@bongos/core 1.19.424 → 1.19.426

package/modules/platform-identity/account-visibility.js

@@ -28,8 +28,11 @@
 //   rollupVisibleSql / isRollupVisible     NUMBERS    — visible AND NOT
 //       hide_stats. ADR 0171 D2's predicate EXTENDED with the existence axis,
 //       and COMPOSED from accountVisibleSql rather than restated.
-//   isRecruiterDiscoverable                REACH      — the COALESCE, privacy
+//   recruiterReachSql / isRecruiterDiscoverable  REACH — the COALESCE, privacy
 //       spec D1. A reach predicate only: it never buys addressability.
+//   scoutingListableSql                    THE DIRECTORY — numbers AND reach,
+//       the ONE predicate the recruiting directory joins (ADR 0210, task
+//       1002290). Composed, never restated.
 //
 // The rollup pair was originally left to "the rollup readers" to apply. Task
 // 1002967 moved it here for the reason this file exists: there are two such
@@ -137,6 +140,47 @@ function isRecruiterDiscoverable(account) {
   return account.account_visibility === 'public';
 }
 
+// The SAME reach answer as a SQL fragment, for the read that filters in the
+// database (task 1002290). It is the ONE spelling of that COALESCE outside the
+// JS twin above — tests/effective_visibility_predicate.mjs fails any other file
+// that writes it — so a directory query and a route can never disagree about who
+// opted out. NULL still means "follow visibility", exactly as the column comment
+// in platform_identity_012_account_privacy.sql says.
+function recruiterReachSql(alias) {
+  if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
+    throw new Error('recruiterReachSql: alias must be a bare SQL identifier');
+  }
+  const q = alias ? `${alias}.` : '';
+  return `COALESCE(${q}recruiter_discoverable, ${q}account_visibility = 'public')`;
+}
+
+// scoutingListableSql — THE predicate the recruiting directory joins: the rollup
+// axis AND the reach axis (ADR 0210, task 1002290). listScoutingRollup is the
+// one reader; /scouting and the hall's /people are its two surfaces.
+//
+// WHY REACH BELONGS HERE AND NOT IN rollupVisibleSql. The two axes answer
+// different questions and only one surface asks both. `hide_stats` suppresses
+// NUMBERS everywhere, for every reader; the recruiting opt-out removes an
+// account from the RECRUITING SURFACE only. The community spec's D3 leaderboards
+// say so out loud — "the recruiting opt-out does not affect leaderboards; it
+// governs the recruiting surface only" — so folding reach into rollupVisibleSql
+// would silently empty a future public leaderboard of every opted-out builder.
+// A leaderboard reader must therefore join rollupVisibleSql, never this.
+//
+// Composed from rollupVisibleSql and recruiterReachSql rather than restated, so
+// changing what "visible", "hidden" or "reachable" means moves this with it.
+function scoutingListableSql(alias) {
+  // Validated HERE as well as in both delegates. The delegates do refuse a bad
+  // alias, but only because rollupVisibleSql happens to be evaluated first in the
+  // template literal below — a security property should not rest on the
+  // evaluation order of a string interpolation, and the error a caller sees
+  // should name the function they actually called.
+  if (alias && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(String(alias))) {
+    throw new Error('scoutingListableSql: alias must be a bare SQL identifier');
+  }
+  return `(${rollupVisibleSql(alias)} AND ${recruiterReachSql(alias)})`;
+}
+
 module.exports = {
   isAccountVisible,
   accountVisibleSql,
@@ -146,4 +190,6 @@ module.exports = {
   isRollupVisible,
   ACCOUNT_VISIBILITY,
   isRecruiterDiscoverable,
+  recruiterReachSql,
+  scoutingListableSql,
 };

package/modules/platform-identity/platform-identity.js

@@ -20,7 +20,7 @@ const api = require('../../src/module-api');
 const visibility = require('./account-visibility');
 
 const { pool: defaultPool } = api;
-const { ACCOUNT_VISIBILITY, accountVisibleSql, rollupVisibleSql, isRollupVisible } = visibility;
+const { ACCOUNT_VISIBILITY, accountVisibleSql, rollupVisibleSql, isRollupVisible, scoutingListableSql } = visibility;
 
 // Default authorization-code lifetime — deliberately short (~60s). A code is a
 // bearer secret that travels through the browser; a tight TTL bounds the replay
@@ -722,15 +722,18 @@ async function upsertActivity({ clientId, githubId, credits = 0, tasksShipped =
 // disciplines union is computed separately in `disc`. Proven against real SQL by
 // tests/scouting_rollup_fanout.mjs.
 //
-// Consent by construction (ADR 0171 D2/D3, extended by task 1002967): only
-// builders whose account passes rollupVisibleSql — active, publicly visible, not
-// hidden — appear. /people and /scouting are live cross-project surfaces, so the
-// predicate lives IN the query, not in any caller's memory, and it is the SHARED
-// one so this list can never disagree with /profiles/:handle about who is
-// visible. Provisional, private and hidden builders drop out entirely; the
-// projection stays an explicit whitelist (no raw-row spread). A private account
-// that is recruiter-discoverable is absent here on purpose: the full rollup is
-// never its disclosure — the D3 sliver is (a separate authorization-scoped port).
+// Consent by construction (ADR 0171 D2/D3, extended by tasks 1002967 + 1002290):
+// only builders whose account passes scoutingListableSql — active, publicly
+// visible, not hidden, AND not opted out of recruiting — appear. /people and
+// /scouting are live cross-project surfaces, so the predicate lives IN the query,
+// not in any caller's memory, and it is the SHARED one so this list can never
+// disagree with /profiles/:handle about who is visible. Provisional, private,
+// hidden and opted-out builders drop out entirely; the projection stays an
+// explicit whitelist. A private account that is recruiter-discoverable is absent
+// here on purpose: the full rollup is never its disclosure — the D3 sliver is.
+// THIS IS THE RECRUITING DIRECTORY: a public LEADERBOARD must not reuse this
+// reader (community spec D3 — the opt-out governs the recruiting surface only);
+// it joins rollupVisibleSql instead. Full argument: scoutingListableSql.
 async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
   const { rows } = await pool.query(
     `WITH agg AS (
@@ -744,7 +747,7 @@ async function listScoutingRollup({ limit = 100, pool = defaultPool } = {}) {
         WHERE EXISTS (
                 SELECT 1 FROM platform_identity_accounts pa
                  WHERE pa.github_id = a.github_id
-                   AND ${rollupVisibleSql('pa')})
+                   AND ${scoutingListableSql('pa')})
         GROUP BY a.github_id
      ), disc AS (
        SELECT x.github_id, array_agg(DISTINCT x.d) AS disciplines

package/modules/platform-identity/routes/scouting.js

@@ -1,10 +1,20 @@
-// modules/platform-identity/routes/scouting.js — the INTERNAL cross-project
-// scouting view (ADR 0141 §4, task #1002114; Metic floor per ADR 0157). Ranks
-// builders across ALL hosted projects from platform_identity_builder_project_activity.
-// A talent tool for the platform operator — NOT authority (the rollup is
-// descriptive; authority stays local, ADR 0141 / ADR 0016). Consent is enforced
-// IN listScoutingRollup itself (ADR 0171 D2/D3): only profile_state='active',
-// non-hidden builders appear, so this surface honors hide by construction.
+// modules/platform-identity/routes/scouting.js — the cross-project RECRUITING
+// DIRECTORY (ADR 0141 §4, task 1002114; graduated to project owners by ADR 0210,
+// task 1002290). Ranks builders across ALL hosted projects from
+// platform_identity_builder_project_activity. A talent tool — NOT authority (the
+// rollup is descriptive; authority stays local, ADR 0141 / ADR 0016).
+//
+// WHO READS IT: a hub operator holding `project.curate` (floor metic since ADR
+// 0157) OR a project owner — someone whose own project reported them as its
+// owner at check-in and whose sign-in the hub itself witnessed. That OR lives in
+// ../scouting-authz.js, which carries the full argument for why reading an
+// instance-asserted ownership claim is not the ADR 0201 D3 inversion.
+//
+// WHO APPEARS IN IT: consent is enforced IN listScoutingRollup itself, by the
+// shared scoutingListableSql predicate — active, publicly visible, not hidden,
+// and not opted out of recruiting (ADR 0171 D2/D3 + privacy spec D1). So this
+// surface honors both the hide flag and the recruiting opt-out by construction,
+// and widening WHO may read it could not widen WHAT is shown.
 //
 // Reaches core only through the doorway (ADR 0083).
 'use strict';
@@ -12,25 +22,55 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
+const scoutingAuthz = require('../scouting-authz');
 
-const { pool, requireBuilder, requirePermission, parsePagination } = api;
+const { pool, requireBuilder, parsePagination } = api;
+
+// Resolved at CALL time, never at load. Proofs that exercise this route pin a
+// PARTIAL doorway (tests/profile_route.mjs stubs pool + the two gates and
+// nothing else), and a module-scope api.logger() would make this file
+// unrequireable there — a logging line is not worth breaking a privacy proof
+// over. my-projects.js reaches the doorway logger the same lazy way.
+let resolvedLog = null;
+const log = {
+  error: (msg) => {
+    if (!resolvedLog) resolvedLog = typeof api.logger === 'function' ? api.logger('platform-identity') : { error: () => {} };
+    resolvedLog.error(msg);
+  },
+};
 
 module.exports = function scoutingRoutes() {
   const router = express.Router();
 
-  // rank: archon — the internal talent directory across every project. The Archon
-  // gate here is the load-bearing protection ("NOT shown to builders"): a non-Archon
-  // is 403'd before any cross-builder data is read.
-  router.get('/scouting', requireBuilder, requirePermission('project.curate'), async (req, res) => {
-    const { limit } = parsePagination(req, { defaultLimit: 100, maxLimit: 500 });
-    try {
-      const builders = await pi.listScoutingRollup({ limit, pool });
-      res.json({ builders });
-    } catch (err) {
-      console.error('[platform-identity] GET /scouting', err);
-      res.fail('scouting_failed', { status: 500, message: 'internal error' });
-    }
-  });
+  // The atom is spelled in the middleware list below, not hidden inside
+  // requireScoutingReader, so route-rank-check.js and gen-api-docs.js classify
+  // this route from its real gate. A helper-hidden gate would record a
+  // privileged route as any-builder — wrong in the dangerous direction.
+
+  // rank: metic+archon — the internal talent directory across every project.
+  // Read by a `project.curate` holder OR a project owner (ADR 0210, task 1002290);
+  // a caller who is neither gets the unchanged permission refusal before any
+  // cross-builder data is read.
+  router.get(
+    '/scouting',
+    requireBuilder,
+    // Ownership is asked FIRST — one indexed LIMIT-1 lookup, paid by the operator
+    // path too. The alternative is asking the permission gate first, and it is not
+    // available: a middleware that has denied has already SENT its response, so
+    // there is nothing to fall through from. Paying a round-trip is what keeps the
+    // 403 byte-identical to the one this route always produced (ADR 0210 D2).
+    scoutingAuthz.requireScoutingReader({ curateGate: api.requirePermission('project.curate'), pool, log }),
+    async (req, res) => {
+      const { limit } = parsePagination(req, { defaultLimit: 100, maxLimit: 500 });
+      try {
+        const builders = await pi.listScoutingRollup({ limit, pool });
+        res.json({ builders });
+      } catch (err) {
+        log.error(`GET /scouting failed: ${err && err.message}`);
+        res.fail('scouting_failed', { status: 500, message: 'internal error' });
+      }
+    },
+  );
 
   return router;
 };

package/modules/platform-identity/routes/sso.js

@@ -17,6 +17,7 @@
 const express = require('express');
 const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
+const scoutingAuthz = require('../scouting-authz');
 const hubKeys = require('../hub-keys');
 const hubDevice = require('../hub-device');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
@@ -114,6 +115,11 @@ function registerSeams() {
       // THROWS on a bad read by design — an empty set means "nobody is hidden",
       // which a database error must never be allowed to say.
       hiddenGithubIds: (githubIds) => pi.hiddenGithubIds(githubIds, { pool }),
+      // task 1002290 (ADR 0210): "does this hub account own a project?", the
+      // second audience the /people page gate admits beside `project.curate`.
+      // The ownership fact lives in this module, so the answer does too; core
+      // asks through the port and treats an absent one as a denial.
+      isProjectOwner: (githubId) => scoutingAuthz.hasOwnerMembership(githubId, { pool }),
     });
   }
 }

package/modules/platform-identity/scouting-authz.js

@@ -0,0 +1,139 @@
+// modules/platform-identity/scouting-authz.js — WHO may read the cross-project
+// recruiting directory (GET /scouting; the hall's /people page renders the same
+// data). ADR 0210, task 1002290 — goal 1000045 C5: "project owners (not only
+// Archons) browse builder profiles to recruit".
+//
+// TWO DOORS, DELIBERATELY DIFFERENT KINDS — the modules/lifecycle/goal-authz.js
+// shape (owner OR rank), which the project-admin-console spec names as the
+// design of record:
+//
+//   RANK      — `project.curate`, floor metic (ADR 0157 lowered it from archon).
+//               The hub OPERATOR's door, unchanged: the atom, the 403 body, the
+//               floors map. Nothing about it moves here.
+//   OWNERSHIP — an instance-asserted, hub-witnessed `membership_kind = 'owner'`
+//               project membership. The PROJECT OWNER's door, and the whole of
+//               what this file adds.
+//
+// WHY OWNERSHIP IS SAFE TO READ HERE, WHEN ADR 0201 D3 SAYS A HUB-HELD OWNER
+// LIST IS NEVER A GATE. The thing that ADR rejects is `platform_identity_-
+// projects.owner_github_id`: a hub CATALOG column, written by hub curation, with
+// no instance behind it — consulting it before an ADMISSION would be the hub
+// deciding who may admit on someone else's box, the ADR 0141 inversion.
+// `platform_identity_project_memberships.membership_kind` is a different record
+// with a different provenance: the PROJECT ITSELF reports it over the
+// client_id + client_secret channel at `POST /sso/membership/check-in`
+// (src/bongos/auth-admission.js decides the value from its OWN first-admin
+// config), and `touchMembership` refuses to write it unless the hub has already
+// witnessed that person sign in (`signin_verified_at`, ADR 0205 D1/D2). So this
+// gate reads the instance's own claim about its own archon, mirrored — authority
+// stays local, exactly as ADR 0141 requires. And the act being gated is a HUB
+// READ of the hub's own directory, not an admission on anyone else's box.
+//
+// NOT AUTHORITY, IN EITHER DIRECTION (ADR 0016). Owning a project buys exactly
+// one thing: reading a descriptive, consent-filtered list. It confers no rank, no
+// claim right, no admission power, and it is never consulted by anything else.
+// The reverse also holds and is load-bearing for task 1002290's other half: a
+// builder's recruiting opt-out changes who can SEE them and grants or denies
+// them nothing — the two axes never touch.
+//
+// LIVE GAP, NAMED ON PURPOSE (ADR 0210 §Consequences; blocker filed). "Project
+// owner" per the goal spec is "the registrant plus delegates they grant". Today
+// an instance reports `owner` for its FIRST ADMIN only, so the REGISTRANT half
+// works and DELEGATES do not: a second archon on a project holds `member` on the
+// hub and reaches /scouting only via `project.curate`. Nothing here needs to
+// change when that is fixed — this gate reads whatever the instance reports.
+'use strict';
+
+const pi = require('./platform-identity');
+
+// The coarse membership value that means "this person is an owner of this
+// project", in the CURRENT vocabulary (ADR 0177 — `role`/'builder' is the legacy
+// spelling platform_identity_010's trigger keeps in lockstep; 'owner' is
+// unchanged across the rename, so there is no legacy value to also accept).
+const OWNER_MEMBERSHIP_KIND = 'owner';
+
+// The one `platform_identity_sso_clients.status` value that means the project is
+// still live on the platform (the other is 'suspended' — migration
+// platform_identity_001_tables.sql). Suspending a client is the operator's
+// revocation lever; see hasOwnerMembership for why this gate answers to it.
+const ACTIVE_CLIENT_STATUS = 'active';
+
+// isProjectOwnerMembership(row) — the PURE predicate: is this one membership row
+// an owner membership the hub itself witnessed a sign-in for? Fail-closed on an
+// absent row, and on a row the hub never witnessed — an un-witnessed row is a
+// client's own unproven claim (ADR 0205 D4, the `membershipBacksRollup` rule).
+function isProjectOwnerMembership(membership) {
+  return !!membership
+    && membership.membership_kind === OWNER_MEMBERSHIP_KIND
+    && !!membership.signin_verified_at;
+}
+
+// hasOwnerMembership(githubId) — does this hub account own at least one project
+// that is still ACTIVE on the platform? EXISTENCE only: which project, and how
+// many, is not this gate's question, so the query stops at the first row. A
+// non-numeric principal (core's 'system:bfg' shape) answers false rather than
+// throwing a bigint cast mid-request — the isNumericGithubId guard every read in
+// this module carries.
+//
+// THE CLIENT JOIN IS THE REVOCATION DIMENSION, and without it this door could
+// never be shut. A membership row is written once and never expires: nothing
+// ages it out, and the only ways it stops saying `owner` are the instance
+// reporting a lower kind at a later check-in, or the builder leaving of their
+// own accord. Neither is available to the platform operator dealing with a rogue
+// or compromised project. Suspending its client (`setClientStatus`) IS that
+// lever — it is what already stops the project signing anyone in — so the read
+// it derives must answer to it too. Otherwise suspending a project would leave
+// its owner reading every builder on the platform, indefinitely.
+async function hasOwnerMembership(githubId, { pool }) {
+  if (!pi.isNumericGithubId(githubId)) return false;
+  const { rows } = await pool.query(
+    `SELECT m.membership_kind, m.signin_verified_at
+       FROM platform_identity_project_memberships m
+       JOIN platform_identity_sso_clients c ON c.client_id = m.client_id
+      WHERE m.github_id = $1 AND m.membership_kind = $2
+        AND m.signin_verified_at IS NOT NULL
+        AND c.status = $3
+      LIMIT 1`,
+    [githubId, OWNER_MEMBERSHIP_KIND, ACTIVE_CLIENT_STATUS],
+  );
+  return isProjectOwnerMembership(rows[0]);
+}
+
+// requireScoutingReader({ curateGate, pool, log }) — the OR gate as one
+// middleware, mounted after requireBuilder. `curateGate` is the ALREADY-BUILT
+// `requirePermission('project.curate')` middleware: the atom is spelled in the
+// route's own middleware list, where route-rank-check.js and gen-api-docs.js can
+// see it, so widening the door cannot make the route's recorded rank read looser
+// than it is.
+//
+// ORDER IS THE DESIGN. The ownership question is asked FIRST and, when it
+// answers yes, the request proceeds without the permission gate ever running.
+// When it answers no — or throws — the request falls through to the UNMODIFIED
+// permission gate, so a caller who is neither owner nor operator gets exactly the
+// 403 this route has always produced: the same code, the same `required`/`held`,
+// the same floors map naming the metic floor. The widening can therefore only
+// ever ADMIT; it cannot change, soften, or swallow a refusal.
+//
+// FAIL-CLOSED ON THE OWNERSHIP QUESTION ITSELF. A database blip while asking
+// "does this person own a project" must not admit, and must not 500 either: it
+// falls to the permission gate, which denies unless the caller holds the atom.
+// The failure mode of the new door is "the old door, unchanged".
+function requireScoutingReader({ curateGate, pool, log }) {
+  return async function scoutingReaderGate(req, res, next) {
+    try {
+      if (await hasOwnerMembership(req.builder && req.builder.github_id, { pool })) return next();
+    } catch (err) {
+      // Message only — a query error can carry row data (the requirePermission
+      // precedent). The request continues to the rank door, which denies.
+      log.error(`scouting owner check failed, falling back to the permission gate: ${err && err.message}`);
+    }
+    return curateGate(req, res, next);
+  };
+}
+
+module.exports = {
+  OWNER_MEMBERSHIP_KIND,
+  isProjectOwnerMembership,
+  hasOwnerMembership,
+  requireScoutingReader,
+};

package/modules/ui-design/kit/serve.js

@@ -125,7 +125,8 @@ const FLOW_RECEIPTS = {
   teardown: { queued: true, message: 'Teardown queued.' },
   restart: { queued: true, message: 'Restart queued.' },
   domain: { recorded: true, queued: true, message: 'Address recorded.' },
-  provision: { queued: true, message: 'Queued. The platform picks it up from here.' },
+  // the wizard's filing (task 1003346): the receipt names the instance the page then polls — Harbor, the fixture's standing-up row — and the address the page promises is the one the server assigned
+  provision: { queued: true, message: 'Queued. The platform picks it up from here.', instance: { id: 102, domain: 'mercury.cloudbongos.com' } },
   settings: { settings: { platform_visibility: 'public', joinability: 'open' }, push: { queued: true, message: 'Saved. The project restarts to apply it.' } },
 };
 // a teardown or restart ask is REMEMBERED for the run: the page re-reads the project right
@@ -218,6 +219,7 @@ const server = http.createServer((req, res) => {
       if (flow) return AUTH ? json(res, 200, flow) : json(res, 401, UNAUTH);
     }
     if (rest.startsWith('/github/repo')) return AUTH ? json(res, 200, { repo: { private: false, admin: true } }) : json(res, 401, UNAUTH);
+    if (rest.startsWith('/provisioning/slug-available')) return json(res, 200, { available: true }); /* the wizard's handle check (task 1003346): every handle is free on the stub */
     if (rest === '/auth/logout') return json(res, 200, { ok: true });
     if (rest.startsWith('/auth/web/start')) { res.writeHead(302, { location: PREFIX }); return res.end(); }
     if (rest === '/instance') { const b = pages.size ? pages.values().next().value.brand : {}; return json(res, 200, { brand: { productName: (b && b.productName) || '', project: {} }, modules: {} }); }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.424",
+  "version": "1.19.426",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.424",
+      "version": "1.19.426",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.424",
+  "version": "1.19.426",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -1386,3 +1386,66 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 @media (prefers-reduced-motion:reduce){
   *,*::before,*::after{animation:none !important;transition:none !important;}
 }
+/* ═══════════════════════════════════════════════════════════════════════
+   THE CREATE WIZARD, IN THE WORLD (task 1003346; direction record §15, the
+   pick: v1 the rail above, the bongo pair kept). The wizard keeps its markup
+   (the panels, the forms, the ids the driver and the tests pin) and takes the
+   world's grammar by SCOPE: no card ground, the six-step strip drawn as the
+   lifecycle rail, the step title lowercase in the display voice, the doors as
+   hairline pills with the accent only on the primary, the GitHub doors
+   inverted. Its own structures (the hairline fields, the choices as cells of
+   one band, the review as a ledger, the human steps, the standup rail) live
+   in projects.html's wizard block. Dark only (ADR 0204); every colour a
+   token; halos are outlines, never box-shadow.
+   ═══════════════════════════════════════════════════════════════════════ */
+#view-new .wrap{max-width:1180px;}
+#view-new .card{background:none;border-radius:0;box-shadow:none;padding:34px 0 60px;margin:0;}
+/* the six-step strip as the rail: six hairlines, a 7px dot, one lit step on the
+   accent with its halo, the number in the display voice, the name in the label
+   face; a step already answered (role=button) stays a way back */
+#view-new .steps{display:grid;grid-template-columns:repeat(6,1fr);gap:0 10px;align-items:start;margin:0 0 40px;}
+#view-new .steps li{display:block;position:relative;border-top:1px solid var(--rule);padding:12px 0 0;gap:0;}
+#view-new .steps li::before{content:"";position:absolute;top:-4px;left:0;right:auto;width:7px;height:7px;margin:0;border-radius:50%;border:1px solid var(--rule);background:var(--bg);}
+#view-new .steps .snum{display:block;width:auto;height:auto;border:0;border-radius:0;background:none;font-family:var(--font-display);font-weight:300;font-size:22px;letter-spacing:-.02em;line-height:1.1;color:var(--ink-faint);margin-bottom:2px;}
+#view-new .steps .slbl{display:block;font-family:var(--label-face);font-size:var(--label-size);font-weight:400;letter-spacing:var(--label-space);text-transform:uppercase;line-height:1.3;color:var(--ink-faint);}
+#view-new .steps li.done{border-top-color:var(--ink-soft);}
+#view-new .steps li.done::before{background:var(--ink-soft);border-color:var(--ink-soft);}
+#view-new .steps li.done .snum,#view-new .steps li.done .slbl{color:var(--ink-soft);background:none;}
+#view-new .steps li.now{border-top-color:var(--accent);}
+#view-new .steps li.now::before{background:var(--accent);border-color:var(--accent);outline:4px solid color-mix(in srgb,var(--accent) 22%,transparent);}
+#view-new .steps li.now .snum,#view-new .steps li.now .slbl{color:var(--ink);}
+#view-new .steps li[role=button]:hover .slbl{color:var(--ink);}
+/* the step: the title lowercase in the display voice, one clause, the fine
+   print in the body face; the bongo pair beside it (the owner's one mark on
+   every surface), its halo gone */
+#view-new .createSplit{align-items:start;gap:48px;}
+#view-new .bongoCell{padding-top:60px;}
+#view-new .bongos .glow{display:none;}
+#view-new .panel h1{font-weight:300;font-size:clamp(28px,3.4vw,44px);letter-spacing:-.035em;line-height:1.04;text-transform:lowercase;color:var(--ink);text-shadow:none;margin:0 0 10px;max-width:18ch;text-wrap:balance;}
+#view-new .panel .lede{font-size:15.5px;font-weight:400;line-height:1.5;color:var(--ink-soft);margin:0 0 26px;max-width:62ch;}
+#view-new .panel .lede strong,#view-new .panel .lede em{color:var(--ink);font-weight:500;font-style:normal;}
+/* the done clause's link to Your projects clears the 24px hit floor as a box (an inline's rect is its content box) */
+#view-new .panel .lede a{display:inline-block;padding:3px 0;min-height:24px;line-height:18px;color:var(--ink);font-weight:400;text-decoration:underline;text-underline-offset:3px;}
+#view-new .finePrint{font-weight:400;font-size:13.5px;line-height:1.5;color:var(--ink-soft);margin-top:18px;max-width:62ch;}
+#view-new .finePrint a{color:var(--ink);font-weight:400;text-decoration:underline;text-underline-offset:3px;}
+#view-new .finePrint em{font-style:normal;color:var(--ink);}
+#view-new .fieldNote{border:0;border-top:1px solid var(--rule);border-bottom:1px solid var(--rule);border-radius:0;text-align:left;font-weight:400;color:var(--ink-soft);}
+#view-new .linklike{font-weight:400;color:var(--ink-soft);}
+#view-new .linklike:hover{color:var(--ink);}
+/* the doors: pills, lowercase, the accent only on the one that acts; back and
+   skip as hairline pills; the GitHub sign-in inverted; no lift, no shadow */
+#view-new .btn{min-height:44px;padding:0 22px;font-family:var(--font-body);font-weight:500;font-size:15px;text-transform:lowercase;white-space:nowrap;box-shadow:none;transition:border-color .15s ease,background .15s ease,color .15s ease;}
+#view-new .btn:hover{transform:none;box-shadow:none;background:color-mix(in srgb,var(--accent) 88%,var(--ink));}
+#view-new .btn:active{transform:none;}
+#view-new .btn:disabled{background:none;border:1px solid var(--rule-soft);color:var(--ink-faint);}
+#view-new .btn.ghost{font-weight:400;color:var(--ink);background:none;border:1px solid var(--rule);}
+#view-new .btn.ghost:hover{border-color:var(--ink-faint);color:var(--ink);background:none;}
+#view-new .btn.big{width:auto;min-height:48px;font-size:16px;padding:0 26px;}
+#view-new #wizSignin{background:var(--ink);color:var(--bg);border:1px solid var(--ink);}
+#view-new #wizSignin:hover{background:color-mix(in srgb,var(--ink) 88%,var(--bg));}
+/* the error alert: the error ink between two hairlines, no plate */
+#view-new .alert{background:none;border:0;border-top:1px solid var(--err);border-bottom:1px solid var(--err);border-radius:0;padding:12px 0;font-weight:400;}
+@media (max-width:900px){
+  #view-new .steps{grid-template-columns:repeat(3,1fr);gap:18px 10px;margin-bottom:30px;}
+  #view-new .steps .snum{font-size:18px;}
+}