@bongos/core 1.19.402 → 1.19.404

package/docs/design/landing-page-direction-v2.md

@@ -56,6 +56,8 @@ The world round's light landing rehoused the chrome in a black specimen panel an
 
 What the pick settles: the settled constraint (dark-first with a real, tested light mode) stands for the landing; the light cutouts (`r2-chrome-blobs-set-cut.png`, `r2-chrome-blob-one-cut.png`, `r2-bongos-chrome-a-cut.png`) are production material for the light mode, so the build's asset set is the three black plates plus the three cutouts. v1 and v2 stay on disk as built and verified; what they leave behind for the build: v1's pointer parallax as an optional second layer of the drift, v2's beat rail down the margin of the live ledger (the reviewer's strongest below-the-fold block of the round) as the ledger proof's alternative form, and v2's mode-invariant black stage as the pattern for any surface that must keep black in light.
 
+**2026-08-28: the owner's review of the shipped hero (task 1003333).** Three corrections to the pick, each overriding this record and `DESIGN.md` where they conflicted: the doors sit in the blob's lower half (stage 73% dark / 75% light, from 53 / 60), not at its centre; the three leader-line figures leave the landing (they read as "random lines" there; the poster card on `/projects` keeps the grammar, task 1003301); and the small bead's orbit is replaced by the big plates themselves drifting like a lava lamp (v1's "drift" of §3, built: `drift-form` 74s, `drift-orb` 58s, transform only, dead under reduced motion; the pointer parallax stays out, no motion in JavaScript). The bead left the hero and survives as the third project orb below the fold. The two feeds that fed only the figures (`/public/cost-summary`, `/public/leaderboard`) leave the page with them.
+
 ## 7. Shot list: real imagery still owed
 
 No version left a placeholder slot: every image on the three pages is a real plate (the round-2 chrome set, the single blob, the two bongo pairs, the two new blob cutouts) or the real Verro Labs medallion, and the proof is the ledger rendered as page content, so no hall or hub capture is used. What the build will still owe:

package/docs/design/projects-hub-direction-v2.md

@@ -144,3 +144,19 @@ Three mastheads, rendered dark and light at 1440 / 390 / 320 (ALL CLEAN) and mea
 - Task 1003301 (the poster card): the ledger grammar above is the card's facts strip, too.
 - Task 1003319 (the planets): the masthead object rides the same crop maths the orbs will take.
 - The mine view and the wizard are the next views to take a masthead in the picked treatment.
+
+## 10. The poster card is built (task 1003301)
+
+**Date:** 2026-08-28 · the v2 card (§7) built into `public-landing/projects.html` + `cosmos.css`, rendered through the kit before and after (`node modules/ui-design/kit/render.js --page /projects`, both modes, 1440 / 390 / 320) — ALL CLEAN; the probes green including seven new card probes.
+
+**What was built, region by region (every one a direct child of the card, the C6 slice rule):** the 5:2 banner as a bare `<img>` (`object-fit: cover`, top corners on the card's radius; a broken image demotes to the no-art layout through one error listener); the two figures as leader-line callouts ON the art from 561px (one feathered patch of the card ground per callout — a mask, not a shadow — set 44px in from the card's edges so the feather is never clipped flat on the paper card) and as the two-up band under 561 or with no art; the accent disc surviving, half over the banner's lower edge, ringed 4px in the card ground; the name at 32px/300, the tagline, the relationship as a mono `--label-face` label (no accent: a fact, not a control); up to five 28px faces at −8px overlap ringed in the card ground, `+N` counted against `builders`; the facts as the 1003332 ledger (mono label left, tabular value right, one `rule-soft` hairline per row); one accent door (`open site →`, 48px, lowercase) and the hall entry beside it as an underlined `accent-deep` text link with the hall glyph. `.projCard` is `min(560px, 100%)`, one `rule` hairline, no shadow, `container-type: inline-size` so the disc and the callouts measure the card.
+
+**The degradation ladder, as shipped:** no art → no banner, the disc where it always was; no faces → the row absent; one figure null → the other stands alone; both null → the band hidden; a fact with no answer hides label and value together; everything null → disc, name, tagline, **the address**, listed, one door. The address is the one difference from the ladder as written in task 1003258: `Runs` on the poster is the project's address (§7), which the catalog always knows, so the floor card carries a Runs row the tags-based card did not. The table keeps the module list in its Runs column.
+
+**The feed (§6 closed):** `modules/platform-identity/project-stats.js` reads four feeds per origin inside the one `Promise.allSettled` — the leaderboard now also yields `faces`; `/public/recent-shipped?days=30` yields `shipped_30d` + `shipped_30d_capped` (200 rows with `?days` honoured, 30 on an older core: the "N+" rule); and the project's API discovery index (`GET /api/bongos`, ADR 0114) yields `hall_origin`. **A decision made on the way:** task 1003301 said the hall address would be "resolved from the project's provisioning record" — no such column exists (provisioning writes `BUILDERS_ORIGIN = PUBLIC_ORIGIN` into the instance's own `web.env` and never round-trips it), and the record could only ever say "same host". The discovery index is the project answering for itself, on the same basis as builders and tags, and it is null where the hall is the site's own host (the address gate) or where the project does not say. One frozen `NULL_STATS` carries every key. The platform's own card answers by the same rule client-side (its leaderboard for faces, its own `recent-shipped?days=30` for the figure), and its hall comes from the DOM: the server-stamped `#selfHall` anchor in its table row, dropped whole by the stamp when a pack names no hall.
+
+**The hall entry, three surfaces → two:** the card's door and the table row's glyph (riding the existing door cell, so the six-cell parity holds), both **member-gated AND address-gated** through one derivation (`hallUrlOf`, through `safeHttpUrl`). The mine-view card is untouched (task 1003301's scope; goal 1000059 R7 adds its manage door). The platform's own row carries the glyph only for a signed-in member.
+
+**Not done, on purpose:** the platform card has no banner — the mock used the landing's social card as "the platform's art in the only sense it has one", but that image carries the landing's own headline and reads as a screenshot inside the card; the kit fixture uses a text-free plate instead. Whether the platform should carry a real `art_url` is the owner's call.
+
+**Owner notes received during the build (filed as task 1003333, the landing hero):** the two doors sit too high and central; the three hero figures with their leader lines leave the landing (they fit the projects page — this card keeps the grammar); the large chrome plates should drift slowly like a lava lamp in place of the small bubble.

package/modules/platform-identity/project-stats.js

@@ -1,5 +1,6 @@
-// modules/platform-identity/project-stats.js — real Builders + Tags for the hub
-// catalog, read from each project's OWN public API (task 1002771).
+// modules/platform-identity/project-stats.js — real Builders + Tags (task 1002771)
+// and, since task 1003301, the poster card's faces, shipped-in-30-days figure and
+// hall address for the hub catalog, all read from each project's OWN public API.
 //
 // WHY THE DATA IS NOT HERE. The apex catalog stores four fields (origin, name,
 // tagline, art_url) and nothing else; the membership and activity tables that
@@ -13,6 +14,10 @@
 // /api/bongos/public/* surface, and the hub's server can read it instance-to-
 // instance with no CORS involved. The project itself is the authority on its own
 // builder count, which is a better source than anything the apex could infer.
+// The same holds for its hall address: no hub table stores one (provisioning
+// collapses every origin to the domain), but the instance's API discovery index
+// (GET /api/bongos, ADR 0114) advertises `hall` — the project answering for
+// itself, on the same basis as builders and tags.
 //
 // SCALE, recorded so it is not rediscovered: this PULL model is right for a
 // handful and fine for a few dozen behind the cache. It does not scale to
@@ -30,6 +35,23 @@ const TTL_MS = 10 * 60 * 1000;   // owner's choice, 2026-08-13
 const FETCH_TIMEOUT_MS = 2500;   // per request
 const COLD_DEADLINE_MS = 3000;   // total wait a COLD cache may cost a page load
 
+// The card's figure window and its faces row (task 1003301). The remote
+// recent-shipped feed is row-capped: 200 when it honours `?days=`, 30 when an
+// older core ignores the parameter — the cap is where a count becomes "N+".
+const SHIPPED_WINDOW_DAYS = 30;
+const SHIPPED_CAP_WINDOWED = 200;
+const SHIPPED_CAP_LEGACY = 30;
+const FACES_MAX = 5;
+const URL_MAX = 300;
+
+// ONE null shape for every way a project can fail to answer (the refresh catch
+// AND the read fallback). A key missing here ships as undefined, which
+// JSON.stringify drops, which silently changes the wire shape (task 1003258).
+const NULL_STATS = Object.freeze({
+  builders: null, tags: null, owner: null, owner_avatar: null,
+  faces: null, shipped_30d: null, shipped_30d_capped: null, hall_origin: null,
+});
+
 const _cache = new Map();        // origin → { at, stats }
 const _inflight = new Map();     // origin → Promise (collapses concurrent refreshes)
 
@@ -58,6 +80,14 @@ function isSystemAccount(login) {
   return /-system$/.test(String(login || ''));
 }
 
+// httpUrl — a third-party string becomes a URL only when it is http(s), and only
+// up to a length cap; anything else is null. Every avatar, face, art and hall
+// address the hub relays passes here (the client scheme-checks again before a
+// value becomes a src or an href).
+function httpUrl(raw, max = URL_MAX) {
+  return typeof raw === 'string' && /^https?:\/\//.test(raw) ? raw.slice(0, max) : null;
+}
+
 // ── SSRF GUARD ──
 // This is the one place the server makes an outbound request to an address that
 // came out of the database, so it is the one place that has to assume the address
@@ -109,14 +139,23 @@ async function assertPublicHost(hostname) {
   }
 }
 
-function publicUrl(origin, route) {
+// siteUrl — the origin as a URL, http(s) only. Throws on anything else, which is
+// the one path that reaches the cached-failure literal synchronously.
+function siteUrl(origin) {
   const u = new URL(origin);
   if (u.protocol !== 'https:' && u.protocol !== 'http:') throw new Error('bad scheme');
-  return new URL(`/api/bongos/public/${route}`, u).href;
+  return u;
+}
+function apiUrl(origin, route) {
+  return new URL(route, siteUrl(origin)).href;
+}
+function publicUrl(origin, route) {
+  return apiUrl(origin, `/api/bongos/public/${route}`);
 }
 
+// The guard has already run for this sweep's host (fetchStats resolves each
+// origin ONCE, not once per feed); this only fetches.
 async function getJson(url) {
-  await assertPublicHost(new URL(url).hostname);
   const res = await fetch(url, {
     signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
     headers: { accept: 'application/json' },
@@ -126,48 +165,92 @@ async function getJson(url) {
   return res.json();
 }
 
-// One project's stats. Either half may fail on its own — a project whose
+// leaderboardStats — builders, owner and faces from the project's OWN leaderboard.
+// The archon row IS the instance's owner — the project's own authority answering
+// for itself, from a payload already in hand (ADR 0170). The catalog's
+// owner_github_id ("advisory attribution (not an authority)") stays unread.
+// Caveat: the leaderboard is credits-ordered and page-capped, so a zero-credit
+// archon on a very large instance can fall off it — that renders as no owner
+// shown, never as a wrong one. The payload is third-party: accept only a
+// plausible login string (GitHub caps logins at 39 chars; 64 leaves headroom
+// without hosting a novel) and only http(s) avatar URLs.
+function leaderboardStats(rows) {
+  const people = rows.filter((b) => !isSystemAccount(b?.github_login));
+  const arch = people.find((b) => b?.rank === 'archon');
+  const login = arch?.github_login;
+  const owner = typeof login === 'string' && login ? login.slice(0, 64) : null;
+  return {
+    builders: people.length,
+    owner,
+    owner_avatar: owner ? httpUrl(arch?.avatar_url) : null,
+    // the faces row: the first five people with a usable avatar, in the feed's
+    // credits order; the card counts the rest against `builders` as +N
+    faces: people.map((b) => httpUrl(b?.avatar_url)).filter(Boolean).slice(0, FACES_MAX),
+  };
+}
+
+// shippedStats — how many tasks the project shipped in the last 30 days, and
+// whether that count sat at the feed's row cap (the card renders "N+" then). The
+// window is applied here from shipped_at even when the remote honoured `?days=`,
+// so an older core that ignores the parameter still yields a true number.
+function shippedStats(body) {
+  const rows = Array.isArray(body?.tasks) ? body.tasks : [];
+  const since = Date.now() - SHIPPED_WINDOW_DAYS * 24 * 60 * 60 * 1000;
+  const inWindow = rows.filter((t) => {
+    const ts = Date.parse(t?.shipped_at);
+    return Number.isFinite(ts) && ts >= since;
+  }).length;
+  const cap = body?.days === SHIPPED_WINDOW_DAYS ? SHIPPED_CAP_WINDOWED : SHIPPED_CAP_LEGACY;
+  return { shipped_30d: inWindow, shipped_30d_capped: rows.length >= cap && inWindow === rows.length };
+}
+
+// hallOrigin — the project's builders' hall address when it is genuinely a
+// different host from the site; null on a single-host instance (the hall is at
+// <site>/builders, where the site's own door already leads) and null when the
+// project does not say. Task 1003257, owner decision (a): a door only where it
+// opens somewhere else.
+function hallOrigin(index, origin) {
+  const hall = httpUrl(index?.hall);
+  if (!hall) return null;
+  try {
+    return new URL(hall).host.toLowerCase() === siteUrl(origin).host.toLowerCase() ? null : hall;
+  } catch {
+    return null;
+  }
+}
+
+// One project's stats. Every quarter may fail on its own — a project whose
 // leaderboard is down can still report its modules — so they settle independently
-// and a missing half is null (an em dash) rather than a discarded pair.
+// inside ONE allSettled (sequential awaits would turn the per-request ceiling into
+// a serial cost that blows the cold-load deadline), and a missing quarter is null
+// rather than a discarded whole.
 async function fetchStats(origin) {
-  const [lb, mods] = await Promise.allSettled([
+  await assertPublicHost(siteUrl(origin).hostname);   // once per sweep, not once per feed
+  const [lb, mods, ships, index] = await Promise.allSettled([
     getJson(publicUrl(origin, 'leaderboard')),
     getJson(publicUrl(origin, 'modules')),
+    getJson(publicUrl(origin, `recent-shipped?days=${SHIPPED_WINDOW_DAYS}`)),
+    getJson(apiUrl(origin, '/api/bongos')),
   ]);
 
-  let builders = null;
-  let owner = null;
-  let ownerAvatar = null;
+  const stats = { ...NULL_STATS };
   if (lb.status === 'fulfilled' && Array.isArray(lb.value?.leaderboard)) {
-    const people = lb.value.leaderboard.filter((b) => !isSystemAccount(b?.github_login));
-    builders = people.length;
-    // The archon row IS the instance's owner — the project's own authority
-    // answering for itself, from a payload already in hand (ADR 0170). The
-    // catalog's owner_github_id ("advisory attribution (not an authority)")
-    // stays unread. Caveat: the leaderboard is credits-ordered and page-capped,
-    // so a zero-credit archon on a very large instance can fall off it — that
-    // renders as no owner shown, never as a wrong one.
-    // The payload is third-party: accept only a plausible login string (GitHub
-    // caps logins at 39 chars; 64 leaves headroom without hosting a novel),
-    // and only an http(s) avatar URL — the client scheme-checks again before
-    // it becomes an <img>.
-    const arch = people.find((b) => b?.rank === 'archon');
-    const login = arch?.github_login;
-    owner = typeof login === 'string' && login ? login.slice(0, 64) : null;
-    const av = arch?.avatar_url;
-    ownerAvatar = owner && typeof av === 'string' && /^https?:\/\//.test(av) ? av.slice(0, 300) : null;
+    Object.assign(stats, leaderboardStats(lb.value.leaderboard));
   }
-
-  let tags = null;
   if (mods.status === 'fulfilled' && mods.value?.enabled && typeof mods.value.enabled === 'object') {
     const core = coreModules();
-    tags = Object.entries(mods.value.enabled)
+    stats.tags = Object.entries(mods.value.enabled)
       .filter(([key, on]) => on === true && !core.has(key))
       .map(([key]) => key)
       .sort();
   }
-
-  return { builders, tags, owner, owner_avatar: ownerAvatar };
+  if (ships.status === 'fulfilled' && Array.isArray(ships.value?.tasks)) {
+    Object.assign(stats, shippedStats(ships.value));
+  }
+  if (index.status === 'fulfilled') {
+    stats.hall_origin = hallOrigin(index.value, origin);
+  }
+  return stats;
 }
 
 function refresh(origin) {
@@ -181,9 +264,8 @@ function refresh(origin) {
       // Remember the FAILURE for a full TTL too. Without this a permanently
       // unreachable project is re-fetched on every request and pays the timeout
       // every time — the exact way one dead project slows the whole page.
-      const stats = { builders: null, tags: null, owner: null, owner_avatar: null };
-      _cache.set(origin, { at: Date.now(), stats });
-      return stats;
+      _cache.set(origin, { at: Date.now(), stats: NULL_STATS });
+      return NULL_STATS;
     })
     .finally(() => _inflight.delete(origin));
   _inflight.set(origin, p);
@@ -215,11 +297,14 @@ async function getProjectStats(origins = []) {
   // null-prototype: an origin literally equal to '__proto__' would otherwise
   // retarget the object's prototype instead of adding a key
   const out = Object.create(null);
-  for (const origin of origins) out[origin] = _cache.get(origin)?.stats || { builders: null, tags: null, owner: null, owner_avatar: null };
+  for (const origin of origins) out[origin] = _cache.get(origin)?.stats || NULL_STATS;
   return out;
 }
 
 // tests
 function _reset() { _cache.clear(); _inflight.clear(); _coreModules = null; }
 
-module.exports = { getProjectStats, isSystemAccount, coreModules, blockedReason, assertPublicHost, _reset, TTL_MS };
+module.exports = {
+  getProjectStats, isSystemAccount, coreModules, blockedReason, assertPublicHost, httpUrl,
+  NULL_STATS, SHIPPED_WINDOW_DAYS, FACES_MAX, _reset, TTL_MS,
+};

package/modules/platform-identity/routes/my-projects.js

@@ -15,6 +15,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
+const projectStats = require('../project-stats');
 
 const { pool, requireBuilder, validateOrRespond, userAgent } = api;
 
@@ -87,6 +88,17 @@ module.exports = function myProjectsRoutes() {
   router.get('/my-projects', requireBuilder, async (req, res) => {
     try {
       const rows = await pi.listMembershipsForAccount(req.builder.github_id, { pool });
+      // hall_origin per membership (task 1003301): the project's own hall
+      // address where it differs from its site, null otherwise — read from the
+      // project's API discovery index through the same cached enrichment the
+      // catalog uses (no hub table stores it). Best-effort: a project that does
+      // not answer gets null, never a failed listing.
+      let stats = {};
+      try {
+        stats = await projectStats.getProjectStats(rows.map((m) => m.project_origin).filter(Boolean));
+      } catch (err) {
+        api.logger('platform-identity').error(`my-projects hall enrichment failed (non-fatal): ${err && err.message}`);
+      }
       const owned = [];
       const building = [];
       for (const m of rows) {
@@ -94,6 +106,7 @@ module.exports = function myProjectsRoutes() {
           client_id: m.client_id,
           name: m.project_name || m.project_origin || m.client_id,
           origin: m.project_origin || null,
+          hall_origin: (m.project_origin && stats[m.project_origin]?.hall_origin) || null,
           membership_kind: m.membership_kind,
           joined_at: m.joined_at,
           last_active: m.last_active,

package/modules/platform-identity/routes/projects.js

@@ -122,13 +122,16 @@ module.exports = function projectsRoutes() {
       } catch (err) {
         console.error('[platform-identity] project stats enrichment failed (non-fatal):', err.message);
       }
+      // The enrichment's keys (builders, tags, owner, owner_avatar, faces,
+      // shipped_30d, shipped_30d_capped, hall_origin) never collide with the
+      // catalog's; a project that did not answer carries the ONE shared null
+      // shape, so the wire never drops a key. art_url is catalog text an Archon
+      // typed — scheme-checked here, and again on the client, before it is a src.
       res.json({
         projects: projects.map((p) => ({
           ...p,
-          builders: stats[p.origin]?.builders ?? null,
-          tags: stats[p.origin]?.tags ?? null,
-          owner: stats[p.origin]?.owner ?? null,
-          owner_avatar: stats[p.origin]?.owner_avatar ?? null,
+          art_url: projectStats.httpUrl(p.art_url, 2048),
+          ...(stats[p.origin] || projectStats.NULL_STATS),
         })),
       });
     } catch (err) {

package/modules/ui-design/kit/fixtures/featured.json

@@ -1 +1 @@
-{"projects":[{"origin":"https://amazonprimea.com","name":"Off the Boats","tagline":"A singular shop, and a broader videogame in a persistent ancient Greek world that collides with modern day commerce & products.","art_url":null,"type":"game","created_at":"2026-07-15T22:12:57.732Z","builders":11,"tags":["art-pipeline","character-anim","demo","game"],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4"},{"origin":"https://demo.cloudbongos.com","name":"Demo","tagline":"A live demo instance on Cloud Bongos.","art_url":null,"type":null,"created_at":"2026-07-14T19:16:38.160Z","builders":1,"tags":[],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4"},{"origin":"https://emersonian-circles.cloudbongos.com","name":"Emersonian Circles","tagline":"An independent project built on Cloud Bongos.","art_url":null,"type":null,"created_at":"2026-07-25T02:21:55.641Z","builders":1,"tags":[],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4"}]}
+{"projects":[{"origin":"https://amazonprimea.com","name":"Off the Boats","tagline":"A singular shop, and a broader videogame in a persistent ancient Greek world that collides with modern day commerce & products.","art_url":"/assets/world/r2-chrome-blob-one.jpg","type":"game","created_at":"2026-07-15T22:12:57.732Z","builders":11,"tags":["art-pipeline","character-anim","demo","game"],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":["https://avatars.githubusercontent.com/u/283020391?v=4","https://avatars.githubusercontent.com/u/64553469?v=4","https://avatars.githubusercontent.com/u/290184380?v=4","https://avatars.githubusercontent.com/u/295990394?v=4","https://avatars.githubusercontent.com/u/35337514?v=4"],"shipped_30d":0,"shipped_30d_capped":false,"hall_origin":"https://builders.amazonprimea.com"},{"origin":"https://demo.cloudbongos.com","name":"Demo","tagline":"A live demo instance on Cloud Bongos.","art_url":null,"type":null,"created_at":"2026-07-14T19:16:38.160Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null},{"origin":"https://emersonian-circles.cloudbongos.com","name":"Emersonian Circles","tagline":"An independent project built on Cloud Bongos.","art_url":null,"type":null,"created_at":"2026-07-25T02:21:55.641Z","builders":1,"tags":[],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":[],"shipped_30d":30,"shipped_30d_capped":true,"hall_origin":null}]}

package/modules/ui-design/kit/fixtures/my-projects.json

@@ -1 +1 @@
-{"owned":[],"building":[]}
+{"owned":[],"building":[{"client_id":"otb","name":"Off the Boats","origin":"https://amazonprimea.com","hall_origin":"https://builders.amazonprimea.com","membership_kind":"member","joined_at":"2026-07-20T10:00:00.000Z","last_active":"2026-08-27T18:00:00.000Z"},{"client_id":"emersonian","name":"Emersonian Circles","origin":"https://emersonian-circles.cloudbongos.com","hall_origin":null,"membership_kind":"member","joined_at":"2026-07-26T10:00:00.000Z","last_active":"2026-08-20T18:00:00.000Z"}]}

package/modules/ui-design/kit/serve.js

@@ -99,12 +99,23 @@ const AUTHED = { '/my-projects': 'my-projects' };
 const UNAUTH = { error: { code: 'unauthenticated', message: 'unauthenticated' } };
 
 function json(res, status, body) { res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' }); res.end(JSON.stringify(body)); }
-function fixture(name, res) {
+function fixture(name, res, origin) {
   if (FAIL.has(name)) return json(res, 500, { error: { code: 'stub_failure', message: `FAIL=${name}` } });
   const file = path.join(FIXTURES, name + '.json');
   if (!fs.existsSync(file)) return json(res, 404, { error: { code: 'no_fixture', message: name } });
   res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' });
-  res.end(fs.readFileSync(file));
+  res.end(name === 'featured' ? JSON.stringify(featured(file, origin)) : fs.readFileSync(file));
+}
+// A project's art in the featured fixture may be root-relative (the surface's
+// own /assets/…, served by this stub) — the page accepts only an http(s) art
+// URL, so it is absolutised to this origin per request, as the builder's
+// avatar is (see me()).
+function featured(file, origin) {
+  const body = JSON.parse(fs.readFileSync(file, 'utf8'));
+  for (const p of body.projects || []) {
+    if (typeof p.art_url === 'string' && p.art_url.startsWith('/')) p.art_url = origin + p.art_url;
+  }
+  return body;
 }
 function proxy(req, res) {
   const origin = (liveOrigin === '1' ? '' : liveOrigin).replace(/\/$/, '');
@@ -142,7 +153,7 @@ const server = http.createServer((req, res) => {
   const apiMatch = p.match(/^\/api\/(gds|bongos)(\/.*)$/);
   if (apiMatch) {
     const rest = apiMatch[2];
-    if (FEEDS[rest]) return LIVE ? proxy(req, res) : fixture(FEEDS[rest], res);
+    if (FEEDS[rest]) return LIVE ? proxy(req, res) : fixture(FEEDS[rest], res, origin);
     if (rest === '/me') return AUTH ? json(res, 200, me(origin)) : json(res, 401, UNAUTH);
     if (AUTHED[rest]) return AUTH ? fixture(AUTHED[rest], res) : json(res, 401, UNAUTH);
     if (rest === '/provisioning/instances') return AUTH ? json(res, 200, { instances: [] }) : json(res, 401, UNAUTH);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.402",
+  "version": "1.19.404",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.402",
+      "version": "1.19.404",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.402",
+  "version": "1.19.404",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -250,6 +250,7 @@
   --radius:16px; --radius-sm:10px; --radius-pill:999px;
   --top-h:64px;
   --gutter:clamp(16px,4vw,34px);
+  --leader-len:68px;   /* the poster card's callout leader (task 1003301) */
   /* the world's object for the hub's view masthead (task 1003332): the apex
      shares the landing's plates because it is the same world (DESIGN.md
      "Materials"); the hub takes the alpha CUTOUT in both modes — the view
@@ -897,32 +898,130 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
    dark, which paints a white sheet over the page instead of dimming it. */
 .cardScrim{position:fixed;inset:0;z-index:60;display:flex;align-items:center;justify-content:center;
   padding:24px;background:rgba(0,0,0,.55);backdrop-filter:blur(3px);}
-.projCard{position:relative;width:min(420px,100%);background:var(--bg-card);border:1.5px solid var(--line);
-  border-radius:var(--r-card,20px);box-shadow:var(--shadow-card);padding:30px 28px 26px;text-align:center;}
-.projCard .cardDot{display:block;width:54px;height:54px;border-radius:50%;margin:0 auto 16px;
-  background:var(--acc,var(--accent));box-shadow:0 0 0 8px color-mix(in srgb,var(--acc,var(--accent)) 18%,transparent);}
-.projCard h3{font-family:var(--font-display);font-weight:700;font-size:21px;color:var(--ink);margin-bottom:6px;}
-.projCard .cardTag{font-size:14px;color:var(--ink-faint);font-weight:600;line-height:1.5;margin-bottom:14px;}
-.projCard .cardRel{display:inline-block;font-family:var(--font-mono);font-size:11px;padding:3px 10px;
-  border-radius:999px;background:var(--accent-soft);color:var(--accent-deep);margin-bottom:18px;}
-/* the facts strip (task 1002778): a label/value grid, centered as a block but
-   read left-aligned. A hidden pair leaves no gap — the grid row collapses. */
-.projCard .cardMeta{display:grid;grid-template-columns:auto auto;justify-content:center;
-  gap:6px 14px;margin-bottom:18px;text-align:left;}
-.projCard .cardMeta dt{font-family:var(--font-mono);font-size:11px;letter-spacing:.04em;
-  text-transform:uppercase;color:var(--ink-faint);align-self:center;}
-.projCard .cardMeta dd{font-size:13.5px;color:var(--ink-soft);font-weight:600;}
-.projCard .cardMeta .ownerAv{width:16px;height:16px;border-radius:50%;vertical-align:-3px;margin-right:6px;}
-.projCard .cardMeta .tags{display:flex;gap:6px;flex-wrap:wrap;}
-.projCard .cardMeta .tags span{font-family:var(--font-mono);font-size:10.5px;padding:2px 8px;
-  border-radius:999px;border:1px solid var(--line);color:var(--ink-faint);white-space:nowrap;}
-.projCard .cardActions{display:flex;gap:10px;justify-content:center;flex-wrap:wrap;}
-.projCard .cardX{position:absolute;top:10px;right:12px;width:30px;height:30px;border-radius:50%;
-  border:none;background:none;cursor:pointer;font-size:14px;color:var(--ink-faint);line-height:1;}
-.projCard .cardX:hover{background:var(--accent-soft);color:var(--accent-deep);}
+/* THE POSTER (task 1003301; the v2 pick, direction §7): a specimen sheet in the
+   world, not a panel. min(560px,100%) on bg-card closed by one rule hairline,
+   no shadow (the world has no shadow vocabulary for UI). A flex column ordered
+   by `order`, so every region stays a flat child of the card whatever the
+   layout does with it (the C6 slice rule in tests/projects_hub.mjs).
+   container-type gives the disc and the callouts the card's own width (cqw),
+   so the banner's 5:2 edge is a number the disc can sit on. Six regions, top
+   to bottom: the banner, the two figures (callouts ON the art from 561px,
+   the two-up band otherwise and with no art), the accent disc, name / tagline
+   / relationship, the faces, the facts as a mono hairline ledger, the doors. */
+.projCard{position:relative;container-type:inline-size;display:flex;flex-direction:column;
+  width:min(560px,100%);max-height:calc(100vh - 48px);overflow:auto;text-align:left;
+  background:var(--bg-card);border:1px solid var(--rule);border-radius:var(--radius);box-shadow:none;padding:0 0 26px;}
+.projCard:not(.has-art){padding-top:26px;}
+.projCard .cardArt{order:0;display:block;width:100%;aspect-ratio:5/2;object-fit:cover;
+  border-radius:var(--radius) var(--radius) 0 0;}
+.projCard .cardX{position:absolute;top:12px;right:12px;z-index:4;display:inline-flex;align-items:center;
+  justify-content:center;width:30px;height:30px;border:0;border-radius:var(--radius-pill);
+  background:var(--glass-strong);color:var(--ink);cursor:pointer;font-size:14px;line-height:1;}
+.projCard .cardX:hover{background:var(--glass-edge);}
+/* on art the close control takes the void pill: the one legal literal is black with alpha */
+.projCard.has-art .cardX{background:var(--void-pill);color:var(--void-ink);}
+/* THE DISC SURVIVES: it is how a project is recognised in the sky (task 1003258).
+   With art it half-overlaps the banner's lower edge, ringed in the card ground
+   so it sits ON the card; without art it renders where it always did. */
+.projCard .cardDot{order:1;align-self:flex-start;display:block;width:54px;height:54px;border-radius:50%;
+  margin:0 0 16px 26px;background:var(--acc,var(--accent));box-shadow:none;}
+.projCard.has-art .cardDot{position:absolute;z-index:3;left:24px;top:calc(100cqw / 2.5 - 27px);margin:0;
+  border:4px solid var(--bg-card);}
+.projCard h3{order:3;margin:0;padding:0 26px;font-family:var(--font-display);font-size:32px;font-weight:300;
+  line-height:1.08;letter-spacing:-.03em;color:var(--ink);}
+.projCard.has-art h3{margin-top:44px;}
+.projCard .cardTag{order:4;margin:9px 0 0;padding:0 26px;font-size:14.5px;font-weight:400;line-height:1.5;
+  color:var(--ink-soft);max-width:46ch;}
+/* the relationship is a mono label, not a pill: a fact about you, not a control */
+.projCard .cardRel{order:5;display:block;margin:14px 0 0;padding:0 26px;background:none;border-radius:0;
+  font-family:var(--label-face);font-size:var(--label-size);letter-spacing:var(--label-space);
+  text-transform:uppercase;color:var(--ink-faint);}
+.projCard .cardFaces{order:6;display:flex;align-items:center;margin:18px 0 0;padding:0 26px;}
+.projCard .cardFaces img{width:28px;height:28px;border-radius:50%;object-fit:cover;
+  border:2px solid var(--bg-card);margin-right:-8px;}
+.projCard .facesMore{margin-left:16px;font-family:var(--font-mono);font-size:11.5px;color:var(--ink-faint);
+  font-variant-numeric:tabular-nums;}
+/* the two figures in the world's callout grammar (DESIGN.md "Leader-line
+   callouts"): a 1px diagonal leader, a 300-weight tabular figure, a caption */
+.projCard .cardFigs{order:7;display:flex;gap:38px;margin:20px 0 0;padding:0 26px;}
+.projCard .cardCall{display:block;}
+.projCard .lead{display:none;width:var(--leader-len);height:26px;margin-bottom:10px;overflow:visible;
+  color:color-mix(in srgb,var(--ink) 78%,transparent);}
+.projCard .fig{display:block;position:relative;width:fit-content;font-family:var(--font-display);
+  font-size:clamp(21px,5cqw,28px);font-weight:300;letter-spacing:-.025em;line-height:1;
+  font-variant-numeric:tabular-nums;color:var(--ink);text-shadow:var(--type-halo);}
+.projCard .cap{display:block;position:relative;width:fit-content;margin-top:7px;font-size:13px;
+  color:var(--ink-soft);text-shadow:var(--type-halo);}
+@media (min-width:561px){
+  .projCard.has-art .cardFigs{position:absolute;z-index:2;left:0;right:0;top:0;height:calc(100cqw / 2.5);
+    margin:0;padding:0;display:block;pointer-events:none;}
+  .projCard.has-art .cardCall{position:absolute;width:max-content;max-width:42%;}
+  /* 44px in, not the 26px gutter: the patch reaches 44px past the glyph box,
+     and a patch that meets the card's edge is clipped flat there */
+  .projCard.has-art .cardCall.a{left:44px;top:14px;}
+  .projCard.has-art .cardCall.b{right:44px;top:calc(100cqw / 2.5 - 112px);text-align:right;}
+  .projCard.has-art .cardCall.b .fig,.projCard.has-art .cardCall.b .cap{margin-left:auto;}
+  .projCard.has-art .cardCall .lead{display:block;}
+  .projCard.has-art .cardCall.b .lead{transform:scaleX(-1);margin-left:auto;}
+  /* each callout carries ONE feathered patch of the CARD ground under its
+     figure and caption together: solid to 10px past every edge of the glyph
+     boxes (no column of the text ever sits on the fade), then a 34px feather
+     to nothing, so the patch reads as haze in the art and never as a slab of
+     paint on it. The feather is a mask, not a shadow. It starts under the
+     figure, never behind the leader. */
+  .projCard.has-art .cardCall::before{content:"";position:absolute;left:-44px;right:-44px;top:18px;bottom:-24px;
+    z-index:-1;pointer-events:none;background:var(--bg-card);border-radius:44px/30px;filter:blur(3px);
+    -webkit-mask-image:linear-gradient(90deg,transparent,var(--ink) 34px,var(--ink) calc(100% - 34px),transparent),
+      linear-gradient(180deg,transparent,var(--ink) 10px,var(--ink) calc(100% - 12px),transparent);
+    -webkit-mask-composite:source-in;
+    mask-image:linear-gradient(90deg,transparent,var(--ink) 34px,var(--ink) calc(100% - 34px),transparent),
+      linear-gradient(180deg,transparent,var(--ink) 10px,var(--ink) calc(100% - 12px),transparent);
+    mask-composite:intersect;}
+}
+/* the facts as the ledger (task 1003332's grammar): mono label left, value
+   right and tabular, ONE rule-soft hairline per row on both cells so the rule
+   never steps at the column boundary. A hidden pair leaves no gap. */
+.projCard .cardMeta{order:8;display:grid;grid-template-columns:auto 1fr;justify-content:normal;gap:0;
+  margin:22px 0 0;padding:0 26px;text-align:left;}
+.projCard .cardMeta dt{font-family:var(--label-face);font-size:var(--label-size);letter-spacing:var(--label-space);
+  text-transform:uppercase;color:var(--ink-faint);padding:11px 20px 11px 0;border-top:1px solid var(--rule-soft);
+  line-height:19px;}
+.projCard .cardMeta dd{margin:0;padding:11px 0;text-align:right;font-size:14px;font-weight:400;color:var(--ink);
+  border-top:1px solid var(--rule-soft);font-variant-numeric:tabular-nums;}
+.projCard .cardMeta .ownerAv{display:inline-block;width:16px;height:16px;border-radius:50%;object-fit:cover;
+  vertical-align:-3px;margin-right:6px;}
+/* ONE accent door (the One Warm Thing Rule), the hall entry beside it as an
+   underlined accent-deep text link (the footer-link grammar) */
+.projCard .cardActions{order:9;display:flex;align-items:center;justify-content:flex-start;gap:22px;flex-wrap:wrap;
+  margin:24px 0 0;padding:0 26px;}
+.projCard .cardOpen{display:inline-flex;align-items:center;justify-content:center;min-height:48px;padding:0 30px;
+  border-radius:var(--radius-pill);background:var(--accent);color:var(--accent-on);font-family:var(--font-display);
+  font-size:16px;font-weight:500;text-transform:lowercase;text-decoration:none;
+  transition:background .2s cubic-bezier(.2,.7,.3,1);}
+.projCard .cardOpen:hover{background:var(--accent-lift);color:var(--accent-on);}
+.projCard .cardHall{display:inline-flex;align-items:center;gap:8px;min-height:24px;color:var(--accent-deep);
+  font-size:15px;text-transform:lowercase;text-decoration:underline;text-underline-offset:4px;
+  text-decoration-color:color-mix(in srgb,var(--accent) 55%,transparent);
+  transition:text-decoration-color .2s cubic-bezier(.2,.7,.3,1);}
+.projCard .cardHall:hover{text-decoration-color:var(--accent-deep);}
+.cardHall svg,.rowHall svg{width:17px;height:17px;fill:none;stroke:currentColor;stroke-width:1.5;
+  stroke-linecap:round;stroke-linejoin:round;}
+/* the table row's hall glyph: beside Open, a member's door, only where the hall is elsewhere */
+.rowHall{display:inline-flex;align-items:center;justify-content:center;width:28px;height:28px;margin-left:10px;
+  vertical-align:middle;color:var(--accent-deep);border-radius:var(--radius-pill);}
+.rowHall:hover{background:var(--glass);}
+.tbl .colGo{white-space:nowrap;}
+@media (max-width:640px){
+  .projCard h3{font-size:26px;padding:0 20px;}
+  .projCard .cardTag,.projCard .cardRel,.projCard .cardFaces,.projCard .cardFigs,.projCard .cardMeta,
+  .projCard .cardActions{padding-left:20px;padding-right:20px;}
+  .projCard .cardDot{margin-left:20px;}
+  .projCard.has-art .cardDot{left:18px;}
+  .projCard .cardActions{gap:16px;}
+}
 @media (prefers-reduced-motion:no-preference){
-  .cardScrim:not([hidden]) .projCard{animation:cardIn .16s ease-out;}
-  @keyframes cardIn{from{opacity:0;transform:translateY(6px) scale(.98);}to{opacity:1;transform:none;}}
+  .cardScrim:not([hidden]) .projCard{animation:cardIn 260ms cubic-bezier(.16,1,.3,1) both;}
+  @keyframes cardIn{from{opacity:0;transform:translateY(6px);}to{opacity:1;transform:none;}}
 }
 
 /* ── your projects: search + a state filter whose pills carry live counts, so