$('mVisRuns')) return;
+    if (visPushOpen(inst)) {
+      mVisPushSeen = true;
+      visRuns(inst.open_intent.state === 'running'
+        ? 'Restarting the project to apply a settings change…'
+        : 'A settings change is queued — the project restarts to pick it up. Until then it keeps its current setting.');
+      return;
+    }
+    if (mVisPushSeen) { mVisPushSeen = false; loadVisRuns(inst); }
+  }
+
+  /* what the project RUNS: its own public manifest, read cross-origin (the
+     same GET /instance the platform's runner reads after a restart) */
+  function loadVisRuns(inst) {
+    if (!inst || inst.status !== 'active' || !inst.domain) { visRuns(''); return; }
+    var asked = manageId;
+    visRuns('Checking what the project is running…');
+    var ctl = typeof AbortController === 'function' ? new AbortController() : null;
+    var timer = ctl ? setTimeout(function () { ctl.abort(); }, 8000) : null;
+    fetch('https://' + inst.domain + '/api/gds/instance', { mode: 'cors', signal: ctl ? ctl.signal : undefined })
+      .then(function (res) {
+        /* a project that ANSWERED but refused (its own pre-launch gate, a proxy
+           error page) is not an older core — say what happened, not a guess */
+        if (!res.ok) throw new Error('http:' + res.status);
+        return res.json();
+      })
+      .then(function (m) {
+        if (asked !== manageId) return;
+        var p = m && m.brand && m.brand.project;
+        var v = p && p.platformVisibility;
+        if (!p || typeof p !== 'object') {
+          visRuns('This project’s server doesn’t report this setting yet — it runs an older platform version, so the setting can’t take effect until the project is updated.');
+          return;
+        }
+        var o = VIS_OPTIONS[v];
+        if (!o) { visRuns('This project’s server reports a setting this page doesn’t recognise (' + esc(String(v)) + ').'); return; }
+        var want = mVisSettings && mVisSettings.value;
+        visRuns('Right now the project runs as <b>' + esc(o.label) + '</b>' +
+          (want && want !== v && VIS_OPTIONS[want] ? ' — the saved choice (' + esc(VIS_OPTIONS[want].label) + ') hasn’t taken effect there yet.' : '.'));
+      })
+      .catch(function (err) {
+        if (asked !== manageId) return;
+        var http = /^http:(\d+)$/.exec(String(err && err.message));
+        visRuns(http
+          ? 'The project answered but didn’t share what it’s running (it replied ' + esc(http[1]) + ').'
+          : 'Couldn’t reach the project to check what it’s running right now.');
+      })
+      .then(function () { if (timer) clearTimeout(timer); });
+  }
+
+  function loadVisibility(inst) {
+    mVisSettings = null; mVisRunsHtml = ''; mVisPushSeen = false;
+    visMsg('<p class="finePrint">Reading the project’s settings…</p>');
+    var asked = manageId; /* a stale answer must never describe a newer project */
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
+      .then(function (res) {
+        if (asked !== manageId) throw new Error('stale');
+        return jsonOrEmpty(res).then(function (data) {
+          if (res.ok) {
+            mVisSettings = {
+              value: (data.settings || {}).platform_visibility,
+              options: (data.options || {}).platform_visibility || Object.keys(VIS_OPTIONS)
+            };
+            renderVis();
+            /* while a push is open the line is the intent's — the manifest is
+               asked the moment it settles (renderVisState), not now */
+            if (!visPushOpen(inst)) loadVisRuns(inst);
+            return;
+          }
+          visMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
+        });
+      })
+      .catch(function (err) {
+        if (String(err && err.message) === 'stale') return;
+        visMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
+      });
+  }
+
+  /* the save sends the CHOICE and shows the platform's receipt verbatim: the
+     same value re-sent is the server's call (no change, or the re-kick of a
+     push that failed) — this page never decides that for it */
+  function doVisSave() {
+    if (!manageInst || !mVisSettings) return;
+    var picked = document.querySelector('#mVis input[name="mVisPick"]:checked');
+    if (!picked) return;
+    var value = picked.value;
+    var box = $('mVisMsg');
+    var btn = document.querySelector('#mVis [data-vis-save]');
+    if (btn) btn.disabled = true;
+    box.className = 'projMsg'; box.textContent = 'Saving…';
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', {
+      method: 'PATCH', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ platform_visibility: value })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          /* the row now holds the choice — the radio follows it; the "runs"
+             line does NOT, until the project's own manifest says so */
+          mVisSettings.value = (data.saved || {}).platform_visibility || value;
+          /* a queued push may open AND settle before the re-read below lands —
+             arm the re-read here so a fast runner cannot leave a stale line */
+          if (data.push && data.push.queued) mVisPushSeen = true;
+          box.className = 'projMsg ok';
+          box.textContent = (data.push && data.push.message) || 'Saved.';
+          return;
+        }
+        var e = apiError(data, res.status);
+        if (res.status === 401) { box.className = 'projMsg err'; box.innerHTML = signInAgain(); return; }
+        /* 409 intent_conflict: the change IS saved (recorded) — the server's
+           sentence says so and names the run holding the slot; show it as is */
+        box.className = e.code === 'intent_conflict' ? 'projMsg' : 'projMsg err';
+        box.textContent = e.message || 'The change could not be saved — try again in a moment.';
+      });
+    }).catch(function () {
+      box.className = 'projMsg err';
+      box.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+    }).then(function () {
+      if (btn) btn.disabled = false;
+      /* the strip + this section's in-flight line read open_intent — re-read it */
+      loadManage(true, true);
+    });
+  }
+
+  $('mVis').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (t && t.hasAttribute('data-vis-save')) doVisSave();
+  });
+
   /* ── delete the project (task 1003042): the manage page's teardown control.
      It renders from status + open_intent only — no second request — so the
      minute tick can repaint it and a queued teardown appears without a reload.

package/src/bongos/auth.js

@@ -87,12 +87,24 @@ function extractTokens(req) {
 
 // Resolve the request to a live session by trying every candidate token until
 // one maps to a non-revoked, unexpired session. Returns null if none do.
+// Resolved ONCE per request (task 1003043): the platform-visibility gate asks
+// ahead of every surface, and the page/API gates ask again behind it — each
+// lookup is a SELECT plus a last-seen UPDATE, so a member's page load with its
+// assets must not pay that twice per request. Keyed weakly on the req object;
+// a rejected lookup is shared too, so every gate on the request fails closed
+// the same way.
+const RESOLVED_SESSIONS = new WeakMap();
 async function resolveSession(req) {
-  for (const token of extractTokens(req)) {
-    const session = await lookupSession(token);
-    if (session) return session;
-  }
-  return null;
+  if (RESOLVED_SESSIONS.has(req)) return RESOLVED_SESSIONS.get(req);
+  const resolved = (async () => {
+    for (const token of extractTokens(req)) {
+      const session = await lookupSession(token);
+      if (session) return session;
+    }
+    return null;
+  })();
+  RESOLVED_SESSIONS.set(req, resolved);
+  return resolved;
 }
 
 // ── SESSION-SCOPES — capability attached to the TOKEN (BV1.R99, ADR 0151 §3) ──

package/src/bongos/platform-visibility-gate.js

@@ -0,0 +1,251 @@
+// src/bongos/platform-visibility-gate.js — the project's member door (task 1003043).
+//
+// A project's owner chooses on the hub who can see it: everyone (today's
+// behaviour, the default) or only people signed in to it. That choice reaches
+// the instance as `project.platformVisibility` in its branding pack — pushed
+// into web.env by the provisioning runner and read once per process (ADR 0190).
+// This gate is where the instance ENFORCES it: when the value is 'gated', a
+// visitor with no live session is refused on every surface a stranger could
+// otherwise read — the landing page, the hub pages, the status dashboard, the
+// hall shell, and the public read API — and shown a door that says so, with the
+// sign-in behind it one click away. A member (any live, non-deactivated session
+// on this instance) passes and sees everything they would have seen anyway.
+//
+//   - Enforcement is per REQUEST and server-side: nothing here relies on the
+//     client hiding anything, and a curl with no cookie gets the same answer a
+//     browser does.
+//   - It grants nothing. Everything behind it still runs its own rank checks
+//     against the database (ADR 0016); the gate only decides whether a stranger
+//     may SEE the instance at all, and "stranger" is decided by the same
+//     session lookup requireBuilder uses — never cached, never a second store.
+//   - The setting is owned by the PLATFORM row and pushed; the instance reads
+//     it through branding(), memoized for the process lifetime, which is why a
+//     change is applied by a restart and why nothing here re-reads a file.
+//   - What a member is shown must not be cached for a stranger: a passed
+//     response leaves marked private, whatever the route behind it said.
+//
+// It is NOT the pre-launch gate (stealth-gate.js): that one is a shared
+// password for an unannounced instance, inert unless STEALTH_PASSWORD is set,
+// and it mounts first. This one is a per-project policy with accounts behind it.
+// Both can be on at once; each refuses on its own terms.
+
+'use strict';
+
+const { branding } = require('../branding');
+const { resolveSession } = require('./auth');
+const { ALL_API_PREFIXES } = require('./api-prefix');
+
+const log = require('./logger').logger.child({ src: 'platform-visibility-gate' });
+
+const GATED = 'gated';
+
+// Every API prefix this instance answers on — versioned, current and legacy
+// (ADR 0117): a CLI pinned to /api/bongos/v1 must find the door where the
+// unversioned one is.
+const escRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const API = `(?:${ALL_API_PREFIXES.map(escRe).join('|')})`;
+
+// Paths that must answer even to a stranger while the project is gated, each for
+// its own reason:
+//   <api>/auth/*         the door itself — the web sign-in round trip, the CLI
+//                        device flow, sign-out. A gated door that cannot be
+//                        opened locks the members out too.
+//   <api>/instance       the public manifest (routes/instance.js). A stranger
+//                        reads it to learn HOW to sign in; the platform's runner
+//                        reads it after a settings restart to learn whether the
+//                        value was consumed (provision-units.js settingsConsumed)
+//                        — including the very push that turns this gate on. It
+//                        carries the policy itself, public by nature (ADR 0190 §9).
+//   <api>/healthz, /healthz, /version, /metrics
+//                        the probes: the deploy's, the runner's, the uptime
+//                        poller's, the control plane's liveness sweep; Prometheus
+//                        is access-gated on its own terms.
+//   <api>/provisioning/tls-check, …/health
+//                        Caddy's on-demand-TLS `ask` and the provisioning probe —
+//                        server-to-server, cookie-less, and on a control plane a
+//                        refused ask means no project ever gets a certificate.
+//   /downloads/*         the installer script and the Dev Box updater — a
+//                        cookie-less `curl … | sh`, and release redirects carry
+//                        no project data.
+//   /__stealth           the pre-launch gate's own submit, when both gates are on.
+const EXEMPT = [
+  new RegExp(`^${API}/auth(/|$)`),
+  new RegExp(`^${API}/instance$`),
+  new RegExp(`^${API}/healthz$`),
+  new RegExp(`^${API}/provisioning/(tls-check|health)$`),
+  /^\/healthz$/,
+  /^\/version$/,
+  /^\/metrics$/,
+  /^\/__stealth$/,
+  /^\/downloads\//,
+];
+
+// The policy, read through the memoized pack. A pack that cannot be read at all
+// FAILS CLOSED — the one place a broken read must not quietly un-gate a
+// members-only project (every other branding consumer on the instance is broken
+// by then too, so nothing is lost by refusing). `read` is injectable for tests.
+function mode(read = branding) {
+  try { return read().project?.platformVisibility || 'public'; } catch (err) {
+    log.error({ err: err && err.message }, 'branding pack unreadable — treating the project as gated');
+    return GATED;
+  }
+}
+
+function isGated() { return mode() === GATED; }
+
+// Express routes case-insensitively and tolerates one trailing slash, so the
+// exempt test must see the path the way the router will — otherwise a probe
+// spelled `/HEALTHZ` or `/api/gds/instance/` is refused while the router would
+// have served it. Mismatches still fail CLOSED; this only keeps the list honest.
+function normalizePath(p) {
+  let s = String(p || '').toLowerCase();
+  if (s.length > 1 && s.endsWith('/')) s = s.slice(0, -1);
+  return s;
+}
+
+function isExempt(path) {
+  const p = normalizePath(path);
+  return EXEMPT.some((re) => re.test(p));
+}
+
+function isApiPath(path) { return /^\/api\//i.test(String(path || '')); }
+
+function productName() {
+  try { return branding().identity?.productName || 'This project'; } catch { return 'This project'; }
+}
+
+// The sign-in start with a `?return=` back to the page that was refused. The
+// return is RELATIVE (the pre-launch gate's relativeReturn shape): auth.js's
+// safeReturnTo accepts a relative path unconditionally, while an absolute one is
+// only honoured over https on the cookie apex — so a member on a co-located
+// subdomain, a dev port, or plain http would otherwise be dropped at the default
+// page. Only a GET/HEAD path is safe to come back to; anything else returns to '/'.
+function signInHref(req) {
+  const base = '/api/gds/auth/web/start';
+  const back = (req.method === 'GET' || req.method === 'HEAD') ? relativeReturn(req.originalUrl) : null;
+  return back ? `${base}?return=${encodeURIComponent(back)}` : base;
+}
+
+// One leading slash, no '//' (protocol-relative), no backslash, no control
+// bytes — the stealth gate's rule; anything else returns to '/'.
+function relativeReturn(raw) {
+  if (typeof raw !== 'string' || !raw.length || raw.length > 512) return null;
+  if (!raw.startsWith('/') || raw.startsWith('//') || raw.includes('\\')) return null;
+  if (/[\x00-\x1f\x7f]/.test(raw)) return null;
+  return raw === '/' ? null : raw;
+}
+
+function escAttr(s) {
+  return String(s).replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
+// The door. Self-contained on purpose (the pre-launch gate's shape): it is
+// served to someone who may not see the project, so it pulls no stylesheet, no
+// branding bundle, no script — nothing that would show the design to whoever
+// knocks. It names the project and says who it is for, and the one control on
+// it is the way in.
+function doorHtml({ productName: name, signIn }) {
+  const safe = String(name || 'This project').replace(/[<>&"]/g, '');
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="robots" content="noindex,nofollow">
+<title>${safe}</title><style>
+:root{color-scheme:light dark}
+*{box-sizing:border-box}
+body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;
+  font:500 15px/1.5 ui-rounded,"Quicksand",system-ui,-apple-system,"Segoe UI",sans-serif;
+  background:#f9d9a8;color:#2b170e}
+@media(prefers-color-scheme:dark){body{background:#150c06;color:#f4e6cd}}
+.box{width:min(380px,100%);text-align:center}
+.dots{display:flex;gap:10px;justify-content:center;margin-bottom:22px}
+.dots i{display:block;border-radius:50%;background:#ce4806}
+.dots i:first-child{width:38px;height:38px}
+.dots i:last-child{width:28px;height:28px;background:#855b3d;align-self:flex-end}
+h1{font-size:20px;font-weight:700;margin:0 0 6px}
+p{margin:0 0 20px;opacity:.72;font-size:14px}
+a.btn{display:inline-block;padding:11px 22px;border-radius:999px;background:#ce4806;color:#fff;
+  font:700 14px/1 inherit;text-decoration:none}
+a.btn:focus{outline:2px solid #ce4806;outline-offset:2px}
+</style></head><body><div class="box">
+<div class="dots"><i></i><i></i></div>
+<h1>${safe}</h1>
+<p>This project’s pages are open to its members. Sign in to continue.</p>
+<a class="btn" href="${escAttr(signIn)}">Sign in</a>
+</div></body></html>`;
+}
+
+function refuse(req, res, code) {
+  res.set('Cache-Control', 'no-store');
+  res.set('Vary', 'Cookie');
+  if (isApiPath(req.path)) {
+    // The API convention for a caller with no identity (requireBuilder) — the
+    // same envelope, so a client's existing 401 handling reads it correctly.
+    // res.fail is attachFail's, mounted just before this gate.
+    return res.fail(code, code === 'builder_inactive' ? 403 : 401);
+  }
+  // 401 rather than 200 or 302: an unauthenticated request being refused, and
+  // said so — a crawler that ignores the noindex is still told. The door itself
+  // carries the way in; a redirect straight into the OAuth round trip would send
+  // every stray asset request and crawler to GitHub.
+  return res.status(401).type('html').send(doorHtml({ productName: productName(), signIn: signInHref(req) }));
+}
+
+// A member's answer must never be served to a stranger by a SHARED cache: the
+// public read API and the hall assets send `Cache-Control: public, max-age=…`,
+// which a CDN edge honours for everyone regardless of Vary. The member's own
+// browser cache is a different matter — a hall page is thirty assets, and each
+// re-fetch is a session lookup — so the route's freshness is KEPT and only the
+// scope changes: `public` → `private`, `s-maxage` dropped, `max-age` untouched;
+// a response that named no policy gets `private, no-cache` (revalidate, never
+// share); `no-store` stays `no-store`. PURE on the header value.
+function privateCacheControl(value) {
+  const parts = String(value || '').split(',').map((s) => s.trim()).filter(Boolean);
+  if (parts.some((p) => /^no-store$/i.test(p))) return parts.join(', ');
+  const kept = parts.filter((p) => !/^(public|private|s-maxage=.*)$/i.test(p));
+  if (!kept.length) return 'private, no-cache';
+  return ['private', ...kept].join(', ');
+}
+
+// Patch writeHead so whatever the route set, the response leaves private —
+// implicit heads (res.end, streams) go through writeHead too.
+function markPrivate(res) {
+  const writeHead = res.writeHead;
+  res.writeHead = function privateWriteHead(...args) {
+    if (!this.headersSent) {
+      this.setHeader('Cache-Control', privateCacheControl(this.getHeader('Cache-Control')));
+      const vary = String(this.getHeader('Vary') || '');
+      if (!/(^|,)\s*cookie\s*(,|$)/i.test(vary)) this.setHeader('Vary', vary ? `${vary}, Cookie` : 'Cookie');
+    }
+    return writeHead.apply(this, args);
+  };
+}
+
+// Mounted ahead of every human and public-read surface (serve-internal.js), after
+// the pre-launch gate and attachFail. `deps` exists for tests only — production
+// reads the real branding pack and the real session lookup.
+function platformVisibilityGate(deps = {}) {
+  const gated = deps.isGated || isGated;
+  const lookup = deps.resolveSession || resolveSession;
+  return function platformVisibility(req, res, next) {
+    if (!gated()) return next();
+    if (req.method === 'OPTIONS') return next();     // a CORS preflight carries no identity
+    if (isExempt(req.path)) return next();
+    // Async middleware must own its rejection (Express 4 drops the promise) —
+    // and it FAILS CLOSED: if the session cannot be resolved, the caller's
+    // identity is unknown, and admitting is never an option (auth.js's rule).
+    lookup(req).then((session) => {
+      if (!session) return refuse(req, res, 'unauthenticated');
+      // A deactivated builder keeps no door (the task 871 hot-path rule): deny
+      // only on the known 'inactive' status, never on a missing value.
+      if (session.status === 'inactive') return refuse(req, res, 'builder_inactive');
+      markPrivate(res);
+      return next();
+    }).catch((err) => {
+      // message only — a lookup error can carry query text
+      log.error({ err: err && err.message }, 'session lookup failed — refusing (fail closed)');
+      refuse(req, res, 'unauthenticated');
+    });
+  };
+}
+
+module.exports = { platformVisibilityGate, isGated, isExempt, mode, signInHref, privateCacheControl };

package/src/bongos/serve-internal.js

@@ -47,6 +47,7 @@ const { buildDevboxDownloads } = require('../devbox-downloads');
 const { buildBongosDownloads } = require('../bongos-downloads');
 const { clientBranding, branding } = require('../branding');
 const { stealthGate } = require('./stealth-gate');
+const { platformVisibilityGate } = require('./platform-visibility-gate');
 const { clientModules, isModuleEnabled } = require('../modules');
 const { hallWidgetScripts, moduleWebSurfaces } = require('../module-loader/loader');
 const { resolveCoreRoot, resolveDocsRoot, resolveInstanceRoot } = require('../instance-config');
@@ -486,6 +487,15 @@ function mountInternalSurfaces(app) {
   // with the router's copy (it just re-installs the same method).
   app.use(attachFail);
 
+  // THE MEMBER DOOR (task 1003043): when the project's platform visibility is
+  // 'gated', a visitor with no live session is refused on every surface below —
+  // the landing, the hub pages, the status dashboard, the hall shell, the public
+  // read API — and shown a sign-in door; members pass. It mounts AFTER attachFail
+  // so an API refusal wears the same envelope requireBuilder's does, and after
+  // the metrics middleware so a refused knock is still counted. Inert while the
+  // setting is 'public' (the default): one branding read per request.
+  app.use(platformVisibilityGate());
+
   app.get('/healthz', (_req, res) => {
     res.type('text/plain').send('ok');
   });