@bongos/core 1.19.420 → 1.19.422

package/modules/platform-identity/account-visibility.js

@@ -14,10 +14,37 @@
 // already at the file-size ratchet. So the definition lands here, alone and
 // tiny, and 1002967 ADOPTS it rather than writing a second one.
 //
-// WHAT IT IS NOT. Not a rollup gate: hide_stats suppresses NUMBERS, not
-// existence, and is applied by the rollup readers (ADR 0171 D2), never here.
+// THREE AXES, THREE ANSWERS, ONE HOME (task 1002967 adopting this file). The
+// axes stay independent — conflating them is the trap the privacy spec D1/D2
+// exists to prevent — but every EFFECTIVE answer derived from them lives here,
+// because an answer that lives anywhere else is a second variant waiting to
+// drift:
+//
+//   accountVisibleSql / isAccountVisible   EXISTENCE  — may the world see that
+//       this account exists? Every PUBLIC read floors on this.
+//   accountActiveSql / isAccountActive     CONSENT    — active, without the
+//       existence axis. The OWN-SCOPE floor (ADR 0202 D4 §2): a private account
+//       is still a real participant in its own scope.
+//   rollupVisibleSql / isRollupVisible     NUMBERS    — visible AND NOT
+//       hide_stats. ADR 0171 D2's predicate EXTENDED with the existence axis,
+//       and COMPOSED from accountVisibleSql rather than restated.
+//   isRecruiterDiscoverable                REACH      — the COALESCE, privacy
+//       spec D1. A reach predicate only: it never buys addressability.
+//
+// The rollup pair was originally left to "the rollup readers" to apply. Task
+// 1002967 moved it here for the reason this file exists: there are two such
+// readers (listScoutingRollup and getPublicProfileExtras), so leaving them to
+// spell `AND NOT hide_stats` themselves is exactly the second-variant problem,
+// one level down. hide_stats still suppresses NUMBERS and never existence —
+// that is why it appears in rollupVisibleSql and in nothing above it.
+//
 // Not authority: an account being visible confers nothing (ADR 0016).
 //
+// tests/effective_visibility_predicate.mjs enforces that this file is the ONLY
+// first-party server file allowed to compare these columns to a literal, and
+// that every SELECT on platform_identity_accounts either joins one of these
+// predicates or is declared non-public with a reason.
+//
 // Fail-closed: a missing/absent account row is invisible, never visible
 // (ADR 0192 §6 / ADR 0194 §2).
 'use strict';
@@ -55,4 +82,68 @@ function accountActiveSql(alias) {
   return `(${alias ? `${alias}.` : ''}profile_state = 'active')`;
 }
 
-module.exports = { isAccountVisible, accountVisibleSql, accountActiveSql };
+// The JS twin of accountActiveSql, for an own-scope reader that already holds
+// the row (routes/connections.js). Fail-closed, same as isAccountVisible.
+function isAccountActive(account) {
+  return !!account && account.profile_state === 'active';
+}
+
+// -------------------------------------------------------------------------
+// The rollup axis: visible AND not hidden (task 1002967 — ADR 0171 D2 extended)
+// -------------------------------------------------------------------------
+
+// The predicate the two ROLLUP readers join — listScoutingRollup (/people,
+// /scouting) and getPublicProfileExtras (the platform-identity.hub port behind
+// core GET /builders/:id/profile). COMPOSED from accountVisibleSql, never
+// restated, so changing what "visible" means moves this with it.
+function rollupVisibleSql(alias) {
+  if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
+    throw new Error('rollupVisibleSql: alias must be a bare SQL identifier');
+  }
+  return `(${accountVisibleSql(alias)} AND NOT ${alias ? `${alias}.` : ''}hide_stats)`;
+}
+
+// The JS twin of rollupVisibleSql, for a reader that already holds the row.
+function isRollupVisible(account) {
+  return isAccountVisible(account) && !account.hide_stats;
+}
+
+// -------------------------------------------------------------------------
+// The reach axis: recruiting discoverability (privacy spec D1)
+// -------------------------------------------------------------------------
+
+// The two stored values of account_visibility. Mirrors the CHECK in
+// migrations/platform_identity_012_account_privacy.sql.
+const ACCOUNT_VISIBILITY = ['public', 'private'];
+
+// isRecruiterDiscoverable(account) — THE effective-recruiter-reach predicate.
+// The JS twin of COALESCE(recruiter_discoverable, account_visibility='public');
+// nothing else may spell that COALESCE out. Moved here from platform-identity.js
+// by task 1002967 so all three effective answers share one home.
+//
+// The tri-state is the point: NULL = follow visibility (opt-OUT for a public
+// account, opt-IN for a private one), an explicit boolean overrides — an
+// explicit true on a PRIVATE account is exactly the privacy spec's D2
+// "private, discoverable" row, which the D3 recruiter sliver exists to serve.
+//
+// NOT a complete gate, and NEVER addressability: profile_state='active' still
+// floors every recruiter surface, hide_stats still empties the sliver to
+// name-only, and a discoverable private account is still absent from every
+// public read. Fail-closed on a missing account.
+function isRecruiterDiscoverable(account) {
+  if (!account) return false;
+  const explicit = account.recruiter_discoverable;
+  if (typeof explicit === 'boolean') return explicit;
+  return account.account_visibility === 'public';
+}
+
+module.exports = {
+  isAccountVisible,
+  accountVisibleSql,
+  accountActiveSql,
+  isAccountActive,
+  rollupVisibleSql,
+  isRollupVisible,
+  ACCOUNT_VISIBILITY,
+  isRecruiterDiscoverable,
+};

package/modules/platform-identity/platform-identity.js

@@ -14,8 +14,13 @@
 
 const crypto = require('node:crypto');
 const api = require('../../src/module-api');
+// THE effective-visibility predicate (task 1002967, adopting the file ADR 0202
+// D4 named). Every public read below joins it from here; nothing in this file
+// re-derives one (see account-visibility.js).
+const visibility = require('./account-visibility');
 
 const { pool: defaultPool } = api;
+const { ACCOUNT_VISIBILITY, accountVisibleSql, rollupVisibleSql, isRollupVisible } = visibility;
 
 // Default authorization-code lifetime — deliberately short (~60s). A code is a
 // bearer secret that travels through the browser; a tight TTL bounds the replay
@@ -717,11 +722,15 @@ async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped =
 // disciplines union is computed separately in `disc`. Proven against real SQL by
 // tests/scouting_rollup_fanout.mjs.
 //
-// Consent by construction (ADR 0171 D2/D3): only builders whose account is
-// profile_state='active' AND NOT hide_stats appear — /people and /scouting are
-// live cross-project surfaces, so the predicate lives IN the query, not in any
-// caller's memory. Provisional (no hub-session consent) and hidden builders drop
-// out entirely; the projection stays an explicit whitelist (no raw-row spread).
+// Consent by construction (ADR 0171 D2/D3, extended by task 1002967): only
+// builders whose account passes rollupVisibleSql — active, publicly visible, not
+// hidden — appear. /people and /scouting are live cross-project surfaces, so the
+// predicate lives IN the query, not in any caller's memory, and it is the SHARED
+// one so this list can never disagree with /profiles/:handle about who is
+// visible. Provisional, private and hidden builders drop out entirely; the
+// projection stays an explicit whitelist (no raw-row spread). A private account
+// that is recruiter-discoverable is absent here on purpose: the full rollup is
+// never its disclosure — the D3 sliver is (a separate authorization-scoped port).
 async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `WITH agg AS (
@@ -735,8 +744,7 @@ async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
         WHERE EXISTS (
                 SELECT 1 FROM platform_identity_accounts pa
                  WHERE pa.github_id = a.github_id
-                   AND pa.profile_state = 'active'
-                   AND NOT pa.hide_stats)
+                   AND ${rollupVisibleSql('pa')})
         GROUP BY a.github_id
      ), disc AS (
        SELECT x.github_id, array_agg(DISTINCT x.d) AS disciplines
@@ -840,20 +848,21 @@ async function getRollupForBuilder(githubId, { pool = defaultPool } = {}) {
   };
 }
 
-// The PUBLIC read behind the 'platform-identity.hub' port (ADR 0171 D1/D2):
-// null unless the account exists, consented (profile_state='active') and is not
-// hidden (hide_stats) — the fail-closed rule every public surface inherits by
-// construction. A null is deliberately indistinguishable between "no account",
-// "provisional" and "hidden" (no partial numbers; a count plus a hidden total is
-// a leak by subtraction).
+// The PUBLIC read behind the 'platform-identity.hub' port (ADR 0171 D1/D2,
+// extended by task 1002967): null unless the account passes the SHARED rollup
+// predicate — exists, consented (profile_state='active'), publicly visible
+// (account_visibility='public') and not hidden (hide_stats). The fail-closed
+// rule every public surface inherits by construction. A null is deliberately
+// indistinguishable between "no account", "provisional", "private" and "hidden"
+// (no partial numbers; a count plus a hidden total is a leak by subtraction).
 async function getPublicProfileExtras(githubId, { pool = defaultPool } = {}) {
   if (!isNumericGithubId(githubId)) return null;
   const { rows } = await pool.query(
-    `SELECT profile_state, hide_stats FROM platform_identity_accounts WHERE github_id = $1`,
+    `SELECT profile_state, account_visibility, hide_stats
+       FROM platform_identity_accounts WHERE github_id = $1`,
     [githubId],
   );
-  const acct = rows[0];
-  if (!acct || acct.profile_state !== 'active' || acct.hide_stats) return null;
+  if (!isRollupVisible(rows[0])) return null;
   return getRollupForBuilder(githubId, { pool });
 }
 
@@ -920,32 +929,10 @@ async function setAccountHideStats({ githubId, githubLogin, displayName, avatarU
 // Account privacy: visibility + recruiter reach (task 1002966 — privacy spec D1)
 // -------------------------------------------------------------------------
 
-// The two stored values of account_visibility (spec D1's EXISTENCE axis).
-// 'private' means the public profile read 404s to everyone — including the
-// owner, who reaches their own page through the own-scope side door instead.
-const ACCOUNT_VISIBILITY = ['public', 'private'];
-
-// isRecruiterDiscoverable(account) — THE effective-recruiter-reach predicate
-// (privacy spec D1). One definition, so every reader answers "may a recruiting
-// surface see this account at all?" the same way; task 1002967 adopts this
-// rather than re-deriving it, and nothing else should spell the COALESCE out.
-//
-// The JS twin of  COALESCE(recruiter_discoverable, account_visibility='public').
-// The tri-state is the point: NULL = follow visibility (opt-OUT for a public
-// account, opt-IN for a private one), an explicit boolean overrides — an
-// explicit true on a PRIVATE account is exactly the spec's D2 "private,
-// discoverable" row, which is what the recruiter sliver exists to serve.
-//
-// NOT a complete gate on its own. profile_state='active' still floors every
-// recruiter surface (a provisional account is never visible), and hide_stats
-// still empties the sliver down to name-only — both stay the caller's to apply.
-// Fail-closed on a missing/absent account.
-function isRecruiterDiscoverable(account) {
-  if (!account) return false;
-  const explicit = account.recruiter_discoverable;
-  if (typeof explicit === 'boolean') return explicit;
-  return account.account_visibility === 'public';
-}
+// ACCOUNT_VISIBILITY and isRecruiterDiscoverable moved to ./account-visibility.js
+// (task 1002967) — every effective-visibility answer now has ONE home, beside
+// the predicate the public reads join. They are re-exported below, so `pi.`
+// callers are unchanged.
 
 // The own-scoped privacy WRITE (task 1002966) — callers key this by the
 // AUTHENTICATED session's github_id, never a caller-named one. Validates here,
@@ -1123,10 +1110,18 @@ async function setAccountHandle({ githubId, handle }, { pool = defaultPool } = {
 // resolution). Case-insensitive. An exact current-handle match always wins;
 // otherwise the single-slot previous_handle matches and answers a move to the
 // current handle (the 301 window from P01). Only publicly addressable accounts
-// resolve (profile_state = 'active', ADR 0171 D3) — provisional and unknown are
-// the same null (the 404, indistinguishable by design). hide_stats deliberately
-// does NOT gate resolution: hiding removes the rollup, not the page (D2 —
-// addressability and hide are different invariants).
+// resolve — the SHARED accountVisibleSql predicate (task 1002967), so this is
+// the same "visible" every other public read uses. Provisional, PRIVATE and
+// unknown are all the same null: the 404 the privacy spec D2 requires, and it is
+// a 404 to EVERYONE INCLUDING THE OWNER, because this function takes no viewer
+// and therefore cannot vary by one (public responses stay viewer-independent,
+// ADR 0171 D4). An owner reaches their own private page through the own-scope
+// side door instead (GET /me/cross-project → getOwnProfileExtras) — the page
+// composition varies, the public response never does. A 403 is deliberately
+// never returned: it would confirm the handle exists.
+// hide_stats deliberately does NOT gate resolution: hiding removes the rollup,
+// not the page (D2 — addressability and hide are different invariants), which is
+// exactly why accountVisibleSql and rollupVisibleSql are two predicates.
 // Returns null | { moved_to } | { account: { github_id, github_login,
 // display_name, avatar_url, handle, created_at } }.
 async function resolveHandle(handle, { pool = defaultPool } = {}) {
@@ -1136,7 +1131,7 @@ async function resolveHandle(handle, { pool = defaultPool } = {}) {
     `SELECT github_id, github_login, display_name, avatar_url, handle, bio, links, created_at,
             (lower(handle) = $1) AS is_current
        FROM platform_identity_accounts
-      WHERE profile_state = 'active'
+      WHERE ${accountVisibleSql()}
         AND (lower(handle) = $1 OR lower(previous_handle) = $1)
       ORDER BY (lower(handle) = $1) DESC
       LIMIT 1`,
@@ -1467,9 +1462,9 @@ module.exports = {
   getPublicProfileExtras,
   getOwnProfileExtras,
   setAccountHideStats,
-  // account privacy: visibility + recruiter reach (privacy spec D1)
-  ACCOUNT_VISIBILITY,
-  isRecruiterDiscoverable,
+  // account privacy: the effective-visibility predicates (./account-visibility.js
+  // — one home for every effective answer; task 1002967 / ADR 0202 D4, 0207)
+  ...visibility,
   setAccountPrivacy,
   // builder handle (P01)
   RESERVED_HANDLES,

package/modules/platform-identity/routes/connections.js

@@ -40,7 +40,7 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const conn = require('../connections');
-const { isAccountVisible } = require('../account-visibility');
+const { isAccountVisible, isAccountActive } = require('../account-visibility');
 
 const { pool, requireBuilder, validateOrRespond, parsePagination } = api;
 const log = api.logger('platform-identity');
@@ -64,7 +64,7 @@ async function actingAccount(builder) {
     return { fail: ['no_platform_identity', { status: 400, message: 'this session has no platform account' }] };
   }
   const acct = await pi.getAccount(githubId, { pool });
-  if (!acct || acct.profile_state !== 'active') {
+  if (!isAccountActive(acct)) {
     return { fail: ['profile_provisional', { status: 403, message: 'sign in to the platform once to activate your profile before connecting' }] };
   }
   return { githubId };
@@ -78,7 +78,7 @@ async function visibleTarget(viewerGithubId, handle) {
   const acct = await conn.findAccountByHandle(handle, { pool });
   if (!acct) return null;
   if (isAccountVisible(acct)) return acct;
-  if (acct.profile_state !== 'active') return null;
+  if (!isAccountActive(acct)) return null;
   return (await conn.isConnectedTo(viewerGithubId, acct.github_id, { pool })) ? acct : null;
 }
 

package/modules/ui-design/kit/fixtures/featured-hub.json

@@ -0,0 +1 @@
+{"_":"The hub's catalog (task 1003345): the landing's featured.json plus Tidewater, an all-null row nobody owns — the card-floor state opens ITS card, because Demo is owned by the signed-in stub (provisioning-instances.json) and an owned orb's plain click opens the manage view, never the card. Served under the name \"featured\" by projects.states.json's stub.fixtures alias; the landing keeps featured.json.","projects":[{"origin":"https://amazonprimea.com","name":"Off the Boats","tagline":"A singular shop, and a broader videogame in a persistent ancient Greek world that collides with modern day commerce & products.","art_url":"/assets/world/r2-chrome-blob-one.jpg","type":"game","template":"bead-wash","created_at":"2026-07-15T22:12:57.732Z","builders":11,"tags":["art-pipeline","character-anim","demo","game"],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":["https://avatars.githubusercontent.com/u/283020391?v=4","https://avatars.githubusercontent.com/u/64553469?v=4","https://avatars.githubusercontent.com/u/290184380?v=4","https://avatars.githubusercontent.com/u/295990394?v=4","https://avatars.githubusercontent.com/u/35337514?v=4"],"shipped_30d":0,"shipped_30d_capped":false,"hall_origin":"https://builders.amazonprimea.com"},{"origin":"https://demo.cloudbongos.com","name":"Demo","tagline":"A live demo instance on Cloud Bongos.","art_url":null,"type":null,"template":"pair-gold-wash","created_at":"2026-07-14T19:16:38.160Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null},{"origin":"https://emersonian-circles.cloudbongos.com","name":"Emersonian Circles","tagline":"An independent project built on Cloud Bongos.","art_url":null,"type":null,"template":null,"created_at":"2026-07-25T02:21:55.641Z","builders":1,"tags":[],"owner":"lars589","owner_avatar":"https://avatars.githubusercontent.com/u/283020391?v=4","faces":[],"shipped_30d":30,"shipped_30d_capped":true,"hall_origin":null},{"origin":"https://tidewater.cloudbongos.com","name":"Tidewater","tagline":"A project that has declared nothing yet.","art_url":null,"type":null,"template":null,"created_at":"2026-07-20T08:00:00.000Z","builders":null,"tags":null,"owner":null,"owner_avatar":null,"faces":null,"shipped_30d":null,"shipped_30d_capped":null,"hall_origin":null}]}

package/modules/ui-design/kit/fixtures/provisioning-instances-empty.json

@@ -0,0 +1,4 @@
+{
+  "_": "The empty mine view (task 1003345): an owner with no projects yet. Named by a states file's stub.fixtures alias.",
+  "instances": []
+}

package/modules/ui-design/kit/fixtures/provisioning-instances.json

@@ -0,0 +1,99 @@
+{
+  "_": "The owner's projects for the kit (task 1003345): four states the mine list and the manage page render — live, standing up, snagged, torn down. Timestamps written \"$now-3m\" / \"$now-1d\" are resolved by the stub at request time so \"checked 3m ago\" stays true. Mooring (task 1003345, the grade's finding): live but unreachable since its last probe, so the restart door renders and the restart probe has a row to drive.",
+  "instances": [
+    {
+      "id": 101,
+      "slug": "demo",
+      "status": "active",
+      "domain": "demo.cloudbongos.com",
+      "target_ref": "builder/demo",
+      "hosting_shape": "co-tenant",
+      "onboard_mode": "scaffold",
+      "created_at": "2026-08-01T10:00:00.000Z",
+      "provisioned_at": "2026-08-01T10:20:00.000Z",
+      "updated_at": "$now-3m",
+      "last_verified_at": "$now-3m",
+      "last_verified_up": true,
+      "error_note": null,
+      "dns_note": null,
+      "torn_down_at": null,
+      "open_intent": null
+    },
+    {
+      "id": 102,
+      "slug": "harbor",
+      "status": "provisioning",
+      "domain": null,
+      "target_ref": "builder/harbor",
+      "hosting_shape": "standalone",
+      "onboard_mode": "scaffold",
+      "created_at": "$now-6m",
+      "provisioned_at": null,
+      "updated_at": "$now-2m",
+      "last_verified_at": null,
+      "last_verified_up": null,
+      "error_note": null,
+      "dns_note": null,
+      "torn_down_at": null,
+      "open_intent": {
+        "action": "standup",
+        "state": "running",
+        "created_at": "$now-6m"
+      }
+    },
+    {
+      "id": 103,
+      "slug": "tidepool",
+      "status": "error",
+      "domain": "tidepool.cloudbongos.com",
+      "target_ref": "builder/tidepool",
+      "hosting_shape": "co-tenant",
+      "onboard_mode": "adopt",
+      "created_at": "2026-08-20T09:00:00.000Z",
+      "provisioned_at": null,
+      "updated_at": "$now-1d",
+      "last_verified_at": null,
+      "last_verified_up": null,
+      "error_note": "The deploy could not read the repository: it is private, and the deploy key only reads public ones.",
+      "dns_note": null,
+      "torn_down_at": null,
+      "open_intent": null
+    },
+    {
+      "id": 104,
+      "slug": "old-lantern",
+      "status": "torn_down",
+      "domain": "old-lantern.cloudbongos.com",
+      "target_ref": "builder/old-lantern",
+      "hosting_shape": "co-tenant",
+      "onboard_mode": "scaffold",
+      "created_at": "2026-07-02T09:00:00.000Z",
+      "provisioned_at": "2026-07-02T09:30:00.000Z",
+      "updated_at": "2026-08-15T12:00:00.000Z",
+      "last_verified_at": "2026-08-15T11:50:00.000Z",
+      "last_verified_up": true,
+      "error_note": null,
+      "dns_note": null,
+      "torn_down_at": "2026-08-15T12:00:00.000Z",
+      "open_intent": null
+    },
+    {
+      "id": 105,
+      "slug": "mooring",
+      "status": "active",
+      "domain": "mooring.cloudbongos.com",
+      "target_ref": "builder/mooring",
+      "hosting_shape": "co-tenant",
+      "onboard_mode": "scaffold",
+      "created_at": "2026-08-10T09:00:00.000Z",
+      "provisioned_at": "2026-08-10T09:20:00.000Z",
+      "updated_at": "$now-20m",
+      "last_verified_at": "$now-20m",
+      "last_verified_up": false,
+      "error_note": null,
+      "dns_note": null,
+      "torn_down_at": null,
+      "open_intent": null
+    }
+  ]
+}

package/modules/ui-design/kit/lib.js

@@ -237,6 +237,8 @@ function reducedMotionProblems({ running = [], frames = 0 } = {}) {
 // { "page": "/projects", "surface"?: "public-landing", "stub"?: { prefix?, child? },
 //   "modes"?: ["dark" | "light", …] (the modes the page renders; default both — a page that pins
 //   one mode declares it here), "modeQuery"?: "mode" | false, "ignoreRequests"?: [regex strings], "ignoreConsole"?: [...],
+//   stub.fixtures?: { "<fixture name>": "<other fixture file>" } (serve another file under a name — an empty list, a
+//   failure shape — for the states in THIS file; task 1003345),
 //   "ignoreControls"?: [selectors], "states": { name: { url?, auth?, actions?, expect? } },
 //   "reducedMotion"?: { auth?, url?, actions? } }
 function validateStatesFile(json) {
@@ -269,10 +271,11 @@ function validateStatesFile(json) {
 }
 function validateStub(stub, at) {
   if (stub === undefined) return [];
-  if (!stub || typeof stub !== 'object' || Array.isArray(stub)) return [`${at}: an object { prefix?, child? }`];
+  if (!stub || typeof stub !== 'object' || Array.isArray(stub)) return [`${at}: an object { prefix?, child?, fixtures? }`];
   const errors = [];
   if (stub.prefix !== undefined && (typeof stub.prefix !== 'string' || !stub.prefix.startsWith('/') || !stub.prefix.endsWith('/'))) errors.push(`${at}.prefix: a URL prefix like "/builders/"`);
   if (stub.child !== undefined && typeof stub.child !== 'boolean') errors.push(`${at}.child: boolean (serve the child-instance shape)`);
+  if (stub.fixtures !== undefined && !(stub.fixtures && typeof stub.fixtures === 'object' && !Array.isArray(stub.fixtures) && Object.values(stub.fixtures).every((v) => typeof v === 'string' && /^[a-z0-9-]+$/.test(v)))) errors.push(`${at}.fixtures: an object of fixture name → the fixture file to serve under it (kebab-case names)`);
   return errors;
 }
 
@@ -339,11 +342,12 @@ function freePort() {
     s.listen(0, '127.0.0.1', () => { const p = s.address().port; s.close(() => resolve(p)); });
   });
 }
-async function startStub({ surface, auth = false, port, prefix, child = false } = {}) {
+async function startStub({ surface, auth = false, port, prefix, child = false, fixtures } = {}) {
   const p = port || await freePort();
   const env = { ...process.env, STUB_PORT: String(p), AUTH: auth ? '1' : '0', CHILD: child ? '1' : '0' };
   if (surface) env.SURFACE = surface;
   if (prefix) env.PREFIX = prefix;
+  if (fixtures) env.FIXTURE_ALIAS = JSON.stringify(fixtures);
   const proc = spawn(process.execPath, [path.join(KIT_DIR, 'serve.js')], { env, stdio: ['ignore', 'pipe', 'pipe'] });
   await new Promise((resolve, reject) => {
     let out = '';

package/modules/ui-design/kit/probe.js

@@ -52,7 +52,7 @@ async function main() {
 
   const stubs = [];
   let baseOut = lib.argOf(args, '--base-out', null), baseIn = lib.argOf(args, '--base-in', null);
-  const stubOpts = { surface, prefix: json.stub && json.stub.prefix, child: json.stub && json.stub.child };
+  const stubOpts = { surface, prefix: json.stub && json.stub.prefix, child: json.stub && json.stub.child, fixtures: json.stub && json.stub.fixtures };
   if (!baseOut) { const s = await lib.startStub({ ...stubOpts, auth: false }); stubs.push(s); baseOut = s.base; }
   if (!baseIn) { const s = await lib.startStub({ ...stubOpts, auth: true }); stubs.push(s); baseIn = s.base; }
   const stop = () => stubs.forEach((s) => s.stop());

package/modules/ui-design/kit/render.js

@@ -76,7 +76,7 @@ async function main() {
 
   const stubs = [];
   let baseOut = lib.argOf(args, '--base-out', null), baseIn = lib.argOf(args, '--base-in', null);
-  const stubOpts = { surface, prefix: json.stub && json.stub.prefix, child: json.stub && json.stub.child };
+  const stubOpts = { surface, prefix: json.stub && json.stub.prefix, child: json.stub && json.stub.child, fixtures: json.stub && json.stub.fixtures };
   if (!baseOut) { const s = await lib.startStub({ ...stubOpts, auth: false }); stubs.push(s); baseOut = s.base; }
   if (!baseIn) { const s = await lib.startStub({ ...stubOpts, auth: true }); stubs.push(s); baseIn = s.base; }
   const stop = () => stubs.forEach((s) => s.stop());

package/modules/ui-design/kit/serve.js

@@ -40,6 +40,9 @@ const AUTH = process.env.AUTH === '1';
 const CHILD = process.env.CHILD === '1';
 const LIVE = process.env.LIVE || '';
 const FAIL = new Set(String(process.env.FAIL || '').split(',').map((s) => s.trim()).filter(Boolean));
+// a states file may point a fixture NAME at another FILE (stub.fixtures, task 1003345) — the
+// way the mine view's empty state is rendered without a second stub shape
+const ALIAS = JSON.parse(process.env.FIXTURE_ALIAS || '{}');
 const FIXTURES = path.join(__dirname, 'fixtures');
 const DOCS = path.join(ROOT, 'docs');
 const TRANSFORM = path.join(ROOT, 'scripts', 'gds', 'ui-kit-transform.js');
@@ -101,11 +104,59 @@ const UNAUTH = { error: { code: 'unauthenticated', message: 'unauthenticated' }
 function json(res, status, body) { res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' }); res.end(JSON.stringify(body)); }
 function fixture(name, res, origin) {
   if (FAIL.has(name)) return json(res, 500, { error: { code: 'stub_failure', message: `FAIL=${name}` } });
-  const file = path.join(FIXTURES, name + '.json');
+  const file = path.join(FIXTURES, (ALIAS[name] || name) + '.json');
   if (!fs.existsSync(file)) return json(res, 404, { error: { code: 'no_fixture', message: name } });
   res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' });
   res.end(name === 'featured' ? JSON.stringify(featured(file, origin)) : fs.readFileSync(file));
 }
+// The owner's projects (task 1003345): the list, one project ({ instance, open_intent }: a
+// wrong id answers 404, the route's own shape), and its settings row. "$now-3m" strings are
+// resolved per request so a "live" chip reads "checked 3m ago" on every render.
+function stamp(v) {
+  if (Array.isArray(v)) return v.map(stamp);
+  if (v && typeof v === 'object') { const o = {}; for (const [k, x] of Object.entries(v)) o[k] = stamp(x); return o; }
+  const m = typeof v === 'string' && v.match(/^\$now(?:([+-]\d+)([smhd]))?$/);
+  if (!m) return v;
+  const unit = { s: 1e3, m: 6e4, h: 36e5, d: 864e5 }[m[2] || 's'];
+  return new Date(Date.now() + (m[1] ? Number(m[1]) * unit : 0)).toISOString();
+}
+// the receipt each ask gets: the message the page shows verbatim, so a probe can pin it
+const FLOW_RECEIPTS = {
+  teardown: { queued: true, message: 'Teardown queued.' },
+  restart: { queued: true, message: 'Restart queued.' },
+  domain: { recorded: true, queued: true, message: 'Address recorded.' },
+  provision: { queued: true, message: 'Queued. The platform picks it up from here.' },
+  settings: { settings: { platform_visibility: 'public', joinability: 'open' }, push: { queued: true, message: 'Saved. The project restarts to apply it.' } },
+};
+// a teardown or restart ask is REMEMBERED for the run: the page re-reads the project right
+// after a receipt (doDelete → loadManage), and what it must then see is the queued intent —
+// the same open_intent shape the route stamps — not the untouched fixture row
+const ASKED = new Map();
+function flowReceipt(rest, method) {
+  if (method === 'POST' && rest === '/provisioning/instances') return FLOW_RECEIPTS.provision;
+  const m = rest.match(/^\/provisioning\/instances\/(\d+)\/(teardown|restart|domain|settings)$/);
+  if (!m) return null;
+  if (m[2] === 'settings') return method === 'PATCH' ? FLOW_RECEIPTS.settings : null;
+  if (method !== 'POST') return null;
+  if (m[2] === 'teardown' || m[2] === 'restart') ASKED.set(m[1], m[2]);
+  return FLOW_RECEIPTS[m[2]];
+}
+function withAsk(inst) {
+  const action = ASKED.get(String(inst.id));
+  return action ? { ...inst, open_intent: { action, state: 'queued', created_at: '$now' } } : inst;
+}
+function instances(res, id, settings) {
+  const name = 'provisioning-instances';
+  if (FAIL.has(name)) return json(res, 500, { error: { code: 'stub_failure', message: `FAIL=${name}` } });
+  const file = path.join(FIXTURES, (ALIAS[name] || name) + '.json');
+  if (!fs.existsSync(file)) return json(res, 404, { error: { code: 'no_fixture', message: name } });
+  const list = stamp((JSON.parse(fs.readFileSync(file, 'utf8')).instances || []).map(withAsk));
+  if (id === null) return json(res, 200, { instances: list });
+  const inst = list.find((i) => String(i.id) === String(id));
+  if (!inst) return json(res, 404, { error: { code: 'not_found', message: 'no such instance' } });
+  if (settings) return json(res, 200, { settings: { platform_visibility: 'public', joinability: 'open' }, options: { platform_visibility: ['public', 'gated'], joinability: ['open', 'apply', 'invite_only'] } });
+  return json(res, 200, { instance: inst, open_intent: inst.open_intent || null });
+}
 // A project's art in the featured fixture may be root-relative (the surface's
 // own /assets/…, served by this stub) — the page accepts only an http(s) art
 // URL, so it is absolutised to this origin per request, as the builder's
@@ -156,7 +207,17 @@ const server = http.createServer((req, res) => {
     if (FEEDS[rest]) return LIVE ? proxy(req, res) : fixture(FEEDS[rest], res, origin);
     if (rest === '/me') return AUTH ? json(res, 200, me(origin)) : json(res, 401, UNAUTH);
     if (AUTHED[rest]) return AUTH ? fixture(AUTHED[rest], res) : json(res, 401, UNAUTH);
-    if (rest === '/provisioning/instances') return AUTH ? json(res, 200, { instances: [] }) : json(res, 401, UNAUTH);
+    if (rest === '/provisioning/instances' && req.method === 'GET') return AUTH ? instances(res, null, false) : json(res, 401, UNAUTH);
+    const one = rest.match(/^\/provisioning\/instances\/(\d+)(\/settings)?$/);
+    if (one && req.method === 'GET') return AUTH ? instances(res, one[1], !!one[2]) : json(res, 401, UNAUTH);
+    // the manage flows (task 1003345): every door on a row and on the manage page only ASKS
+    // (ADR 0111) — the stub answers each ask with the route's receipt so the probes can drive
+    // attach / restart / teardown / revive / join end to end; nothing changes in the fixture
+    if (req.method !== 'GET') {
+      const flow = flowReceipt(rest, req.method);
+      if (flow) return AUTH ? json(res, 200, flow) : json(res, 401, UNAUTH);
+    }
+    if (rest.startsWith('/github/repo')) return AUTH ? json(res, 200, { repo: { private: false, admin: true } }) : json(res, 401, UNAUTH);
     if (rest === '/auth/logout') return json(res, 200, { ok: true });
     if (rest.startsWith('/auth/web/start')) { res.writeHead(302, { location: PREFIX }); return res.end(); }
     if (rest === '/instance') { const b = pages.size ? pages.values().next().value.brand : {}; return json(res, 200, { brand: { productName: (b && b.productName) || '', project: {} }, modules: {} }); }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.420",
+  "version": "1.19.422",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.420",
+      "version": "1.19.422",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.420",
+  "version": "1.19.422",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",