@bongos/core 1.19.441 → 1.19.443

package/src/module-loader/loader.js

@@ -175,32 +175,49 @@ function hallWidgetScripts({ isEnabled } = {}, opts) {
   return out;
 }
 
-// Host-routed static web surfaces contributed by enabled modules (BV1.R84, ADR 0093
-// §1 / 02-module-map §6 — a web surface is first-class). A module that owns a web
-// surface (e.g. the status dashboard at status.<apex>) declares
-// contributes.webSurfaces:[{ host:"status.", dir:"public" }] in its manifest AND
-// ships that static dir at modules/<key>/<dir>/. This returns, for each discovered +
-// ENABLED module that declares webSurfaces and actually ships the directory, the
-// SERVING descriptor serve-internal.js iterates to route by Host header:
-//   { key, host, dir } — host is the lowercase Host-header prefix; dir is the
-//   ABSOLUTE on-disk path of the static directory.
-// The Host-routed twin of mountModuleRoutes / hallWidgetScripts: an enabled module's
-// surface answers on its host, a disabled one vanishes (it's never returned, so
-// serve-internal never routes its host). No-op (empty list) until a module ships a
-// web surface — same SAFE-BY-CONSTRUCTION posture as every other seam here. Pure
-// (reads disk only). Exported + module-agnostic so serve-internal hardcodes no key.
+// Static web surfaces contributed by enabled modules (BV1.R84, ADR 0093 §1 /
+// 02-module-map §6 — a web surface is first-class). A module that owns a web surface
+// declares contributes.webSurfaces in its manifest AND ships that static dir at
+// modules/<key>/<dir>/. A surface names WHERE it answers in one of two ways, never
+// both and never neither (ADR 0218):
+//   { host: "status.", dir: "public" }  → a Host-header PREFIX (status-UI, hall-UI)
+//   { apexRoot: true,  dir: "public" }  → the APEX ROOT (public-landing) — whatever
+//                                         host is left once the subdomains are taken
+// This returns, for each discovered + ENABLED module that declares a surface and
+// actually ships the directory, the SERVING descriptor its server iterates:
+//   { key, host, dir }            — host is the lowercase Host-header prefix
+//   { key, apexRoot: true, dir }  — NO host field at all
+// dir is the ABSOLUTE on-disk path of the static directory in both shapes.
+//
+// `host: ""` is REJECTED, not treated as "the root" (ADR 0218 §3): the routers match
+// with host.startsWith(s.host), and every string starts with "" — an empty prefix
+// would answer on builders./status. too and make isModuleSurfaceHost() true for every
+// request, which is the predicate the hall's own /builders guards use to step aside.
+// A boolean cannot be mistaken for a prefix, so apex-root says so with a flag.
+//
+// The twin of mountModuleRoutes / hallWidgetScripts: an enabled module's surface
+// answers, a disabled one vanishes (it's never returned, so nothing routes it — for
+// the apex root that means the front door is simply gone and the 404 tail answers).
+// No-op (empty list) until a module ships a web surface — same SAFE-BY-CONSTRUCTION
+// posture as every other seam here. Pure (reads disk only). Exported + module-agnostic
+// so both servers hardcode no key.
 function moduleWebSurfaces({ isEnabled } = {}, opts) {
   const out = [];
   for (const { key, dir, manifest } of discovered(opts).loaded) {
     if (typeof isEnabled === 'function' && !isEnabled(key)) continue;
     const surfaces = (manifest.contributes && manifest.contributes.webSurfaces) || [];
     for (const s of surfaces) {
-      if (!s || typeof s.host !== 'string' || typeof s.dir !== 'string') continue;
+      if (!s || typeof s.dir !== 'string') continue;
+      const apexRoot = s.apexRoot === true;
+      const hasHost = typeof s.host === 'string' && s.host !== '';
+      // exactly one of the two, never both and never neither — and `host: ""` counts
+      // as NEITHER, which is what keeps an empty prefix from matching every host
+      if (apexRoot === hasHost) continue;
       const abs = path.join(dir, s.dir);
       let isDir = false;
       try { isDir = fs.statSync(abs).isDirectory(); } catch { isDir = false; }
-      if (!isDir) continue; // declared but not shipped → skip (no host routed)
-      out.push({ key, host: s.host.toLowerCase(), dir: abs });
+      if (!isDir) continue; // declared but not shipped → skip (nothing routed)
+      out.push(apexRoot ? { key, apexRoot: true, dir: abs } : { key, host: s.host.toLowerCase(), dir: abs });
     }
   }
   return out;

package/src/module-loader/manifest-schema.js

@@ -34,7 +34,9 @@
 //       "disciplines": ["artist"],      //   disciplines this module adds
 //       "skills":      ["otb-…"],       //   slash-command skills it ships
 //       "uiSections":  ["boxes"],       //   hall/status UI sections it owns
-//       "webSurfaces": [{ "host": "status.", "dir": "public" }], // host-routed static web surfaces (BV1.R84)
+//       "webSurfaces": [{ "host": "status.", "dir": "public" }], // static web surfaces. Each names a Host
+//                                       //   PREFIX (BV1.R84) or, as { "apexRoot": true, "dir": "public" },
+//                                       //   the APEX ROOT — never both (ADR 0218).
 //       "migrations":  true             //   true => modules/<key>/migrations/ exists (or an array of names)
 //     },
 //     "provides":      ["reward"],      // OPTIONAL. seam PORTS this module registers a provider for.
@@ -84,13 +86,19 @@ const isObj = (v) => v && typeof v === 'object' && !Array.isArray(v);
 const isStr = (v) => typeof v === 'string' && v.length > 0;
 const isStrArray = (v) => Array.isArray(v) && v.every(isStr);
 
-// A webSurface entry: { host: "<subdomain-prefix>.", dir: "<static-dir-rel-to-module>" }.
-// `host` is the lowercase Host-header prefix the surface answers on (e.g. "status."
-// → status.<apex>); `dir` is the module-relative directory of static files to serve
-// (e.g. "public"). Both required, non-empty strings; `dir` must stay inside the
-// module (no absolute / "..").
+// A webSurface entry names WHERE the surface answers, in exactly one of two ways
+// (ADR 0218), plus the module-relative directory of static files to serve:
+//   { host: "status.", dir: "public" }  — a lowercase Host-header PREFIX (status.<apex>)
+//   { apexRoot: true,  dir: "public" }  — the APEX ROOT: whatever host is left once
+//                                         the subdomains are taken (the front door)
+// `dir` is required, non-empty, and must stay inside the module (no absolute / "..").
+// A host surface's `host` must be a NON-EMPTY string: routers match with
+// host.startsWith(host), and every string starts with "", so an empty prefix would
+// answer on every host and silently swallow the other surfaces. That is exactly why
+// the apex root is a boolean flag and not the empty prefix it superficially resembles.
+const isWebSurfaceDir = (v) => isStr(v.dir) && !v.dir.startsWith('/') && !v.dir.split(/[\\/]/).includes('..');
 const isWebSurface = (v) =>
-  isObj(v) && isStr(v.host) && isStr(v.dir) && !v.dir.startsWith('/') && !v.dir.split(/[\\/]/).includes('..');
+  isObj(v) && isWebSurfaceDir(v) && (v.apexRoot === true ? !('host' in v) : isStr(v.host));
 const isWebSurfaceArray = (v) => Array.isArray(v) && v.every(isWebSurface);
 
 function validateManifest(obj) {
@@ -172,7 +180,7 @@ function validateManifest(obj) {
       }
     }
     if ('webSurfaces' in obj.contributes && !isWebSurfaceArray(obj.contributes.webSurfaces)) {
-      E('contributes.webSurfaces: must be an array of { host: "<prefix>.", dir: "<module-relative dir>" } objects (dir inside the module, no absolute path or "..")');
+      E('contributes.webSurfaces: must be an array of { host: "<prefix>.", dir: "<module-relative dir>" } or { apexRoot: true, dir: "<module-relative dir>" } objects — a surface names a Host prefix OR the apex root, never both and never neither (ADR 0218); dir stays inside the module (no absolute path or "..")');
     }
     if ('migrations' in obj.contributes) {
       const m = obj.contributes.migrations;

package/src/platform-server.js

@@ -54,13 +54,40 @@ const { logger, requestIdMiddleware } = require('./bongos/logger');
 const PORT = Number(process.env.PORT) || 3000;
 const HOST = process.env.HOST || '127.0.0.1';
 
-// The apex landing page — a game-less instance's home (replaces the bare 404 the
-// apex host used to serve). A deliberately MINIMAL placeholder: the mascot + a
-// way into the Builders' Hall; the full landing is its own task. Served only on
-// the apex host (status./builders. are handled by mountInternalSurfaces). The
-// branding pack is injected once at boot (theme + window.__BRANDING__), exactly
-// as the hall pages are, so the look + identity come from config, not hardcode.
-const LANDING_DIR = path.join(__dirname, '..', 'public-landing');
+// The apex front door — a game-less instance's home (it replaced the bare 404 the
+// apex host used to serve). Served only on the apex host; status./builders. are
+// handled by mountInternalSurfaces. The branding pack is injected once at boot
+// (theme + window.__BRANDING__), exactly as the hall pages are, so the look and the
+// identity come from config, never from hardcode.
+//
+// THE SURFACE IS A MODULE (task 1003322, ADR 0218). The front door used to be a
+// hardcoded path here; it is now modules/public-landing/public/, resolved through the
+// loader's web-surface seam by the APEX-ROOT declaration ({ apexRoot: true, dir }) —
+// the one shape that seam grew for it, because the apex is not a Host PREFIX like
+// "status."/"builders." but whatever is left once the subdomains are taken.
+//
+// Resolved by PREDICATE, never by key: this file names no module (ADR 0083 §Decision
+// #4), so an instance shipping its own front door gets the apex by declaring apexRoot.
+// Lazy + memoised so importing this module reads no disk and a test can build the app
+// after setting up its own module state.
+//
+// null when NO enabled module claims the apex root — the module is disabled, or the
+// instance ships no landing at all. Every consumer below already treats an absent page
+// as "fall through", so the front door simply vanishes and the 404 tail answers.
+let _landingDir;
+function landingDir() {
+  if (_landingDir === undefined) {
+    // The apex root is singular by definition — two modules cannot both be "everything
+    // that is not a subdomain". Serve the first and SAY so, rather than silently
+    // shadowing one of them.
+    const claims = moduleLoader.moduleWebSurfaces({ isEnabled: isModuleEnabled }).filter((s) => s.apexRoot);
+    if (claims.length > 1) {
+      logger.warn({ keys: claims.map((s) => s.key) }, 'more than one enabled module declares an apex-root web surface — serving the first');
+    }
+    _landingDir = claims.length ? claims[0].dir : null;
+  }
+  return _landingDir;
+}
 // ── CONTENT-STAMPED STATIC ASSETS (task 1002766) ──
 // The landing HTML is `cf-cache-status: DYNAMIC` and never cached, but the
 // assets it references come back `Cache-Control: public, max-age=14400` — four
@@ -80,7 +107,7 @@ const LANDING_DIR = path.join(__dirname, '..', 'public-landing');
 // shape serve-internal.js already stamps onto the hall's own scripts.
 //
 // Stamped by RESOLUTION, not by a path allow-list: a URL is an asset if it
-// actually names a file under public-landing/. Routes (`/projects`, `/create`)
+// actually names a file under the landing surface. Routes (`/projects`, `/create`)
 // and API paths resolve to nothing and are left alone, so a new asset is
 // stamped the day it is added and nobody has to remember to list it.
 const _assetStamps = new Map();
@@ -88,9 +115,10 @@ function assetStamp(url) {
   if (!_assetStamps.has(url)) {
     let v = '';
     try {
-      const abs = path.resolve(LANDING_DIR, '.' + url);
+      const root = landingDir();
+      const abs = path.resolve(root, '.' + url);
       // never let a template's own text walk out of the landing dir
-      if (abs.startsWith(LANDING_DIR + path.sep)) {
+      if (abs.startsWith(root + path.sep)) {
         v = require('node:crypto').createHash('sha256')
           .update(fs.readFileSync(abs)).digest('hex').slice(0, 8);
       }
@@ -112,14 +140,14 @@ function landingPage(file) {
     try {
       // stamped LAST, so anything a later transform introduces is stamped too
       html = stampAssets(injectBrandingGlobal(stripApexOnly(
-        fs.readFileSync(path.join(LANDING_DIR, file), 'utf8'))));
-    } catch { /* absent → '' */ }
+        fs.readFileSync(path.join(landingDir(), file), 'utf8'))));
+    } catch { /* absent, or no module claims the apex root → '' */ }
     _landingPages.set(file, html);
   }
   return _landingPages.get(file);
 }
 
-// THE APEX CONDITIONAL (task 1002748). public-landing/ ships wholesale to every
+// THE APEX CONDITIONAL (task 1002748). The landing surface ships wholesale to every
 // instance, so one file has to render two shapes: the platform's own front door,
 // and a child project's. Sections that are true only of the platform — the
 // catalog of OTHER instances, the "capture-resistant commons" claim, the door
@@ -231,11 +259,15 @@ function buildPlatformApp() {
       res.type('html').send(html);
     });
   }
-  const landingAssets = express.static(LANDING_DIR, { index: false, fallthrough: true });
-  app.use((req, res, next) => {
-    if (!isApexHost(req)) return next();
-    return landingAssets(req, res, next);
-  });
+  // Assets fall through to the 404 tail when no module claims the apex root — the
+  // handler is not mounted at all rather than pointed at a missing directory.
+  const landingAssets = landingDir() && express.static(landingDir(), { index: false, fallthrough: true });
+  if (landingAssets) {
+    app.use((req, res, next) => {
+      if (!isApexHost(req)) return next();
+      return landingAssets(req, res, next);
+    });
+  }
 
   // Non-game tail. Anything that did not resolve to /api/gds, the status host,
   // or the builders' hall lands here. There is NO game to fall through to, so:

package/tests/cosmos_token_contrast.mjs

@@ -1,6 +1,6 @@
 // Guards the WCAG AA contrast of the cosmos.css token layer (task 1002749).
 //
-// The tokens are the ONLY input here: this test PARSES public-landing/assets/cosmos.css
+// The tokens are the ONLY input here: this test PARSES the landing surface’s assets/cosmos.css
 // and resolves var()/color-mix() itself, so it measures what the surfaces actually paint.
 // Duplicating the hex values would prove nothing.
 //
@@ -13,10 +13,10 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-const CSS = path.join(
-  path.dirname(fileURLToPath(import.meta.url)),
-  '..', 'public-landing', 'assets', 'cosmos.css'
-);
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+// the front door is a module since task 1003322 (ADR 0218) — one constant, so the path moves once
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const CSS = path.join(LANDING, 'assets', 'cosmos.css');
 const src = fs.readFileSync(CSS, 'utf8');
 
 // The two sheets that actually ship, comment-stripped. Several static guards
@@ -76,7 +76,7 @@ const darkMedia = declarations(blockAfter(':root:not([data-mode="light"]){'));
 // The dark blocks are :root[data-mode="dark"] and :root:not([data-mode="light"]) —
 // both (0,2,0) — so they outrank the pack's (0,1,0) and win back.
 const packColors = JSON.parse(
-  fs.readFileSync(path.join(path.dirname(CSS), '..', '..', 'config', 'branding.neutral.json'), 'utf8')
+  fs.readFileSync(path.join(ROOT, 'config', 'branding.neutral.json'), 'utf8')
 ).theme.ui.colors;
 
 // mirrors COLOR_VARS in src/bongos/serve-internal.js

package/tests/fitness.mjs

@@ -660,6 +660,26 @@ test('identity gate skips comments + instance-injected tokens (no false positive
   assert.equal(scanPromptIdentity('x.html', '<title>{{worldName}} — the gate</title>').length, 0, 'a {{worldName}} token carries no literal');
 });
 
+// task 1003322 / ADR 0218 — the front door became modules/public-landing/, which put
+// the landing pages under this gate for the first time. Its apex-only regions name
+// the projects HOSTED on the hub; the server deletes them on every non-hub instance
+// (stripApexOnly), so they cannot produce the failure this gate names — "a non-OTB
+// instance renders ITS OWN brand". Everything outside the sentinels still fails.
+test('identity gate: an apex-only region is exempt, and only that region (ADR 0218)', () => {
+  const { scanPromptIdentity } = fitness;
+  const inside = '<ul>\n<!--apex-only:start-->\n<li>Off the Boats</li>\n<!--apex-only:end-->\n</ul>';
+  assert.equal(scanPromptIdentity('x.html', inside).length, 0, 'a literal the server strips on a child instance is exempt');
+
+  const outside = '<h1>Off the Boats</h1>\n<!--apex-only:start-->\n<li>ok</li>\n<!--apex-only:end-->';
+  const hits = scanPromptIdentity('x.html', outside);
+  assert.equal(hits.length, 1, 'a literal OUTSIDE the sentinels still fails — the exemption is the region, not the file');
+  assert.match(hits[0], /^x\.html:1 /, 'blanking preserves line numbers so the violation still points at the real line');
+
+  // an UNCLOSED start sentinel must not blank the rest of the file into silence
+  const unclosed = '<!--apex-only:start-->\n<li>ok</li>\n<h1>Off the Boats</h1>';
+  assert.equal(scanPromptIdentity('x.html', unclosed).length, 1, 'an unterminated region exempts nothing');
+});
+
 // task 1002756 — the two holes that let migrate.sh's founder DB default survive:
 // (1) the stripper could be OPENED by a `/*` inside a `//` line comment (a real
 // `*/` hundreds of lines later then swallowed everything between — provision.js

package/tests/landing_legal_pages.mjs

@@ -22,7 +22,8 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const LANDING = path.join(ROOT, 'public-landing');
+// the front door is a module since task 1003322 (ADR 0218) — one constant, so the path moves once
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 const read = (f) => fs.readFileSync(path.join(LANDING, f), 'utf8');
 
 const platformMod = require('../src/platform-server.js');

package/tests/landing_page.mjs

@@ -40,8 +40,10 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const HTML = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8');
-const WORLD = fs.readFileSync(path.join(ROOT, 'public-landing', 'assets', 'world.css'), 'utf8');
+// the front door is a module since task 1003322 (ADR 0218) — one constant, so the path moves once
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HTML = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8');
+const WORLD = fs.readFileSync(path.join(LANDING, 'assets', 'world.css'), 'utf8');
 
 const { stripApexOnly } = require('../src/platform-server.js');
 const { applyBrandTokens } = require('../src/bongos/serve-internal.js');
@@ -186,8 +188,8 @@ test('the social card is the world card, stamped onto THIS instance', () => {
     assert.equal(m[1], 'https://spike-harbor.example/assets/world/og-card.jpg');
   }
   assert.ok(
-    fs.existsSync(path.join(ROOT, 'public-landing', 'assets', 'world', 'og-card.jpg')),
-    'the og card the head names must exist under public-landing/',
+    fs.existsSync(path.join(LANDING, 'assets', 'world', 'og-card.jpg')),
+    'the og card the head names must exist under the landing surface',
   );
 });
 
@@ -210,7 +212,7 @@ test('a pack with no hall of its own falls back to its own apex, not the platfor
 
 test('a pack with NO domains drops the hall pill server-side rather than stamping href="" (task 1003242)', () => {
   // the hub has no client scrubber, so an empty token must never reach it as a dead link
-  const HUB = fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.html'), 'utf8');
+  const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
   assert.match(HUB, /data-link-hall href="\{\{buildersOrigin\}\}"/, 'the hub pill is token-stamped');
   const none = applyBrandTokens(HUB, BRAND, '', '');
   assert.doesNotMatch(none, /href=""/, 'no empty href survives the stamp');

package/tests/module-scope-map.mjs

@@ -100,7 +100,7 @@ test('provisioning + public-landing joined the roster (task 1002690) — territo
   const prov = scope.globsForModules(['provisioning']);
   assert.ok(prov.includes('modules/provisioning/'), 'provisioning owns its module directory');
   assert.ok(prov.includes('scripts/gds/provision.js'), 'the control-plane runner travels with its domain');
-  assert.ok(scope.globsForModules(['public-landing']).includes('public-landing/'), 'public-landing owns its surface directory');
+  assert.ok(scope.globsForModules(['public-landing']).includes('modules/public-landing/'), 'public-landing owns its surface directory');
 });
 
 test('platform-identity joined the roster (task 1002322) — the catalog territory goal 1000046 walls', () => {
@@ -127,7 +127,7 @@ test('platform-identity joined the roster (task 1002322) — the catalog territo
     'modules/platform-identity/routes/projects.js',     // the feed + invite routes
     'modules/status-ui/public/explore.js',              // orb render-type surface
     'modules/hall-ui/public/my-projects.js',            // owner settings / applications queue
-    'public-landing/projects.html',                     // the creation step, ?view=new since task 1002763
+    'modules/public-landing/public/projects.html',                     // the creation step, ?view=new since task 1002763
     'modules/provisioning/',                            // module-bundle selection at provision time
   ]) {
     assert.equal(covers(touch), true, `wall does not cover ${touch}`);

package/tests/module_loader.mjs

@@ -179,6 +179,9 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // And ui-design (task 1003324 / ADR 0197) — the design contract, its adapters
   // and the /design playbook as a platform capability: declaration-only (three
   // skills, no routes/port), default-on because every instance has a face.
+  // And public-landing (task 1003322 / ADR 0218) — the front door, the THIRD web
+  // surface after status-ui and hall-ui and the first to declare apexRoot instead
+  // of a Host prefix; default-on because every instance answers at its own apex.
   // All are discovered; none has validation
   // errors or coreVersion mismatches. Order is the readdir sort.
   //
@@ -203,7 +206,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'dev-box', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'security', 'sessions', 'status-ui', 'ui-design']);
+  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'dev-box', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'public-landing', 'security', 'sessions', 'status-ui', 'ui-design']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();

package/tests/onboard.mjs

@@ -64,7 +64,7 @@ test('every form OFFERS the optional step and names what skipping costs — skil
   assert.match(cli, /off the public map/, 'and says what a missing description means');
 
   // the web form
-  const hub = read('public-landing/projects.html');
+  const hub = read('modules/public-landing/public/projects.html');
   assert.match(hub, /id="panel-detail"/, 'the wizard ships the panel');
   assert.match(hub, /id="skipDetail"/, 'with a skip control of its own');
 
@@ -168,7 +168,7 @@ test('every render surface carries the terminal hall step (task 1002703)', () =>
   const cli = read('scripts/gds/onboard.js');
   assert.match(cli, /builders hall/i, 'the CLI walkthrough ends at the hall');
   assert.match(cli, /bongos dev/, 'the CLI offers the local-hall one-liner when no domain');
-  const hubHtml = read('public-landing/projects.html');
+  const hubHtml = read('modules/public-landing/public/projects.html');
   const enterHall = hubHtml.match(/data-onboard-step="enter-hall"[^]*?<\/li>/g) || [];
   assert.ok(enterHall.length >= 1, 'the ?view=new wizard tags the enter-hall step');
   assert.match(enterHall.join(''), /\/builders/, 'the wizard points at the hall address');
@@ -180,7 +180,7 @@ test('the wizard done panel is plan-driven, manifest-driven, and owner-honest (t
   // The wizard lives inside the hub page since task 1002763.
   const { readFileSync } = require('node:fs');
   const path = require('node:path');
-  const src = readFileSync(path.join(import.meta.dirname, '..', 'public-landing/projects.html'), 'utf8');
+  const src = readFileSync(path.join(import.meta.dirname, '..', 'modules/public-landing/public/projects.html'), 'utf8');
   // gap 2 (idea 1000675): the checklist renders FROM the canonical plan endpoint
   assert.match(src, /provisioning\/onboard-plan/, 'the done panel fetches the canonical plan');
   // gap 3 (idea 1000676): the ADR 0133 one-click manifest flow has a UI caller again
@@ -203,7 +203,7 @@ test('the wizard gate trust link points at a live artifact, not the dead private
   // "open source" is the license itself.
   const { readFileSync } = require('node:fs');
   const path = require('node:path');
-  const src = readFileSync(path.join(import.meta.dirname, '..', 'public-landing/projects.html'), 'utf8');
+  const src = readFileSync(path.join(import.meta.dirname, '..', 'modules/public-landing/public/projects.html'), 'utf8');
   assert.doesNotMatch(src, /Claude-OTB/, 'the dead repo link is gone');
   assert.match(src, /https:\/\/www\.gnu\.org\/licenses\/agpl-3\.0/, 'the trust link resolves (the AGPL-3.0 license text)');
 });
@@ -266,7 +266,7 @@ test('the web form (?view=new) declares EXACTLY the canonical human steps — dr
   const path = require('node:path');
   const humanKeys = ob.onboardPlan().filter((s) => s.kind === 'human').map((s) => s.key).sort();
   const surfaces = {
-    '/projects?view=new wizard': 'public-landing/projects.html',
+    '/projects?view=new wizard': 'modules/public-landing/public/projects.html',
   };
   for (const [name, rel] of Object.entries(surfaces)) {
     const src = readFileSync(path.join(import.meta.dirname, '..', rel), 'utf8');