@bongos/core 1.19.419 → 1.19.420

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.419",
+  "version": "1.19.420",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.419",
+      "version": "1.19.420",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.419",
+  "version": "1.19.420",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -95,14 +95,17 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
 .wizField{display:block;margin-bottom:18px;}
 .wizField>span{display:block;font-size:13.5px;font-weight:700;color:var(--ink-soft);margin-bottom:7px;letter-spacing:0.2px;}
 .wizField small{font-weight:500;color:var(--ink-faint);}
-#view-new input[type=text]{
+/* the About step's description is prose, so it is a textarea — it wears the
+   same control skin as every other field (task 1002334), never its own */
+#view-new input[type=text], #view-new textarea{
   width:100%;font-family:var(--font-body);font-size:17px;font-weight:600;color:var(--ink);
   background:var(--bg-card);border:2px solid var(--ctl-line);border-radius:14px;padding:13px 16px;outline:none;
   transition:border-color .15s ease, box-shadow .15s ease;
 }
+#view-new textarea{font-size:15.5px;line-height:1.5;resize:vertical;min-height:84px;display:block;}
 /* no fade toward the card — a 70% mix washed placeholders to 2.89:1 (task 1002749) */
-#view-new input[type=text]::placeholder{color:var(--ink-faint);font-weight:500;}
-#view-new input[type=text]:focus{border-color:var(--accent);box-shadow:0 0 0 4px color-mix(in srgb,var(--accent) 13%,transparent);}
+#view-new input[type=text]::placeholder, #view-new textarea::placeholder{color:var(--ink-faint);font-weight:500;}
+#view-new input[type=text]:focus, #view-new textarea:focus{border-color:var(--accent);box-shadow:0 0 0 4px color-mix(in srgb,var(--accent) 13%,transparent);}
 #view-new input[type=text].bad{border-color:var(--err);}
 .hint{font-size:13px;font-weight:600;color:var(--ink-faint);margin-top:7px;min-height:18px;}
 .hint.ok{color:var(--ok);}
@@ -146,6 +149,9 @@ h1[tabindex="-1"]:focus:not(:focus-visible){outline:none;}
 .humanSteps .ghbtn{font-size:14px;padding:9px 16px;margin-top:10px;}
 
 .nav{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-top:26px;}
+/* two controls sharing one end of a nav row — the About step's Skip beside its
+   Next (task 1002334). Wraps on a narrow card rather than crushing either. */
+.navPair{display:inline-flex;align-items:center;gap:10px;flex-wrap:wrap;justify-content:flex-end;}
 .btn.big{width:100%;justify-content:center;font-size:18px;padding:17px 30px;}
 
 /* review list */
@@ -748,7 +754,7 @@ summary{min-height:24px;padding:3px 0;}
 
 <!-- ══════════════════ VIEW · NEW PROJECT ══════════════════════════════════
      The whole create wizard, absorbed from /create (task 1002763; direction
-     §4 — that route now 302s here). Seven panels behind the five-beat rail; the
+     §4 — that route now 302s here). Eight panels behind the six-beat rail; the
      wizard block in the script below drives them. Same trust boundary as
      ever: every button here only ENQUEUES a provisioning request (ADR 0111).
      The name panel carries a static `on` so a no-script visitor still reads
@@ -759,9 +765,10 @@ summary{min-height:24px;padding:3px 0;}
       <ol class="steps" aria-label="Creation steps">
         <li class="now" data-step="1" aria-current="step"><span class="snum">1</span><span class="slbl">Name</span></li>
         <li data-step="2"><span class="snum">2</span><span class="slbl">Type</span></li>
-        <li data-step="3"><span class="snum">3</span><span class="slbl">Home</span></li>
-        <li data-step="4"><span class="snum">4</span><span class="slbl">Address</span></li>
-        <li data-step="5"><span class="snum">5</span><span class="slbl">Create</span></li>
+        <li data-step="3"><span class="snum">3</span><span class="slbl">About</span></li>
+        <li data-step="4"><span class="snum">4</span><span class="slbl">Home</span></li>
+        <li data-step="5"><span class="snum">5</span><span class="slbl">Address</span></li>
+        <li data-step="6"><span class="snum">6</span><span class="slbl">Create</span></li>
       </ol>
 
       <div class="createSplit">
@@ -841,11 +848,45 @@ summary{min-height:24px;padding:3px 0;}
             </form>
           </section>
 
-          <!-- step 3 · home (repo + mode) -->
+          <!-- step 3 · about (task 1002334) — the OPTIONAL project-detail step.
+               The one panel in the wizard that can be walked past without an
+               answer, so the skip is a real button of its own, sitting beside
+               Next rather than hidden as "leave it blank and press Next" — an
+               optional step whose escape hatch has to be inferred is not
+               optional in practice. What skipping costs is stated ON the panel
+               (ADR 0182 D4: no description ⇒ the project is off the public map
+               until it has one), because a consequence discovered afterwards is
+               not a choice the owner made. -->
+          <section class="panel" id="panel-detail" aria-labelledby="detail-h">
+            <h1 id="detail-h">Tell us about it</h1>
+            <p class="lede">Optional — skip it and nothing about your project changes. Answering shapes what we set up for you, and a description is what puts the project on the public map.</p>
+            <form data-next="4">
+              <label class="wizField"><span>What are you building? <small>(a sentence or two)</small></span>
+                <textarea id="f-desc" rows="3" maxlength="600" placeholder="A co-op farming game where the seasons never repeat."></textarea>
+              </label>
+              <div class="wizField"><span id="teamLbl">Who’s building it?</span>
+                <div class="typeCards" id="teamCards" role="group" aria-labelledby="teamLbl">
+                  <button type="button" class="tpill" data-team="solo" aria-pressed="false">Just me</button>
+                  <button type="button" class="tpill" data-team="small-team" aria-pressed="false">A small team</button>
+                  <button type="button" class="tpill" data-team="community" aria-pressed="false">An open community</button>
+                </div>
+              </div>
+              <div class="reassure" id="detailSkipNote"></div>
+              <div class="nav">
+                <button type="button" class="btn ghost" data-back="2">← Back</button>
+                <span class="navPair">
+                  <button type="button" class="btn ghost" id="skipDetail">Skip for now</button>
+                  <button type="submit" class="btn">Next →</button>
+                </span>
+              </div>
+            </form>
+          </section>
+
+          <!-- step 4 · home (repo + mode) -->
           <section class="panel" id="panel-home" aria-labelledby="home-h">
             <h1 id="home-h">Where the code lives</h1>
             <p class="lede">Every project is a real GitHub repository that you own. Start from a clean slate, or bring a repo you already have.</p>
-            <form data-next="4">
+            <form data-next="5">
               <div class="choices" role="group" aria-label="Starting point">
                 <button type="button" class="choice" id="c-green" aria-pressed="true">
                   <!-- token-built, not platform orange — public-landing/ ships wholesale to
@@ -904,13 +945,13 @@ summary{min-height:24px;padding:3px 0;}
               </div>
               <div class="hint" id="h-home">&nbsp;</div>
               <div class="nav">
-                <button type="button" class="btn ghost" data-back="2">← Back</button>
+                <button type="button" class="btn ghost" data-back="3">← Back</button>
                 <button type="submit" class="btn">Next →</button>
               </div>
             </form>
           </section>
 
-          <!-- step 4 · address — a CONFIRMATION, not a form (task 1002704: every project
+          <!-- step 5 · address — a CONFIRMATION, not a form (task 1002704: every project
                gets its slug subdomain assigned up front). The domainless default was a
                proven dead-end (QA walk, task 1002702).
                Three choices, all legible without opening anything (task 1002898 N8):
@@ -922,7 +963,7 @@ summary{min-height:24px;padding:3px 0;}
           <section class="panel" id="panel-address" aria-labelledby="addr-h">
             <h1 id="addr-h">Its address in the sky</h1>
             <p class="lede">The handle names your project on the platform — and its address comes with it. Once it stands up, a few GitHub steps (the next screen walks you through them) switch sign-in on.</p>
-            <form data-next="5">
+            <form data-next="6">
               <label class="wizField"><span>Project handle</span>
                 <input type="text" id="f-slug" placeholder="mercury" autocomplete="off" maxlength="40" spellcheck="false">
                 <div class="hint" id="h-slug">&nbsp;</div>
@@ -944,13 +985,13 @@ summary{min-height:24px;padding:3px 0;}
                 </label>
               </div>
               <div class="nav">
-                <button type="button" class="btn ghost" data-back="3">← Back</button>
+                <button type="button" class="btn ghost" data-back="4">← Back</button>
                 <button type="submit" class="btn">Next →</button>
               </div>
             </form>
           </section>
 
-          <!-- step 5 · review + create -->
+          <!-- step 6 · review + create -->
           <section class="panel" id="panel-review" aria-labelledby="rev-h">
             <h1 id="rev-h">Ready to roll</h1>
             <p class="lede">One tap files the request and the platform starts standing your project up — server, database, address. Here's the beat you're about to drop:</p>
@@ -958,7 +999,7 @@ summary{min-height:24px;padding:3px 0;}
             <div class="alert" id="createAlert" role="alert"></div>
             <div class="nav" style="flex-direction:column;align-items:stretch;">
               <button type="button" class="btn big" id="doCreate">Create my project</button>
-              <button type="button" class="btn ghost" data-back="4" style="align-self:flex-start;margin-top:10px;">← Back</button>
+              <button type="button" class="btn ghost" data-back="5" style="align-self:flex-start;margin-top:10px;">← Back</button>
             </div>
             <p class="finePrint">This files the request; the control plane does the real standup and nothing touches servers from this page. You'll get the few steps only you can do right after.</p>
           </section>
@@ -2488,13 +2529,16 @@ summary{min-height:24px;padding:3px 0;}
     var root = $('view-new');
 
     /* ── state ── */
-    /* -v2 since task 1002772: the step indices renumbered (Type joined as 2),
-       so a draft written under the five-step numbering must be ignored, not
-       reinterpreted — a stale step 4 would land on Address and skip the Type
-       gate with the rail already marking it done. */
-    var DRAFT_KEY = 'cb-create-draft-v2';
+    /* -v3 since task 1002334: the indices renumbered AGAIN (About joined as 3),
+       so a draft written under either older numbering must be ignored, not
+       reinterpreted — a stale step 4 meant Address under v1 and Home under v3,
+       and replaying it would land on the wrong panel with the rail already
+       marking the skipped ones done. Bump this key on EVERY renumbering. */
+    var DRAFT_KEY = 'cb-create-draft-v3';
     var CREATED_KEY = 'cb-created-instance';
-    var state = { step: 0, name: '', projType: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
+    /* `description` + `teamShape` are the optional About step (task 1002334) —
+       both legitimately stay empty, and empty is what the create request omits. */
+    var state = { step: 0, name: '', projType: null, description: '', teamShape: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
     try { Object.assign(state, JSON.parse(sessionStorage.getItem(DRAFT_KEY) || '{}')); } catch (e) {}
     var authKnown = false;   /* flips true when the boot's /me settles, either way */
 
@@ -2508,7 +2552,7 @@ summary{min-height:24px;padding:3px 0;}
         state.name = handedName.trim().slice(0, 80);
         state.slug = deriveSlug(state.name); state.slugTouched = false;
         state.repo = deriveRepo(state.name); state.repoTouched = false;
-        state.step = state.step >= 1 && state.step <= 5 ? state.step : 1;
+        state.step = state.step >= 1 && state.step <= 6 ? state.step : 1;
         try { sessionStorage.setItem(DRAFT_KEY, JSON.stringify(state)); } catch (e) {}
       }
     } catch (e) {}
@@ -2700,16 +2744,17 @@ summary{min-height:24px;padding:3px 0;}
     }
 
     /* ── step navigation ──
-       Six steps since task 1002772: gate 0 · name 1 · type 2 · home 3 ·
-       address 4 · review 5 · done 6 (the rail shows 1-5; done marks it all). */
-    var panels = { 0: 'panel-gate', 1: 'panel-name', 2: 'panel-type', 3: 'panel-home', 4: 'panel-address', 5: 'panel-review', 6: 'panel-done' };
+       Seven steps since task 1002334: gate 0 · name 1 · type 2 · about 3 ·
+       home 4 · address 5 · review 6 · done 7 (the rail shows 1-6; done marks it
+       all). About is the one step Next can pass with nothing filled in. */
+    var panels = { 0: 'panel-gate', 1: 'panel-name', 2: 'panel-type', 3: 'panel-detail', 4: 'panel-home', 5: 'panel-address', 6: 'panel-review', 7: 'panel-done' };
     /* the rail at the done panel (task 1003244): "done" is the Create step
        still running — the marker stays on 5 until the project actually
        answers, and only then does the whole rail read finished. aria-current
        tells a screen reader the same thing. */
     function paintRail(step) {
-      var landed = step === 6 && !!(live && live.instStatus === 'active');
-      var cur = step === 6 ? 5 : step;
+      var landed = step === 7 && !!(live && live.instStatus === 'active');
+      var cur = step === 7 ? 6 : step;
       root.querySelectorAll('.steps li').forEach(function (li) {
         var n = Number(li.getAttribute('data-step'));
         var now = !landed && n === cur;
@@ -2720,7 +2765,7 @@ summary{min-height:24px;padding:3px 0;}
            the button role, the tab stop and the data-goto the delegated handler
            below reads. The done panel offers none — the project is filed, and
            there is nothing behind it to change. */
-        if (step < 6 && n < cur) {
+        if (step < 7 && n < cur) {
           li.setAttribute('role', 'button');
           li.setAttribute('tabindex', '0');
           li.setAttribute('data-goto', String(n));
@@ -2739,7 +2784,7 @@ summary{min-height:24px;padding:3px 0;}
       paintRail(step);
       saveDraft();
       /* the done step takes the whole card — the bongo pair steps aside */
-      root.querySelector('.createSplit').classList.toggle('wizDone', step === 6);
+      root.querySelector('.createSplit').classList.toggle('wizDone', step === 7);
       /* focus moves ONLY on a deliberate step (the hub rule setView already
          applies to this view: never on boot, never on a background settle) */
       if (moveFocus) {
@@ -2749,15 +2794,15 @@ summary{min-height:24px;padding:3px 0;}
       /* the repo probe is authenticated — never fire it before /me settles
          (a pre-auth probe 401s for strangers and, worse, could seed the
          draft's owner with myLogin()'s placeholder) */
-      if (step === 3) { syncHome(); if (authKnown) ensureRepoAccess(); }
+      if (step === 4) { syncHome(); if (authKnown) ensureRepoAccess(); }
       /* a resumed draft can land PAST the Home step with the probe never run —
          Create would then file a repo it promised to make but never did */
-      else if (step > 3 && step < 6 && authKnown && repoAccess === null) ensureRepoAccess();
+      else if (step > 4 && step < 7 && authKnown && repoAccess === null) ensureRepoAccess();
       /* re-check on every entry, not just on typing: a resumed draft arrives here with
          a handle nobody has asked the server about, and a handle free ten minutes ago
          may not be now (task 1002898 N10) */
-      if (step === 4) { checkSlugAvailable(); renderAddrPanel(); }
-      if (step === 5) renderReview();
+      if (step === 5) { checkSlugAvailable(); renderAddrPanel(); }
+      if (step === 6) renderReview();
     }
 
     /* One delegated pair on the rail, so paintRail can add and drop data-goto
@@ -2850,6 +2895,65 @@ summary{min-height:24px;padding:3px 0;}
     });
     paintType(state.projType || null);
 
+    /* ── the OPTIONAL About step (task 1002334) ──
+       Two answers, both skippable. The description is half the publish gate
+       (ADR 0182 D4) and the team shape is what the setup recommendations read;
+       neither gates the standup, and neither is ever guessed on the owner's
+       behalf. paintDetail keeps the consequence visible while they are still on
+       the panel — it flips between "here's what you'll get" and "here's what
+       skipping costs", so pressing Skip is an informed choice rather than a
+       discovery made three screens later. */
+    var TEAM_META = {
+      'solo': 'Just you. We keep the setup light and skip the joining machinery.',
+      'small-team': 'A handful of people you know. We suggest a setup built around invites.',
+      'community': 'Open to whoever turns up. We suggest a setup built for people applying to join.'
+    };
+    function teamLabel(t) {
+      var b = t && root.querySelector('#teamCards .tpill[data-team="' + t + '"]');
+      return b ? b.textContent : '';
+    }
+    function paintTeam(t) {
+      root.querySelectorAll('#teamCards .tpill').forEach(function (b) {
+        b.setAttribute('aria-pressed', String(b.getAttribute('data-team') === t));
+      });
+    }
+    function paintDetail() {
+      var note = $('detailSkipNote');
+      var told = String(state.description || '').trim();
+      var parts = [];
+      if (!told) {
+        parts.push('No description yet — your project still stands up, it just stays off the public map until it has one. You can add it any time from its page.');
+      } else {
+        parts.push('That description is what puts your project on the public map.');
+      }
+      if (state.teamShape && TEAM_META[state.teamShape]) parts.push(TEAM_META[state.teamShape]);
+      note.textContent = parts.join(' ');
+      note.classList.add('on');
+    }
+    $('f-desc').value = state.description || '';
+    $('f-desc').addEventListener('input', function () {
+      state.description = this.value.slice(0, 600);
+      paintDetail();
+      saveDraft();
+    });
+    root.querySelectorAll('#teamCards .tpill').forEach(function (b) {
+      b.addEventListener('click', function () {
+        /* clicking the chosen pill again UNSAYS it — the only way back to "I did
+           not answer", which an optional question has to keep offering */
+        var pick = b.getAttribute('data-team');
+        state.teamShape = state.teamShape === pick ? null : pick;
+        paintTeam(state.teamShape);
+        paintDetail();
+        saveDraft();
+      });
+    });
+    paintTeam(state.teamShape || null);
+    paintDetail();
+    /* Skip = go on with whatever is (or isn't) filled in. It deliberately does
+       NOT erase an answer already given: a visitor who typed a description and
+       then pressed Skip meant "I'm done here", not "throw that away". */
+    $('skipDetail').addEventListener('click', function () { show(4, true); });
+
     /* ── GitHub-integrated repo picker (adopt) + auto-create (fresh) — task 1002099 / ADR 0143.
           Progressive enhancement: probe GET /github/repos once we reach the Home step.
             200 → we hold repo access → show the picker (adopt) / name field (fresh);
@@ -3046,7 +3150,9 @@ summary{min-height:24px;padding:3px 0;}
         }
         return true;
       }
-      if (step === 3) {
+      /* step 3 (About) has no clause: it is the optional one, and Next past an
+         empty answer is the whole point (task 1002334). */
+      if (step === 4) {
         var homeErr = function (msg) { $('h-home').textContent = msg; $('h-home').className = 'hint err'; return false; };
         if (repoAccess === 'need-connect') return homeErr('Allow GitHub repo access to pick or create your repository — or choose “enter it manually”.');
         if (repoAccess === true && state.mode !== 'adopt') {
@@ -3061,7 +3167,7 @@ summary{min-height:24px;padding:3px 0;}
         $('h-home').innerHTML = '&nbsp;'; $('h-home').className = 'hint';
         return true;
       }
-      if (step === 4) {
+      if (step === 5) {
         if (!validSlug(state.slug)) {
           $('h-slug').textContent = '2–40 lowercase letters, numbers, or dashes; no leading/trailing/double dash.';
           $('h-slug').className = 'hint err'; $('f-slug').classList.add('bad');
@@ -3127,6 +3233,13 @@ summary{min-height:24px;padding:3px 0;}
       var rows = [
         ['Project', esc(state.name)],
         ['Type', typeLabel(state.projType) || 'Not declared'],
+        /* the About step is optional, so its row states the CONSEQUENCE of the
+           skip rather than a bare em-dash — the review is the last screen before
+           Create, and "off the map" should never be a surprise (task 1002334) */
+        ['About', String(state.description || '').trim()
+          ? esc(String(state.description).trim())
+          : '<em style="font-weight:600;color:var(--warn)">not said — off the public map until you add it</em>'],
+        ['Who’s building it', teamLabel(state.teamShape) || 'Not said'],
         ['Starting from', state.mode === 'adopt' ? 'A repo you already have' : 'A fresh, empty repo'],
         ['Repository', '<code>' + esc(state.owner + '/' + state.repo) + '</code>'],
         ['Handle', '<code>' + esc(state.slug) + '</code>'],
@@ -3213,6 +3326,11 @@ summary{min-height:24px;padding:3px 0;}
           body: JSON.stringify({
             slug: state.slug,
             type: state.projType || undefined,
+            /* the optional About answers (task 1002334) — omitted when skipped,
+               because absent means SKIPPED and an empty string would read as an
+               answered-but-blank description to the publish gate */
+            description: String(state.description || '').trim() || undefined,
+            detail: state.teamShape ? { team_shape: state.teamShape } : undefined,
             hosting_shape: 'standalone',
             /* ONLY a bring-your-own domain travels (task 1002898 N2). The server owns
                the assigned <slug>.<apex> default (task 1002704) and applies it to an
@@ -3257,7 +3375,7 @@ summary{min-height:24px;padding:3px 0;}
           sessionStorage.removeItem(DRAFT_KEY);
         } catch (e) {}
         renderDone();
-        show(6, true);
+        show(7, true);
         startProgress(data.instance && data.instance.id);
       }).catch(function (err) {
         if (String(err && err.message) === 'signing in') return;
@@ -3265,7 +3383,7 @@ summary{min-height:24px;padding:3px 0;}
         if (err && err.gotoHome) {
           /* A repo-creation problem (name taken / reconnect) — bounce back to the Home
              step with the reason, so the user fixes it where the repo is chosen. */
-          show(3, true);
+          show(4, true);
           $('h-home').textContent = err.homeMsg || 'Please revisit the repository step.';
           $('h-home').className = 'hint err';
           return;
@@ -3799,7 +3917,7 @@ summary{min-height:24px;padding:3px 0;}
                5s tick never clobbers an open dropdown or mid-flight button) */
             if (inst && inst.status !== live.instStatus) {
               live.instStatus = inst.status; renderSteps();
-              if (state.step === 6) paintRail(6);   /* the rail finishes only when the project answers */
+              if (state.step === 7) paintRail(7);   /* the rail finishes only when the project answers */
             }
             var terminal = renderProgress(inst);
             if (!terminal) pollTimer = setTimeout(tick, 5000);
@@ -3836,13 +3954,14 @@ summary{min-height:24px;padding:3px 0;}
         lastStepsHtml = '';
         lastProgHtml = '';
         try { sessionStorage.removeItem(CREATED_KEY); sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
-        state = { step: 1, name: '', projType: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
+        state = { step: 1, name: '', projType: null, description: '', teamShape: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
         $('newName').value = ''; $('f-owner').value = ''; $('f-repo').value = ''; $('f-slug').value = ''; $('f-domain').value = '';
-        $('f-noaddr').checked = false;
+        $('f-noaddr').checked = false; $('f-desc').value = '';
         /* Re-seed the owner from the signed-in account for the next project. */
         if (me && me.github_login) { state.owner = me.github_login; $('f-owner').value = state.owner; }
         $('h-name').innerHTML = '&nbsp;';
         paintType(null);
+        paintTeam(null);
         setMode('greenfield');
         show(1, true);
       });
@@ -3875,7 +3994,7 @@ summary{min-height:24px;padding:3px 0;}
           manifestState = created.manifest_state; manifestPending = true;
         }
         renderDone();
-        show(6, !!focus);
+        show(7, !!focus);
         startProgress(created.id);
         resumePolls();
         return;
@@ -3883,7 +4002,7 @@ summary{min-height:24px;padding:3px 0;}
       /* before identity settles, never render past the name step: deeper steps
          carry authenticated side effects (the Home-step repo probe), and onAuth()
          re-enters to the real draft step the moment /me answers */
-      var step = authKnown && state.step >= 1 && state.step <= 5 ? state.step : 1;
+      var step = authKnown && state.step >= 1 && state.step <= 6 ? state.step : 1;
       if (step === 1) {
         show(1, false);
         if (focus) $('newName').focus();

package/scripts/gds/fitness.js

@@ -494,6 +494,15 @@ const KERNEL_FILES = [
   // and pino, so joining the roster costs nothing and buys the import-direction
   // guarantee on the file every module now logs through.
   'src/bongos/logger.js',                    // pino + request correlation + ADR 0022 redaction
+  // task 1003339 (ADR 0209): the abuse ceiling is a trust primitive in the same
+  // sense the authz gates are — authz says WHO may ask, this says HOW OFTEN, and
+  // an unauthenticated read route has nothing else holding it. src/module-api.js
+  // now hands modules the shared account-existence limiter (the onboarding
+  // module's account-existence probe spends the same budget as core's), so it
+  // sits BELOW the module boundary exactly as logger.js does. It requires NOTHING
+  // — no relative imports at all — so joining the roster costs nothing and buys
+  // the import-direction guarantee on a file two surfaces now trust.
+  'src/bongos/middleware/rate-limit.js',     // the sliding-window abuse ceilings (write + per-surface read)
   'src/bongos/db-kernel.js',                 // the kernel db slice — identity/audit/rank/withTx (BV1.R69)
   'src/bongos/routes/_helpers.js',           // shared request validators the doorway re-exports
   // config / identity (host context a module reads, never hardcodes)

package/scripts/gds/onboard.js

@@ -60,6 +60,23 @@ function buildInitSpec(a = {}) {
 
 function healthzUrl(domain) { return `https://${domain}/healthz`; }
 
+// The optional project-detail step's answers, as the CLI collects them (task
+// 1002334) — the same shape POST /provisioning/instances takes, so the terminal
+// form and the web wizard file identical requests. A blank answer is a SKIP, and a
+// skip is a supported default: the project stands up, it just stays off the map
+// until a description exists (ADR 0182 D4). Off-vocabulary team answers are dropped
+// rather than guessed — the server's normalizeProjectDetail applies the same rule.
+// PURE.
+const TEAM_SHAPES = ['solo', 'small-team', 'community'];
+function buildProjectDetail(a = {}) {
+  const out = {};
+  const told = typeof a.description === 'string' ? a.description.replace(/\s+/g, ' ').trim() : '';
+  if (told) out.description = told;
+  const team = String(a.teamShape || '').trim().toLowerCase();
+  if (TEAM_SHAPES.includes(team)) out.detail = { team_shape: team };
+  return out;
+}
+
 // ── Interactive shell ────────────────────────────────────────────────────────
 
 function ask(rl, q, dflt) {
@@ -90,6 +107,29 @@ async function run() {
     a.slug = await ask(rl, 'Instance slug? (DNS/db-safe, e.g. mercury)');
     a.domain = await ask(rl, 'Domain you own (bring-your-own; blank = the platform assigns <slug>.<its apex> when configured)?');
 
+    // Step 1b — the OPTIONAL project detail (task 1002334). Every form in the
+    // sequence offers it and every owner may skip it: Enter past both questions and
+    // the standup is unaffected. Say what skipping costs BEFORE asking, so the skip
+    // is an informed choice rather than a shrug — a project with no description
+    // stays off the map (ADR 0182 D4) and `bongos` can recommend nothing.
+    log('\nTell us about your project — optional. Press Enter to skip either question.');
+    log('  A description is what puts your project on the map (you can add it later);');
+    log(`  who's building it is what the platform's setup recommendations read.`);
+    a.description = await ask(rl, 'What are you building, in a sentence or two?');
+    a.teamShape = await ask(rl, `Who's building it — ${TEAM_SHAPES.join(' / ')}?`);
+    const detail = buildProjectDetail(a);
+    if (Object.keys(detail).length) {
+      // This CLI prints commands rather than calling the API (the trust boundary),
+      // so it shows the answers as the request fields they are — the SAME body the
+      // web wizard files, which is what keeps the two forms in lockstep.
+      log('  These ride the project\'s provisioning request (POST /provisioning/instances):');
+      log('  ' + JSON.stringify(detail));
+    }
+    if (!detail.description) {
+      log('  → no description. Your project stands up either way; it stays off the public map until it');
+      log('    has one, and you can add it any time (PATCH /provisioning/instances/:id/detail).');
+    }
+
     // Step 2 — human: the GitHub repo (create empty for greenfield; use existing for adopt)
     if (adopt) {
       log('\n① Use your EXISTING GitHub repository:');
@@ -224,4 +264,4 @@ async function run() {
 
 if (require.main === module) run().catch((e) => { console.error('onboard failed:', e && e.message ? e.message : e); process.exit(1); });
 
-module.exports = { onboardPlan, oauthAppInstructions, buildInitSpec, healthzUrl };
+module.exports = { onboardPlan, oauthAppInstructions, buildInitSpec, healthzUrl, buildProjectDetail, TEAM_SHAPES };

package/scripts/gds/provision-net.js

@@ -75,9 +75,13 @@ async function federateInstance(inst, deps) {
     ownerGithubId = rows[0] ? rows[0].github_id : null;
   } catch { /* non-fatal */ }
   await platformIdentity.registerClient(
-    // type: the owner's declaration rides the instance row from the create
-    // wizard (task 1002772) and lands on the catalog row here — never guessed.
-    { clientId, secret: clientSecret, name: inst.slug, redirectUris, origin, ownerGithubId, type: inst.type },
+    // type + description: the owner's answers ride the instance row from the
+    // create form (tasks 1002772 / 1002334) and land on the catalog row here —
+    // never guessed. description is half the publish gate (ADR 0182 D4), so a
+    // project that described itself at creation is publishable the moment it
+    // federates; one that skipped the optional step passes null and stays dark
+    // matter until it fills the answer in.
+    { clientId, secret: clientSecret, name: inst.slug, redirectUris, origin, ownerGithubId, type: inst.type, description: inst.description },
     { pool: db },
   );
   log(`  [federate] registered client '${clientId}' on the hub (origin ${origin})`);