@bongos/core 1.19.419 → 1.19.421

package/public-landing/projects.probes.json

@@ -1,7 +1,8 @@
 {
-  "_": "The hub's interaction contract for modules/ui-design/kit/probe.js (task 1003320): the disclosure bands, the views, the card, the fold under 480, signed out. A probe with `continue` keeps the previous page — the contract is a sequence.",
+  "_": "The hub's interaction contract for modules/ui-design/kit/probe.js (task 1003320): the disclosure bands, the views, the card, the fold under 480, signed out. A probe with `continue` keeps the previous page — the contract is a sequence. The manage flows (task 1003345): attach, restart, teardown (the row and the ender), revive, retry and join drive the stub's receipts end to end, so the makeover cannot silently break a door. The catalog is featured-hub.json (stub.fixtures): the signed-in stub owns Demo, and an owned orb's plain click opens its manage view, never its card — the card probes open the landing's other rows and Tidewater, the un-owned floor row.",
   "page": "/projects",
   "surface": "public-landing",
+  "stub": { "fixtures": { "featured": "featured-hub" } },
   "probes": [
     { "name": "closed: the main content starts under the bar", "auth": true, "width": 1440,
       "steps": [],
@@ -46,7 +47,7 @@
       "steps": [["click", "#menuProfile a[data-nav-to=\"mine\"]"], ["wait", 300]],
       "expect": { "param": { "view": "mine" }, "closed": "#menuProfile", "text": [["[aria-current=\"page\"]", "Your projects"]] } },
     { "name": "an orb opens the card", "continue": true,
-      "steps": [["back"], ["wait", 400], ["dispatchClick", "#orbField a.worldOrb:not(#selfOrb)"], ["wait", 400]],
+      "steps": [["back"], ["wait", 400], ["dispatchClick", "#orbField a.worldOrb:not(#selfOrb):not([data-manage])"], ["wait", 400]],
       "expect": { "dialog": true } },
     { "name": "Escape closes the card when no band is open", "continue": true,
       "steps": [["press", "Escape"], ["wait", 150]],
@@ -59,11 +60,11 @@
                   "text": [["#cardBuilders", "11"], ["#cardShipped", "0"], ["#cardRel", "you build here"], ["#cardRuns", "amazonprimea.com"], ["#cardFaces .facesMore", "+6"], ["#cardHall", "Builders' hall"]],
                   "href": [["#cardHall", "https://builders.amazonprimea.com/"], ["#cardOpen", "https://amazonprimea.com/"]] } },
     { "name": "the ladder: a project that answered nothing is the card that shipped before (disc, name, tagline, address, listed, one door)", "continue": true,
-      "steps": [["press", "Escape"], ["wait", 150], ["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]"], ["wait", 500]],
+      "steps": [["press", "Escape"], ["wait", 150], ["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://tidewater.cloudbongos.com\"]"], ["wait", 500]],
       "expect": { "dialog": true, "hasClass": [["#projCard", "has-art", false]],
                   "hidden": ["#cardArt", "#cardFaces", "#cardFigs", "#cardBuildersFig", "#cardShippedFig", "#cardHall", "#cardRel", "#cardTypeL", "#cardOwnerL"],
                   "visible": ["#cardDot", "#cardName", "#cardTag", "#cardRuns", "#cardListed", "#cardOpen"],
-                  "text": [["#cardRuns", "demo.cloudbongos.com"]] } },
+                  "text": [["#cardRuns", "tidewater.cloudbongos.com"]] } },
     { "name": "the hall door is address-gated: a member of a project whose hall is its own site gets no door; the capped figure reads N+", "continue": true,
       "steps": [["press", "Escape"], ["wait", 150], ["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://emersonian-circles.cloudbongos.com\"]"], ["wait", 500]],
       "expect": { "dialog": true, "hidden": ["#cardArt", "#cardFaces", "#cardHall"], "visible": ["#cardFigs", "#cardBuildersFig", "#cardShippedFig", "#cardOpen"],
@@ -74,7 +75,7 @@
                   "text": [["#cardRel", "yours"]], "href": [["#cardOpen", "/"]] } },
     { "name": "the table: the hall glyph rides the door cell on the one member row whose hall is elsewhere, and on the platform's row", "continue": true,
       "steps": [["press", "Escape"], ["wait", 150], ["click", "#projTrig"], ["wait", 120], ["click", "a[data-sub=\"table\"]"], ["wait", 300]],
-      "expect": { "dialog": false, "visible": ["#selfHall"], "count": [["#mapRows tr[data-generated] .rowHall", 1], ["#mapRows tr[data-generated] td", 18]],
+      "expect": { "dialog": false, "visible": ["#selfHall"], "count": [["#mapRows tr[data-generated] .rowHall", 1], ["#mapRows tr[data-generated] td", 42]],
                   "href": [["#mapRows tr[data-generated] .rowHall", "https://builders.amazonprimea.com/"]] } },
     { "name": "back to the sky for the rest of the sequence", "continue": true,
       "steps": [["click", "#projTrig"], ["wait", 120], ["click", "a[data-sub=\"sky\"]"], ["wait", 300]],
@@ -93,7 +94,7 @@
       "expect": { "count": [["#menuProjects .bandCell:not([hidden])", 3], ["#menuProjects a[href=\"/docs\"]", 0]], "hidden": ["#menuProjects [data-nav=\"mine\"]"],
                   "href": [[".footNav a[href=\"/#about\"]", "/#about"], [".footNav a[href=\"/docs\"]", "/docs"]] } },
     { "name": "signed out: the card still closes on Escape (nothing throws with no session)", "continue": true,
-      "steps": [["press", "Escape"], ["wait", 100], ["dispatchClick", "#orbField a.worldOrb:not(#selfOrb)"], ["wait", 400], ["press", "Escape"], ["wait", 150]],
+      "steps": [["press", "Escape"], ["wait", 100], ["dispatchClick", "#orbField a.worldOrb:not(#selfOrb):not([data-manage])"], ["wait", 400], ["press", "Escape"], ["wait", 150]],
       "expect": { "dialog": false, "closed": "#menuProjects" } },
     { "name": "390: the magnifier opens the row and focuses the field", "auth": true, "width": 390,
       "steps": [["click", "#qToggle"], ["wait", 150]],
@@ -106,6 +107,30 @@
       "expect": { "hasClass": [["#qWrap", "is-open", false]], "open": "#menuProjects", "top": [["#hubMain", 60]] } },
     { "name": "390: a solo Shift tap opens the fold and focuses the field, without overflow", "continue": true,
       "steps": [["press", "Escape"], ["wait", 100], ["press", "Shift"], ["wait", 150]],
-      "expect": { "hasClass": [["#qWrap", "is-open", true]], "activeId": "mapQ", "noOverflow": true } }
+      "expect": { "hasClass": [["#qWrap", "is-open", true]], "activeId": "mapQ", "noOverflow": true } },
+    { "name": "manage flows (task 1003345): the address fold on a live row records a domain", "auth": true, "width": 1440, "url": "/projects?view=mine",
+      "steps": [["wait",600],["click","li[data-inst=\"101\"] details.attachFold summary"],["fill","#dom-101","demo.example.com"],["click","[data-attach=\"101\"]"],["wait",600]],
+      "expect": {"text":[["#msg-101","Address recorded."]],"hasClass":[["#msg-101","ok",true]]} },
+    { "name": "manage flows: restart on an unreachable row asks; the row re-reads the project and shows the queued rail, the door leaves while the intent is open", "auth": true, "width": 1440, "url": "/projects?view=mine",
+      "steps": [["wait",600],["click","[data-restart=\"105\"]"],["wait",900]],
+      "expect": {"text":[["li[data-inst=\"105\"] .strip .pnote","A restart is queued — this card updates when it starts."],["li[data-inst=\"105\"] .strip .stages li.now .slbl","Restart queued"]],"visible":["li[data-inst=\"105\"] .strip","li[data-inst=\"105\"] .worldOrb.ashen"],"hidden":["[data-restart=\"105\"]"]} },
+    { "name": "manage flows: tear it down asks twice on a row — the truth first, then the door", "auth": true, "width": 1440, "url": "/projects?view=mine",
+      "steps": [["wait",600],["click","[data-teardown=\"101\"]"],["wait",200]],
+      "expect": {"visible":["li[data-inst=\"101\"] .confirmRow","[data-teardown-yes=\"101\"]","[data-teardown-no=\"101\"]"],"hidden":["[data-teardown=\"101\"]"]} },
+    { "name": "manage flows: the second press queues the teardown; the row re-reads the project and shows the wind-down rail, the door leaves", "continue": true,
+      "steps": [["click","[data-teardown-yes=\"101\"]"],["wait",900]],
+      "expect": {"text":[["li[data-inst=\"101\"] .strip .pnote","A teardown is queued — this card updates when it starts."]],"visible":["li[data-inst=\"101\"] .strip.flowDown"],"hidden":["[data-teardown=\"101\"]","[data-teardown-yes=\"101\"]"]} },
+    { "name": "manage flows: bring it back on a torn-down row re-files the project", "auth": true, "width": 1440, "url": "/projects?view=mine",
+      "steps": [["wait",600],["click","[data-revive=\"104\"]"],["wait",600]],
+      "expect": {"text":[["#msg-104","Queued. The platform picks it up from here."]],"hasClass":[["#msg-104","ok",true]],"visible":["li[data-inst=\"104\"] .worldOrb.ghost"]} },
+    { "name": "manage flows: try again on a snagged row re-files it too", "auth": true, "width": 1440, "url": "/projects?view=mine",
+      "steps": [["wait",600],["click","[data-retry=\"103\"]"],["wait",600]],
+      "expect": {"text":[["#msg-103","Queued. The platform picks it up from here."]],"hasClass":[["#msg-103","ok",true]]} },
+    { "name": "manage flows: how people join — pick a cell, save, the receipt lands under the choice", "auth": true, "width": 1440, "url": "/projects?view=manage&id=101",
+      "steps": [["wait",900],["check","input[name=\"mJoinPick\"][value=\"apply\"]"],["click","[data-join-save]"],["wait",600]],
+      "expect": {"text":[["#mJoinMsg","Saved. The project restarts to apply it."],["#mName","demo"]],"checked":"input[name=\"mJoinPick\"][value=\"apply\"]","visible":["#mOrb .worldOrb","#mFacts .ledger .k"]} },
+    { "name": "manage flows: the ender asks for the name typed back, queues the teardown, and the page re-reads the project as queued", "auth": true, "width": 1440, "url": "/projects?view=manage&id=105",
+      "steps": [["wait",900],["click","[data-del-ask]"],["wait",200],["fill","#mDelName","mooring"],["wait",100],["click","[data-del-yes]"],["wait",900]],
+      "expect": {"text":[["#mDel .addr","A teardown is queued for this project."],["#mName","mooring"]],"hidden":["#mDelName","[data-del-ask]"],"visible":["#mStrip .strip.flowDown"]} }
   ]
 }

package/public-landing/projects.states.json

@@ -1,28 +1,32 @@
 {
-  "_": "The hub's states for modules/ui-design/kit/render.js (task 1003320): name → url + actions + expectations. `auth` picks the signed-in stub. Rendered dark only at 1440/390/320 (the apex pins data-mode=\"dark\", task 1003336) and audited against the platform floors. The card states (task 1003301) walk the poster's ladder: the full poster, the artless two-up band, the all-null floor, the platform's own card.",
+  "_": "The hub's states for modules/ui-design/kit/render.js (task 1003320): name → url + actions + expectations. `auth` picks the signed-in stub. Rendered dark only at 1440/390/320 (the apex pins data-mode=\"dark\", task 1003336) and audited against the platform floors. The card states (task 1003301) walk the poster's ladder: the full poster, the artless two-up band, the all-null floor, the platform's own card. The signed-in stub OWNS Demo (provisioning-instances.json, task 1003345), and an owned orb's plain click opens its manage view, never its card — so the all-null floor card renders from projects-floor.states.json on the hub's own catalog (featured-hub.json, one un-owned null row more).",
   "page": "/projects",
   "surface": "public-landing",
   "modes": ["dark"],
   "modeQuery": false,
-  "ignoreRequests": ["/api/(gds|bongos)/me$", "/my-projects", "/provisioning/"],
-  "ignoreConsole": ["/api/(gds|bongos)/me", "\\b401\\b", "Unauthorized"],
+  "ignoreRequests": ["/api/(gds|bongos)/me$", "/my-projects", "/provisioning/instances/999", "/provisioning/instances/101$", "/api/gds/instance$"],
+  "ignoreConsole": ["/api/(gds|bongos)/me", "\\b401\\b", "\\b404\\b", "Unauthorized"],
   "ignoreControls": [".skip", ".vh"],
   "states": {
     "out-map": { "auth": false, "expect": { "expanded": false } },
-    "in-map": { "auth": true, "expect": { "expanded": false, "count": [["#orbField .worldOrb[data-shape][data-style]", 4]], "attr": [["#selfOrb", "data-template", "pair-chrome"], ["#orbField a.worldOrb[data-origin=\"https://amazonprimea.com\"]", "data-template", "bead-wash"], ["#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]", "data-shape", "pair"], ["#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]", "data-material", "gold"], ["#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]", "data-template", "pair-gold-wash"], ["#orbField a.worldOrb[data-origin=\"https://emersonian-circles.cloudbongos.com\"]", "data-template", "bead-obsidian-plain"]] } },
+    "in-map": { "auth": true, "expect": { "expanded": false, "count": [["#orbField .worldOrb[data-shape][data-style]", 7]], "attr": [["#selfOrb", "data-template", "pair-chrome"], ["#orbField a.worldOrb[data-origin=\"https://amazonprimea.com\"]", "data-template", "bead-wash"], ["#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]", "data-shape", "pair"], ["#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]", "data-material", "gold"], ["#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]", "data-template", "pair-gold-wash"], ["#orbField a.worldOrb[data-origin=\"https://emersonian-circles.cloudbongos.com\"]", "data-template", "bead-obsidian-plain"]] } },
     "in-map-projects": { "auth": true, "actions": [["click", "#projTrig"], ["wait", 350]], "expect": { "expanded": true, "open": "#menuProjects" } },
     "in-map-profile": { "auth": true, "actions": [["click", "#who"], ["wait", 350]], "expect": { "expanded": true, "open": "#menuProfile" } },
     "in-map-kbd": { "auth": true, "actions": [["focus", "#projTrig"], ["press", "Enter"], ["wait", 350], ["press", "ArrowDown"], ["wait", 120]], "expect": { "expanded": true, "activeText": "Table" } },
     "in-map-search": { "auth": true, "actions": [["clickIfVisible", "#qToggle"], ["wait", 200], ["fill", "#mapQ", "emer"], ["wait", 300]], "expect": { "value": [["#mapQ", "emer"]] } },
     "in-map-mine-on": { "auth": true, "actions": [["check", "#onlyMine"], ["wait", 300]], "expect": { "checked": "#onlyMine" } },
     "in-table": { "auth": true, "actions": [["click", "#projTrig"], ["wait", 250], ["click", "a[data-sub=\"table\"]"], ["wait", 400]], "expect": { "visible": ["#sub-table-body", ".tblMast", ".mastObj", "#selfHall"], "closed": "#menuProjects", "count": [["#mapRows tr[data-generated] .rowHall", 1]] } },
-    "in-mine": { "auth": true, "url": "/projects?view=mine", "expect": { "hidden": ["#qWrap"] } },
+    "in-mine": { "auth": true, "url": "/projects?view=mine", "expect": { "hidden": ["#qWrap", "#empty"], "visible": ["#mineBar", "#projectsList", "#projectsList .proj .worldOrb .disc"], "count": [["#projectsList .proj", 5], ["#projectsList .proj.gone", 1], ["#projectsList .proj .worldOrb[data-shape][data-material][data-style]", 5], ["#projectsList .proj .strip", 1], ["#projectsList .proj .worldOrb.ashen", 2], ["#projectsList [data-restart]", 1]] } },
+    "in-manage": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mMain", "#mChip .chip", "#mOrb .worldOrb", "#mFacts .ledger .k", "#mActs"], "hidden": ["#qWrap", "#mGate", "#mMissing", "#mErr"], "text": [["#mName", "demo"], ["#mTitle", "demo"]] } },
+    "in-manage-snag": { "auth": true, "url": "/projects?view=manage&id=103", "expect": { "visible": ["#mMain", "#mErr", "#mActs"], "text": [["#mName", "tidepool"]] } },
+    "in-manage-gone": { "auth": true, "url": "/projects?view=manage&id=104", "expect": { "visible": ["#mMain", "#mActs"], "hidden": ["#mErr"], "text": [["#mName", "old-lantern"]] } },
+    "in-manage-missing": { "auth": true, "url": "/projects?view=manage&id=999", "expect": { "visible": ["#mMissing"], "hidden": ["#mMain", "#mGate"] } },
+    "out-manage": { "auth": false, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mGate"], "hidden": ["#mMain", "#mMissing"] } },
     "in-new": { "auth": true, "url": "/projects?view=new", "expect": { "hidden": ["#qWrap"] } },
     "out-new": { "auth": false, "url": "/projects?view=new", "expect": { "hidden": ["#qWrap"] } },
     "out-map-projects": { "auth": false, "actions": [["click", "#projTrig"], ["wait", 350]], "expect": { "expanded": true, "hidden": ["#menuProjects [data-nav=\"mine\"]"] } },
     "card": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://amazonprimea.com\"]"], ["wait", 900]], "expect": { "dialog": true, "hasClass": [["#projCard", "has-art"]], "visible": ["#cardArt", "#cardFaces", "#cardBuildersFig", "#cardShippedFig", "#cardOpen", "#cardHall"], "text": [["#cardBuilders", "11"], ["#cardShipped", "0"], ["#cardRel", "you build here"], ["#cardRuns", "amazonprimea.com"], ["#cardFaces .facesMore", "+6"]], "count": [["#cardFaces img", 5]], "href": [["#cardHall", "https://builders.amazonprimea.com/"]] } },
     "card-noart": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://emersonian-circles.cloudbongos.com\"]"], ["wait", 600]], "expect": { "dialog": true, "hasClass": [["#projCard", "has-art", false]], "hidden": ["#cardArt", "#cardFaces", "#cardHall"], "visible": ["#cardBuildersFig", "#cardShippedFig", "#cardOpen"], "text": [["#cardShipped", "30+"], ["#cardRel", "you build here"]] } },
-    "card-floor": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]"], ["wait", 600]], "expect": { "dialog": true, "hidden": ["#cardArt", "#cardFaces", "#cardFigs", "#cardHall", "#cardRel", "#cardTypeL", "#cardOwnerL"], "visible": ["#cardOpen", "#cardRuns", "#cardListed"] } },
     "card-self": { "auth": true, "actions": [["dispatchClick", "#selfOrb"], ["wait", 600]], "expect": { "dialog": true, "hidden": ["#cardArt"], "visible": ["#cardBuildersFig", "#cardShippedFig", "#cardFaces", "#cardOpen", "#cardHall"], "text": [["#cardRel", "yours"]] } }
   },
   "reducedMotion": { "auth": true, "actions": [["click", "#projTrig"], ["wait", 100]] }

package/scripts/gds/fitness.js

@@ -494,6 +494,15 @@ const KERNEL_FILES = [
   // and pino, so joining the roster costs nothing and buys the import-direction
   // guarantee on the file every module now logs through.
   'src/bongos/logger.js',                    // pino + request correlation + ADR 0022 redaction
+  // task 1003339 (ADR 0209): the abuse ceiling is a trust primitive in the same
+  // sense the authz gates are — authz says WHO may ask, this says HOW OFTEN, and
+  // an unauthenticated read route has nothing else holding it. src/module-api.js
+  // now hands modules the shared account-existence limiter (the onboarding
+  // module's account-existence probe spends the same budget as core's), so it
+  // sits BELOW the module boundary exactly as logger.js does. It requires NOTHING
+  // — no relative imports at all — so joining the roster costs nothing and buys
+  // the import-direction guarantee on a file two surfaces now trust.
+  'src/bongos/middleware/rate-limit.js',     // the sliding-window abuse ceilings (write + per-surface read)
   'src/bongos/db-kernel.js',                 // the kernel db slice — identity/audit/rank/withTx (BV1.R69)
   'src/bongos/routes/_helpers.js',           // shared request validators the doorway re-exports
   // config / identity (host context a module reads, never hardcodes)

package/scripts/gds/onboard.js

@@ -60,6 +60,23 @@ function buildInitSpec(a = {}) {
 
 function healthzUrl(domain) { return `https://${domain}/healthz`; }
 
+// The optional project-detail step's answers, as the CLI collects them (task
+// 1002334) — the same shape POST /provisioning/instances takes, so the terminal
+// form and the web wizard file identical requests. A blank answer is a SKIP, and a
+// skip is a supported default: the project stands up, it just stays off the map
+// until a description exists (ADR 0182 D4). Off-vocabulary team answers are dropped
+// rather than guessed — the server's normalizeProjectDetail applies the same rule.
+// PURE.
+const TEAM_SHAPES = ['solo', 'small-team', 'community'];
+function buildProjectDetail(a = {}) {
+  const out = {};
+  const told = typeof a.description === 'string' ? a.description.replace(/\s+/g, ' ').trim() : '';
+  if (told) out.description = told;
+  const team = String(a.teamShape || '').trim().toLowerCase();
+  if (TEAM_SHAPES.includes(team)) out.detail = { team_shape: team };
+  return out;
+}
+
 // ── Interactive shell ────────────────────────────────────────────────────────
 
 function ask(rl, q, dflt) {
@@ -90,6 +107,29 @@ async function run() {
     a.slug = await ask(rl, 'Instance slug? (DNS/db-safe, e.g. mercury)');
     a.domain = await ask(rl, 'Domain you own (bring-your-own; blank = the platform assigns <slug>.<its apex> when configured)?');
 
+    // Step 1b — the OPTIONAL project detail (task 1002334). Every form in the
+    // sequence offers it and every owner may skip it: Enter past both questions and
+    // the standup is unaffected. Say what skipping costs BEFORE asking, so the skip
+    // is an informed choice rather than a shrug — a project with no description
+    // stays off the map (ADR 0182 D4) and `bongos` can recommend nothing.
+    log('\nTell us about your project — optional. Press Enter to skip either question.');
+    log('  A description is what puts your project on the map (you can add it later);');
+    log(`  who's building it is what the platform's setup recommendations read.`);
+    a.description = await ask(rl, 'What are you building, in a sentence or two?');
+    a.teamShape = await ask(rl, `Who's building it — ${TEAM_SHAPES.join(' / ')}?`);
+    const detail = buildProjectDetail(a);
+    if (Object.keys(detail).length) {
+      // This CLI prints commands rather than calling the API (the trust boundary),
+      // so it shows the answers as the request fields they are — the SAME body the
+      // web wizard files, which is what keeps the two forms in lockstep.
+      log('  These ride the project\'s provisioning request (POST /provisioning/instances):');
+      log('  ' + JSON.stringify(detail));
+    }
+    if (!detail.description) {
+      log('  → no description. Your project stands up either way; it stays off the public map until it');
+      log('    has one, and you can add it any time (PATCH /provisioning/instances/:id/detail).');
+    }
+
     // Step 2 — human: the GitHub repo (create empty for greenfield; use existing for adopt)
     if (adopt) {
       log('\n① Use your EXISTING GitHub repository:');
@@ -224,4 +264,4 @@ async function run() {
 
 if (require.main === module) run().catch((e) => { console.error('onboard failed:', e && e.message ? e.message : e); process.exit(1); });
 
-module.exports = { onboardPlan, oauthAppInstructions, buildInitSpec, healthzUrl };
+module.exports = { onboardPlan, oauthAppInstructions, buildInitSpec, healthzUrl, buildProjectDetail, TEAM_SHAPES };

package/scripts/gds/provision-net.js

@@ -75,9 +75,13 @@ async function federateInstance(inst, deps) {
     ownerGithubId = rows[0] ? rows[0].github_id : null;
   } catch { /* non-fatal */ }
   await platformIdentity.registerClient(
-    // type: the owner's declaration rides the instance row from the create
-    // wizard (task 1002772) and lands on the catalog row here — never guessed.
-    { clientId, secret: clientSecret, name: inst.slug, redirectUris, origin, ownerGithubId, type: inst.type },
+    // type + description: the owner's answers ride the instance row from the
+    // create form (tasks 1002772 / 1002334) and land on the catalog row here —
+    // never guessed. description is half the publish gate (ADR 0182 D4), so a
+    // project that described itself at creation is publishable the moment it
+    // federates; one that skipped the optional step passes null and stays dark
+    // matter until it fills the answer in.
+    { clientId, secret: clientSecret, name: inst.slug, redirectUris, origin, ownerGithubId, type: inst.type, description: inst.description },
     { pool: db },
   );
   log(`  [federate] registered client '${clientId}' on the hub (origin ${origin})`);

package/src/bongos/middleware/rate-limit.js

@@ -1,7 +1,9 @@
 // src/bongos/middleware/rate-limit.js — V3.R34 (#255).
 //
-// Two sliding-window in-memory limiters that protect write methods on
-// /api/gds/*. Read methods (GET, HEAD, OPTIONS) bypass entirely.
+// Four sliding-window in-memory limiters. The first two are the GLOBAL pair and
+// protect write methods on /api/gds/* only — read methods (GET, HEAD, OPTIONS)
+// bypass them entirely; #3 and #4 are mounted per-surface to close exactly that
+// gap where an unauthenticated READ is itself the abuse.
 //
 //   1. Per-IP limiter      — 30 writes / 60s. Anchors on req.ip (which honors
 //                            'trust proxy' in server.js so Cloudflare's
@@ -32,6 +34,22 @@
 //                            server.js sets 'trust proxy', so req.ip is the end
 //                            user, not Cloudflare's single origin IP.
 //
+//   4. Account-existence limiter — 120 reads / 60s per IP, spent from ONE bucket
+//                            by BOTH routes that answer "does this GitHub login
+//                            have an account here?": the onboarding module's
+//                            GET /access-requests/status (the richer
+//                            member|invited|pending|dismissed|none) and core's
+//                            GET /auth/web/admission-status (its boolean twin).
+//                            Task 1003339 / ADR 0209. They are ONE oracle read
+//                            two ways, so they share one budget — give each its
+//                            own and an enumerator just alternates between them
+//                            for double the rate. Both are unauthenticated by
+//                            design (a would-be builder is outside the system),
+//                            so the per-IP budget is the only ceiling there is.
+//                            120/min clears the honest pollers with wide margin —
+//                            the access-pending page polls every 3s (20/min) —
+//                            while capping a scraper at ~2 logins/s.
+//
 // Any limiter tripping → 429 with Retry-After (seconds rounded up to the
 // nearest whole second). Audit middleware still fires on a write 429 — the row
 // in audit_log is forensic value for "who tried too hard." (Reads are never
@@ -54,11 +72,16 @@ const PER_SESSION_WINDOW_MS = 60 * 1000;
 const PER_SESSION_LIMIT     = 60;
 const PUBLIC_READ_WINDOW_MS = 60 * 1000;
 const PUBLIC_READ_LIMIT     = 120;
+const ACCOUNT_EXISTENCE_WINDOW_MS = 60 * 1000;
+const ACCOUNT_EXISTENCE_LIMIT     = 120;
 const SWEEP_MS              = 5 * 60 * 1000;
 
 const ipBuckets         = new Map();
 const sessionBuckets    = new Map();
 const publicReadBuckets = new Map();
+// ONE bucket map for limiter #4 — both account-existence probes key into it, so
+// the budget is genuinely shared rather than merely identically configured.
+const accountExistenceBuckets = new Map();
 
 const WRITE_METHODS = new Set(['POST', 'PATCH', 'PUT', 'DELETE']);
 // HEAD is metered too: Express runs the GET handler (incl. the DB query) for a
@@ -105,6 +128,10 @@ function sweep() {
     pruneAndCount(arr, now, PUBLIC_READ_WINDOW_MS);
     if (arr.length === 0) publicReadBuckets.delete(k);
   }
+  for (const [k, arr] of accountExistenceBuckets) {
+    pruneAndCount(arr, now, ACCOUNT_EXISTENCE_WINDOW_MS);
+    if (arr.length === 0) accountExistenceBuckets.delete(k);
+  }
 }
 
 // Schedule the sweep. unref() so it doesn't keep the process alive during
@@ -182,9 +209,46 @@ function publicReadRateLimitMiddleware(req, res, next) {
   next();
 }
 
+// perIpSlidingWindow(buckets, opts) — build a per-IP sliding-window middleware
+// over the given bucket map. Exists so a second route can spend from the SAME
+// budget as the first simply by mounting the same returned function; `scope`
+// names that budget in the 429 body + headers so a caller can tell which ceiling
+// it hit. Keyed on req.ip — the same real-client-IP resolution the write limiter
+// uses (Caddy forwards the client IP, server sets 'trust proxy').
+function perIpSlidingWindow(buckets, { limit, windowMs, scope }) {
+  return function slidingWindowRateLimit(req, res, next) {
+    const now = Date.now();
+    const ip = req.ip || req.socket?.remoteAddress || 'unknown';
+    let bucket = buckets.get(ip);
+    if (!bucket) { bucket = []; buckets.set(ip, bucket); }
+    if (pruneAndCount(bucket, now, windowMs) >= limit) {
+      const retryAfter = Math.max(1, Math.ceil((bucket[0] + windowMs - now) / 1000));
+      res.set('Retry-After', String(retryAfter));
+      res.set('X-RateLimit-Scope', scope);
+      res.set('X-RateLimit-Limit', String(limit));
+      res.set('X-RateLimit-Window-Seconds', String(windowMs / 1000));
+      return res.fail('rate_limited', 429, { scope, retry_after_seconds: retryAfter });
+    }
+    bucket.push(now);
+    return next();
+  };
+}
+
+// accountExistenceReadRateLimit — limiter #4 in the header. ONE instance, mounted
+// on both account-existence probes (core /auth/web/admission-status and the
+// onboarding module's /access-requests/status, which reaches it through the
+// doorway). Mounting the same function on both is what makes the budget shared:
+// exhausting it on either route closes the other for the rest of the window.
+const accountExistenceReadRateLimit = perIpSlidingWindow(accountExistenceBuckets, {
+  limit: ACCOUNT_EXISTENCE_LIMIT,
+  windowMs: ACCOUNT_EXISTENCE_WINDOW_MS,
+  scope: 'account-existence',
+});
+
 module.exports = {
   rateLimitMiddleware,
   publicReadRateLimitMiddleware,
+  accountExistenceReadRateLimit,
   // exported for tests + the security-baseline-check script
   PER_IP_WINDOW_MS,
   PER_IP_LIMIT,
@@ -192,4 +256,6 @@ module.exports = {
   PER_SESSION_LIMIT,
   PUBLIC_READ_WINDOW_MS,
   PUBLIC_READ_LIMIT,
+  ACCOUNT_EXISTENCE_WINDOW_MS,
+  ACCOUNT_EXISTENCE_LIMIT,
 };

package/src/bongos/routes/auth.js

@@ -34,6 +34,7 @@ const { reportActivityRollupForShippedTask } = require('../auth-admission.js');
 const db = require('../db');
 const { pairStore } = require('../app-pair');
 const { publicOrigin, parseCookie, validateOrRespond } = require('./_helpers');
+const { accountExistenceReadRateLimit } = require('../middleware/rate-limit');
 const { branding } = require('../../branding');
 const seams = require('../../module-seams');
 // task 1003208: structured logging — was console.*. A core file logs through
@@ -564,23 +565,29 @@ module.exports = function buildAuthRouter() {
   // NOT make it non-enumerable: with open enrollment off, and for any login
   // that is not the configured firstAdmin, `admitted:true` means that login is
   // a member or has been invited. That reveals account existence to an
-  // unauthenticated caller. It is also NOT throttled — rateLimitMiddleware
-  // returns early for non-write methods, so GETs bypass it entirely; the page's
-  // 3s poll bounds the honest client, not an attacker.
+  // unauthenticated caller.
   //
-  // Why it is nonetheless not a new exposure: the onboarding module's
-  // GET /access-requests/status?github_login=X is ALREADY public and returns
-  // the strictly richer member|invited|pending|dismissed|none plus its own
-  // `admitted`. Anything derivable here is already derivable there, so this
-  // adds no net-new surface — and hardening only this route would accomplish
-  // nothing while that one stays open. Whether unauthenticated login-existence
-  // probing is acceptable at all is a real question, but it belongs to both
-  // routes together, not to a comment here.
+  // IT IS NOW THROTTLED (task 1003339 / ADR 0209). It used to say "NOT
+  // throttled" here, and that was true: rateLimitMiddleware returns early for
+  // non-write methods, so GETs bypassed it entirely and the page's 3s poll
+  // bounded the honest client, not an attacker. accountExistenceReadRateLimit
+  // below is the ceiling — 120 reads/60s per IP, and the SAME instance is
+  // mounted on the onboarding module's GET /access-requests/status, which is
+  // this route's strictly richer twin (member|invited|pending|dismissed|none
+  // plus its own `admitted`). One budget across both, because they are one
+  // oracle: hardening either alone would accomplish nothing, and giving each its
+  // own budget would just let an enumerator alternate for double the rate.
+  //
+  // WHAT IS STILL OPEN and is deliberately NOT decided here: whether the answer
+  // itself should collapse, so a caller who is not the subject cannot tell
+  // pending/dismissed/none apart from a bare "not admitted". That changes what a
+  // real invited user sees during onboarding, so it is the owner's call — filed
+  // as a blocker against task 1003339, not settled by a comment in this file.
   //
   // That endpoint is also why this one exists: it models neither the firstAdmin
   // bypass nor open enrollment, so it reports the OWNER as 'none' forever —
   // the exact case this page has to resolve.
-  router.get('/auth/web/admission-status', async (req, res) => {
+  router.get('/auth/web/admission-status', accountExistenceReadRateLimit, async (req, res) => {
     const login = typeof req.query.login === 'string' ? req.query.login.slice(0, 100) : '';
     if (!login) return res.json({ admitted: false });
     try {

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.419'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.421'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -131,6 +131,18 @@ module.exports = {
   // The ladder as the canonical 1-based rank → tier map (BV1.R108) — modules
   // derive tier comparisons from this instead of hand-copying the map.
   get RANK_TIER() { return require('./bongos/db-kernel').RANK_TIER; },
+  // accountExistenceReadRateLimit — the SHARED per-IP budget (120 reads/60s)
+  //     spent by every route that answers "does this login have an account
+  //     here?". A kernel trust primitive in the same sense the authz gates are:
+  //     the abuse ceiling on an unauthenticated read. It is one MIDDLEWARE
+  //     INSTANCE, not a factory, on purpose — core's /auth/web/admission-status
+  //     and the onboarding module's richer /access-requests/status are one
+  //     oracle read two ways, so they must spend from one bucket or an
+  //     enumerator alternates between them for double the rate (task 1003339,
+  //     ADR 0209). Vendoring a second copy in a module is the failure this
+  //     export exists to prevent.
+  accountExistenceReadRateLimit: require('./bongos/middleware/rate-limit').accountExistenceReadRateLimit,
+
   // --- per-builder secrets at rest (AES-256-GCM box) — a kernel trust
   //     primitive; the full secretBox object is exposed so a module can call
   //     isConfigured/encrypt/decrypt/provisionMasterKey without reaching core.