@bongos/core 1.19.442 → 1.19.444

package/tests/credit_grant.mjs

@@ -588,6 +588,242 @@ await test('cost-plus-only cascade: a 0 per-task credit → idea-promotion slice
   assert.equal(client.queries.length, 0, 'no lineage lookup, no bonus INSERT when the base credit is 0');
 });
 
+// =========================================================================
+// (7) task 1003435 — a PARALLEL session (one claim, several subagents).
+//
+// The cost ledger has always billed a session's subagents subtree in its own
+// `session:subagent` cost_log row, but model_usage — the reward's only input —
+// was built from ONE file, the interactive transcript. So a builder who followed
+// CLAUDE.md's "delegate freely" moved most of a session's real spend into a
+// bucket the reward could not see, and the two ledgers described different
+// sessions.
+//
+// The acceptance test is that RECONCILIATION: what the reward prices must equal
+// what the ledger bills, within independent-rounding epsilon. It runs both real
+// pricing paths over the same on-disk fixture rather than asserting a hand-typed
+// number on either side, so a change to one that is not made to the other reds.
+// =========================================================================
+
+const fs = require('node:fs');
+const os = require('node:os');
+const nodePath = require('node:path');
+const { priceTranscript, priceSubagents, buildCostRows } = require('../scripts/gds/session-cost.js');
+const { buildSessionDigest } = require('../scripts/gds/session-digest-build.js');
+const { foldSubagentUsage } = require('../scripts/gds/ship-session-upload.js');
+const { priceModelUsage } = require('../src/bongos/llm-pricing.js');
+
+const PARALLEL_SID = 'sess-parallel';
+
+// One assistant transcript line. `id` is the API call's identity — two lines
+// sharing one are ONE call, which is what makes the dedup assertion below real.
+function asstLine(id, model, usage) {
+  return JSON.stringify({
+    type: 'assistant',
+    timestamp: '2026-08-30T00:00:00.000Z',
+    message: { id, model, usage, content: [{ type: 'text', text: 'work' }] },
+  });
+}
+function userLine(text) {
+  return JSON.stringify({
+    type: 'user',
+    timestamp: '2026-08-30T00:00:00.000Z',
+    message: { role: 'user', content: text },
+  });
+}
+function parseJsonlText(raw) {
+  return raw.split('\n').filter((l) => l.trim()).map((l) => JSON.parse(l));
+}
+
+// A session that spawned three subagents, one of them a grader. Mirrors the real
+// on-disk layout: the interactive transcript is a FILE, and the subagents live in
+// a sibling DIRECTORY named for the session id.
+function makeParallelFixture() {
+  const dir = fs.mkdtempSync(nodePath.join(os.tmpdir(), 'otb-parallel-'));
+  const mainPath = nodePath.join(dir, `${PARALLEL_SID}.jsonl`);
+  // opus: 150k in / 30k out / 1.5M read / 40k write = $0.75+$0.75+$0.75+$0.25 = $2.50.
+  // m1 is written twice (one API call, two content blocks) — priced ONCE.
+  const dup = asstLine('m1', 'claude-opus-4-8', {
+    input_tokens: 100_000, output_tokens: 20_000,
+    cache_read_input_tokens: 1_000_000, cache_creation_input_tokens: 40_000,
+  });
+  fs.writeFileSync(mainPath, [
+    userLine('ship task 1003435'),
+    dup,
+    dup,
+    asstLine('m2', 'claude-opus-4-8', {
+      input_tokens: 50_000, output_tokens: 10_000,
+      cache_read_input_tokens: 500_000, cache_creation_input_tokens: 0,
+    }),
+  ].join('\n'));
+
+  const subagents = nodePath.join(dir, PARALLEL_SID, 'subagents');
+  const nested = nodePath.join(subagents, 'nested');
+  fs.mkdirSync(nested, { recursive: true });
+  // opus subagent: 200k in / 40k out / 2M read = $1.00+$1.00+$1.00 = $3.00
+  fs.writeFileSync(nodePath.join(subagents, 'agent-a.jsonl'), [
+    userLine('audit the pricing path'),
+    asstLine('a1', 'claude-opus-4-8', {
+      input_tokens: 200_000, output_tokens: 40_000, cache_read_input_tokens: 2_000_000,
+    }),
+  ].join('\n'));
+  // sonnet subagent, one level deeper — the walk is recursive:
+  // 100k in / 20k out / 1M read = $0.20+$0.20+$0.20 = $0.60
+  fs.writeFileSync(nodePath.join(nested, 'agent-b.jsonl'), [
+    userLine('read the ledger rows'),
+    asstLine('b1', 'claude-sonnet-5', {
+      input_tokens: 100_000, output_tokens: 20_000, cache_read_input_tokens: 1_000_000,
+    }),
+  ].join('\n'));
+  // A GRADER worker nested in the subagents dir. Its $5.00 is already captured via
+  // the worker envelope, so pricing it here would double-count (ADR 0028).
+  fs.writeFileSync(nodePath.join(nested, 'grader-worker.jsonl'), [
+    userLine('You are the **Hacker** — a specialist adversarial subagent. Find the holes.'),
+    asstLine('g1', 'claude-opus-4-8', { input_tokens: 1_000_000 }),
+  ].join('\n'));
+
+  return { dir, mainPath, sessionDir: nodePath.join(dir, PARALLEL_SID) };
+}
+
+const fixture = makeParallelFixture();
+const INTERACTIVE_USD = 2.50;
+const SUBAGENT_USD = 3.60;
+const SESSION_USD = INTERACTIVE_USD + SUBAGENT_USD; // $6.10
+// Each cost_log row is rounded to 4dp independently and priceModelUsage rounds
+// its own total, so the two sides may disagree by a rounding step per row.
+const EPSILON = 0.0002;
+
+// The digest the ship uploads for this session, subagents folded in.
+function parallelDigest() {
+  const digest = buildSessionDigest(parseJsonlText(fs.readFileSync(fixture.mainPath, 'utf8')));
+  foldSubagentUsage(digest, fixture.mainPath, PARALLEL_SID);
+  return digest;
+}
+
+await test('1003435 the cost ledger bills interactive + subagent, grader excluded', () => {
+  const inter = priceTranscript(fixture.mainPath);
+  const sub = priceSubagents(fixture.sessionDir);
+  assert.equal(Math.round(inter.total * 100) / 100, INTERACTIVE_USD, 'm1 priced once, not twice');
+  assert.equal(Math.round(sub.subagentTotal * 100) / 100, SUBAGENT_USD);
+  assert.equal(sub.subagentFiles, 2);
+  assert.equal(sub.graderSkipped, 1, 'the grader worker is skipped by signature');
+  const built = buildCostRows({ sessionId: PARALLEL_SID, inter, sub });
+  assert.equal(built.rows.length, 2, 'one :interactive row + one :subagent row');
+  assert.equal(Math.round(built.rowsTotal * 100) / 100, SESSION_USD);
+});
+
+await test('1003435 model_usage now carries the subagents subtree, grader excluded', () => {
+  const digest = parallelDigest();
+  const models = Object.keys(digest.metrics.model_usage).sort();
+  assert.deepEqual(models, ['claude-opus-4-8', 'claude-sonnet-5'],
+    'the sonnet subagent reached model_usage, which only the fold can do');
+  assert.equal(digest.metrics.subagent_files, 2);
+  assert.equal(digest.metrics.subagent_grader_skipped, 1);
+  // The grader's 1M opus input tokens must be in NEITHER ledger.
+  assert.equal(digest.metrics.model_usage['claude-opus-4-8'].input, 350_000,
+    '150k interactive + 200k subagent — the grader\'s 1M is not counted');
+});
+
+await test('1003435 detail + total_tokens stay the INTERACTIVE thread\'s record', () => {
+  const interactiveOnly = buildSessionDigest(
+    parseJsonlText(fs.readFileSync(fixture.mainPath, 'utf8'))
+  );
+  const digest = parallelDigest();
+  // The fold is model_usage ONLY: detail and the turn/token metrics feed the BFG
+  // corpus + inefficiency evaluator, which reason about ONE agent's turn-by-turn
+  // behaviour. Splicing N subagent transcripts into that would distort the very
+  // signal they measure, so the subagent_* counters carry the difference instead.
+  assert.equal(digest.detail.length, interactiveOnly.detail.length);
+  assert.equal(digest.totalTokens, interactiveOnly.totalTokens);
+  assert.equal(digest.metrics.assistant_turns, interactiveOnly.metrics.assistant_turns);
+});
+
+await test('1003435 ACCEPTANCE: the reward reconciles with the session\'s cost_log rows', () => {
+  const inter = priceTranscript(fixture.mainPath);
+  const sub = priceSubagents(fixture.sessionDir);
+  const ledgerUsd = buildCostRows({ sessionId: PARALLEL_SID, inter, sub }).rowsTotal;
+  const rewardUsd = priceModelUsage(parallelDigest().metrics.model_usage).true_cost_usd;
+  assert.ok(Math.abs(rewardUsd - ledgerUsd) <= EPSILON,
+    `reward priced $${rewardUsd} but the ledger billed $${ledgerUsd}`);
+});
+
+await test('1003435 a parallel session is PAID for its subagents', async () => {
+  const client = fakeClient();
+  client.enqueue(NO_PRIOR);
+  client.enqueue([{ id: 99 }]);
+  const digest = parallelDigest();
+  const res = await awardSessionTokenReward(
+    client, 7, PARALLEL_SID, digest.metrics.model_usage, digest.totalTokens
+  );
+  assert.equal(res.awarded, true);
+  assert.equal(res.trueCostUsd, SESSION_USD);
+  assert.equal(res.drachmae, Math.round(SESSION_USD * 1.20)); // $6.10 × 1.20 = 7.32 → 7
+  // The bug this closes: interactive-only priced the same session at $2.50 → 3.
+  const before = computeSessionTokenReward(INTERACTIVE_USD).drachmae;
+  assert.ok(res.drachmae > before, `subagent-blind reward was ${before}, now ${res.drachmae}`);
+});
+
+await test('1003435 a re-ship of the same session is still a no-op (one award per session)', async () => {
+  const digest = parallelDigest();
+  const client = fakeClient();
+  // The watermark already holds everything this session is worth.
+  client.enqueue(ledger(Math.round(SESSION_USD * 1.20), 0));
+  const res = await awardSessionTokenReward(
+    client, 7, PARALLEL_SID, digest.metrics.model_usage, digest.totalTokens
+  );
+  assert.equal(res.awarded, false);
+  assert.equal(res.drachmae, 0);
+  assert.equal(client.queries.length, 1, 'SELECT only — a second upload must not pay again');
+});
+
+await test('1003435 a traversing session id folds NOTHING (the walk feeds a payout)', () => {
+  // The id is interpolated into a filesystem path whose contents get priced, so
+  // a `../` value could aim the walk at another directory and fold fabricated
+  // tokens into the reward. The on-ship caller screens the id before resolving
+  // the transcript; the SessionEnd hook takes it straight off stdin — so the
+  // guard lives in foldSubagentUsage, where every caller gets it.
+  const entries = parseJsonlText(fs.readFileSync(fixture.mainPath, 'utf8'));
+  const clean = buildSessionDigest(entries).metrics.model_usage;
+  for (const hostile of ['../' + PARALLEL_SID, `${PARALLEL_SID}/..`, 'a/../../etc', '']) {
+    const digest = foldSubagentUsage(buildSessionDigest(entries), fixture.mainPath, hostile);
+    assert.deepEqual(digest.metrics.model_usage, clean, `folded for id ${JSON.stringify(hostile)}`);
+    assert.equal(digest.metrics.subagent_files, undefined);
+  }
+  // …and the legitimate id still folds, so the guard is not just refusing everything.
+  const ok = foldSubagentUsage(buildSessionDigest(entries), fixture.mainPath, PARALLEL_SID);
+  assert.equal(ok.metrics.subagent_files, 2);
+});
+
+await test('1003435 usageOnly changes what is BUILT, never what is COUNTED', () => {
+  // The fold reuses buildSessionDigest so the token semantics — dedup by
+  // message.id, skip <synthetic>, fold unlabeled turns — have ONE home. usageOnly
+  // only drops the per-turn rows it would discard (and their snippet scrubbing,
+  // which the SessionEnd watchdog gives a hard time budget). If it ever changed a
+  // count, the reward and the ledger would quietly diverge again.
+  const entries = parseJsonlText(fs.readFileSync(fixture.mainPath, 'utf8'));
+  const full = buildSessionDigest(entries);
+  const lean = buildSessionDigest(entries, { usageOnly: true });
+  assert.deepEqual(lean.metrics.model_usage, full.metrics.model_usage);
+  assert.equal(lean.totalTokens, full.totalTokens);
+  assert.equal(lean.metrics.assistant_turns, full.metrics.assistant_turns);
+  assert.equal(lean.metrics.api_calls, full.metrics.api_calls);
+  assert.deepEqual(lean.detail, [], 'the detail rows are what usageOnly skips');
+  assert.ok(full.detail.length > 0);
+});
+
+await test('1003435 a session with no subagents is untouched (no regression)', () => {
+  const dir = fs.mkdtempSync(nodePath.join(os.tmpdir(), 'otb-solo-'));
+  const mainPath = nodePath.join(dir, 'sess-solo.jsonl');
+  fs.writeFileSync(mainPath, asstLine('s1', 'claude-opus-4-8', { input_tokens: 110_000 }));
+  const entries = parseJsonlText(fs.readFileSync(mainPath, 'utf8'));
+  const before = buildSessionDigest(entries);
+  const after = foldSubagentUsage(buildSessionDigest(entries), mainPath, 'sess-solo');
+  assert.deepEqual(after.metrics.model_usage, before.metrics.model_usage);
+  assert.equal(after.metrics.subagent_files, undefined, 'no counters when there is nothing to count');
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+fs.rmSync(fixture.dir, { recursive: true, force: true });
+
 // -------------------------------------------------------------------------
 // runner summary
 // -------------------------------------------------------------------------

package/tests/fitness.mjs

@@ -660,6 +660,26 @@ test('identity gate skips comments + instance-injected tokens (no false positive
   assert.equal(scanPromptIdentity('x.html', '<title>{{worldName}} — the gate</title>').length, 0, 'a {{worldName}} token carries no literal');
 });
 
+// task 1003322 / ADR 0218 — the front door became modules/public-landing/, which put
+// the landing pages under this gate for the first time. Its apex-only regions name
+// the projects HOSTED on the hub; the server deletes them on every non-hub instance
+// (stripApexOnly), so they cannot produce the failure this gate names — "a non-OTB
+// instance renders ITS OWN brand". Everything outside the sentinels still fails.
+test('identity gate: an apex-only region is exempt, and only that region (ADR 0218)', () => {
+  const { scanPromptIdentity } = fitness;
+  const inside = '<ul>\n<!--apex-only:start-->\n<li>Off the Boats</li>\n<!--apex-only:end-->\n</ul>';
+  assert.equal(scanPromptIdentity('x.html', inside).length, 0, 'a literal the server strips on a child instance is exempt');
+
+  const outside = '<h1>Off the Boats</h1>\n<!--apex-only:start-->\n<li>ok</li>\n<!--apex-only:end-->';
+  const hits = scanPromptIdentity('x.html', outside);
+  assert.equal(hits.length, 1, 'a literal OUTSIDE the sentinels still fails — the exemption is the region, not the file');
+  assert.match(hits[0], /^x\.html:1 /, 'blanking preserves line numbers so the violation still points at the real line');
+
+  // an UNCLOSED start sentinel must not blank the rest of the file into silence
+  const unclosed = '<!--apex-only:start-->\n<li>ok</li>\n<h1>Off the Boats</h1>';
+  assert.equal(scanPromptIdentity('x.html', unclosed).length, 1, 'an unterminated region exempts nothing');
+});
+
 // task 1002756 — the two holes that let migrate.sh's founder DB default survive:
 // (1) the stripper could be OPENED by a `/*` inside a `//` line comment (a real
 // `*/` hundreds of lines later then swallowed everything between — provision.js

package/tests/landing_legal_pages.mjs

@@ -22,7 +22,8 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const LANDING = path.join(ROOT, 'public-landing');
+// the front door is a module since task 1003322 (ADR 0218) — one constant, so the path moves once
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 const read = (f) => fs.readFileSync(path.join(LANDING, f), 'utf8');
 
 const platformMod = require('../src/platform-server.js');

package/tests/landing_page.mjs

@@ -40,8 +40,10 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const HTML = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8');
-const WORLD = fs.readFileSync(path.join(ROOT, 'public-landing', 'assets', 'world.css'), 'utf8');
+// the front door is a module since task 1003322 (ADR 0218) — one constant, so the path moves once
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HTML = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8');
+const WORLD = fs.readFileSync(path.join(LANDING, 'assets', 'world.css'), 'utf8');
 
 const { stripApexOnly } = require('../src/platform-server.js');
 const { applyBrandTokens } = require('../src/bongos/serve-internal.js');
@@ -186,8 +188,8 @@ test('the social card is the world card, stamped onto THIS instance', () => {
     assert.equal(m[1], 'https://spike-harbor.example/assets/world/og-card.jpg');
   }
   assert.ok(
-    fs.existsSync(path.join(ROOT, 'public-landing', 'assets', 'world', 'og-card.jpg')),
-    'the og card the head names must exist under public-landing/',
+    fs.existsSync(path.join(LANDING, 'assets', 'world', 'og-card.jpg')),
+    'the og card the head names must exist under the landing surface',
   );
 });
 
@@ -210,7 +212,7 @@ test('a pack with no hall of its own falls back to its own apex, not the platfor
 
 test('a pack with NO domains drops the hall pill server-side rather than stamping href="" (task 1003242)', () => {
   // the hub has no client scrubber, so an empty token must never reach it as a dead link
-  const HUB = fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.html'), 'utf8');
+  const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
   assert.match(HUB, /data-link-hall href="\{\{buildersOrigin\}\}"/, 'the hub pill is token-stamped');
   const none = applyBrandTokens(HUB, BRAND, '', '');
   assert.doesNotMatch(none, /href=""/, 'no empty href survives the stamp');

package/tests/module-scope-map.mjs

@@ -100,7 +100,7 @@ test('provisioning + public-landing joined the roster (task 1002690) — territo
   const prov = scope.globsForModules(['provisioning']);
   assert.ok(prov.includes('modules/provisioning/'), 'provisioning owns its module directory');
   assert.ok(prov.includes('scripts/gds/provision.js'), 'the control-plane runner travels with its domain');
-  assert.ok(scope.globsForModules(['public-landing']).includes('public-landing/'), 'public-landing owns its surface directory');
+  assert.ok(scope.globsForModules(['public-landing']).includes('modules/public-landing/'), 'public-landing owns its surface directory');
 });
 
 test('platform-identity joined the roster (task 1002322) — the catalog territory goal 1000046 walls', () => {
@@ -127,7 +127,7 @@ test('platform-identity joined the roster (task 1002322) — the catalog territo
     'modules/platform-identity/routes/projects.js',     // the feed + invite routes
     'modules/status-ui/public/explore.js',              // orb render-type surface
     'modules/hall-ui/public/my-projects.js',            // owner settings / applications queue
-    'public-landing/projects.html',                     // the creation step, ?view=new since task 1002763
+    'modules/public-landing/public/projects.html',                     // the creation step, ?view=new since task 1002763
     'modules/provisioning/',                            // module-bundle selection at provision time
   ]) {
     assert.equal(covers(touch), true, `wall does not cover ${touch}`);

package/tests/module_loader.mjs

@@ -179,6 +179,9 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // And ui-design (task 1003324 / ADR 0197) — the design contract, its adapters
   // and the /design playbook as a platform capability: declaration-only (three
   // skills, no routes/port), default-on because every instance has a face.
+  // And public-landing (task 1003322 / ADR 0218) — the front door, the THIRD web
+  // surface after status-ui and hall-ui and the first to declare apexRoot instead
+  // of a Host prefix; default-on because every instance answers at its own apex.
   // All are discovered; none has validation
   // errors or coreVersion mismatches. Order is the readdir sort.
   //
@@ -203,7 +206,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'dev-box', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'security', 'sessions', 'status-ui', 'ui-design']);
+  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'dev-box', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'platform-identity', 'provisioning', 'public-landing', 'security', 'sessions', 'status-ui', 'ui-design']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();

package/tests/onboard.mjs

@@ -64,7 +64,7 @@ test('every form OFFERS the optional step and names what skipping costs — skil
   assert.match(cli, /off the public map/, 'and says what a missing description means');
 
   // the web form
-  const hub = read('public-landing/projects.html');
+  const hub = read('modules/public-landing/public/projects.html');
   assert.match(hub, /id="panel-detail"/, 'the wizard ships the panel');
   assert.match(hub, /id="skipDetail"/, 'with a skip control of its own');
 
@@ -168,7 +168,7 @@ test('every render surface carries the terminal hall step (task 1002703)', () =>
   const cli = read('scripts/gds/onboard.js');
   assert.match(cli, /builders hall/i, 'the CLI walkthrough ends at the hall');
   assert.match(cli, /bongos dev/, 'the CLI offers the local-hall one-liner when no domain');
-  const hubHtml = read('public-landing/projects.html');
+  const hubHtml = read('modules/public-landing/public/projects.html');
   const enterHall = hubHtml.match(/data-onboard-step="enter-hall"[^]*?<\/li>/g) || [];
   assert.ok(enterHall.length >= 1, 'the ?view=new wizard tags the enter-hall step');
   assert.match(enterHall.join(''), /\/builders/, 'the wizard points at the hall address');
@@ -180,7 +180,7 @@ test('the wizard done panel is plan-driven, manifest-driven, and owner-honest (t
   // The wizard lives inside the hub page since task 1002763.
   const { readFileSync } = require('node:fs');
   const path = require('node:path');
-  const src = readFileSync(path.join(import.meta.dirname, '..', 'public-landing/projects.html'), 'utf8');
+  const src = readFileSync(path.join(import.meta.dirname, '..', 'modules/public-landing/public/projects.html'), 'utf8');
   // gap 2 (idea 1000675): the checklist renders FROM the canonical plan endpoint
   assert.match(src, /provisioning\/onboard-plan/, 'the done panel fetches the canonical plan');
   // gap 3 (idea 1000676): the ADR 0133 one-click manifest flow has a UI caller again
@@ -203,7 +203,7 @@ test('the wizard gate trust link points at a live artifact, not the dead private
   // "open source" is the license itself.
   const { readFileSync } = require('node:fs');
   const path = require('node:path');
-  const src = readFileSync(path.join(import.meta.dirname, '..', 'public-landing/projects.html'), 'utf8');
+  const src = readFileSync(path.join(import.meta.dirname, '..', 'modules/public-landing/public/projects.html'), 'utf8');
   assert.doesNotMatch(src, /Claude-OTB/, 'the dead repo link is gone');
   assert.match(src, /https:\/\/www\.gnu\.org\/licenses\/agpl-3\.0/, 'the trust link resolves (the AGPL-3.0 license text)');
 });
@@ -266,7 +266,7 @@ test('the web form (?view=new) declares EXACTLY the canonical human steps — dr
   const path = require('node:path');
   const humanKeys = ob.onboardPlan().filter((s) => s.kind === 'human').map((s) => s.key).sort();
   const surfaces = {
-    '/projects?view=new wizard': 'public-landing/projects.html',
+    '/projects?view=new wizard': 'modules/public-landing/public/projects.html',
   };
   for (const [name, rel] of Object.entries(surfaces)) {
     const src = readFileSync(path.join(import.meta.dirname, '..', rel), 'utf8');

package/tests/projects_hub.mjs

@@ -19,8 +19,10 @@ import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
-const HUB = fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.html'), 'utf8');
-const COSMOS = fs.readFileSync(path.join(ROOT, 'public-landing', 'assets', 'cosmos.css'), 'utf8');
+// the front door is a module since task 1003322 (ADR 0218) — one constant, so the path moves once
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
+const COSMOS = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8');
 const STYLE = (HUB.match(/<style>([\s\S]*?)<\/style>/) || [, ''])[1];
 const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
 
@@ -71,7 +73,7 @@ test('?view= is the deep-link contract, read on boot and written with replaceSta
   assert.match(SCRIPT, /'&id=' \+ encodeURIComponent\(manageId\)/,
     'the URL writer must carry the manage id, encoded');
   // the landing page's CTAs have always pointed here — this is the bug they hit
-  const landing = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8');
+  const landing = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8');
   assert.match(landing, /href="\/projects\?view=new"/,
     'the landing CTA target must stay a view the hub knows');
 });
@@ -255,8 +257,8 @@ test('the gate is retired — no route, no files, no links into it', () => {
   // the FILES, not the directory: git cannot track an empty dir, so a stale
   // working tree may keep the folder while the commit is clean
   for (const f of ['index.html', 'space.js', 'space.css']) {
-    assert.equal(fs.existsSync(path.join(ROOT, 'public-landing', 'gate', f)), false,
-      `public-landing/gate/${f} must be gone: express.static would keep serving it`);
+    assert.equal(fs.existsSync(path.join(LANDING, 'gate', f)), false,
+      `the landing surface’s gate/${f} must be gone: express.static would keep serving it`);
   }
   const server = fs.readFileSync(path.join(ROOT, 'src', 'platform-server.js'), 'utf8');
   assert.doesNotMatch(server, /res\.redirect\(302, '\/gate\/'\)/,
@@ -272,7 +274,7 @@ test('/create is absorbed — the wizard lives here and the route only redirects
   // are real markup inside the new view (C7), create.html is deleted — the
   // gate precedent above: express.static would keep serving the raw file —
   // and the name handoff became an in-page step advance.
-  assert.equal(fs.existsSync(path.join(ROOT, 'public-landing', 'create.html')), false,
+  assert.equal(fs.existsSync(path.join(LANDING, 'create.html')), false,
     'create.html must be gone: express.static would keep serving it raw and unbranded');
   assert.doesNotMatch(SCRIPT, /location\.assign\('\/create'/,
     'naming a project advances the wizard in place — no navigation');
@@ -449,8 +451,8 @@ test('the count includes the platform when it is shown', () => {
    and the hub's. ── */
 
 test('neither the landing hero nor the hub types (tasks 1003298, 1003300)', () => {
-  const LANDING = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8');
-  assert.doesNotMatch(LANDING, /id="typed"|setTimeout\(type\b/, 'the landing hero does not type');
+  const LANDING_HTML = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8');
+  assert.doesNotMatch(LANDING_HTML, /id="typed"|setTimeout\(type\b/, 'the landing hero does not type');
   assert.doesNotMatch(SCRIPT, /function typeMark\(\)|HOLD_HOME|setTimeout\(type\b/, 'the hub has no typing loop');
 });
 
@@ -1569,9 +1571,9 @@ test('the walk assigns the template by canonical position beside the accent; a c
 });
 
 test("the planet is the landing's object on the landing's crop maths: the three rectangles are byte-equal across the two sheets", () => {
-  const LANDING = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8');
+  const LANDING_HTML = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8');
   const landingCrop = (cls) => {
-    const m = LANDING.match(new RegExp(`\\.${cls}\\{[^}]*--bead-ar:([^;]+);--bead-zoom:([^;]+);--bead-px:([^;]+);--bead-py:([^;}]+)`));
+    const m = LANDING_HTML.match(new RegExp(`\\.${cls}\\{[^}]*--bead-ar:([^;]+);--bead-zoom:([^;]+);--bead-px:([^;]+);--bead-py:([^;}]+)`));
     assert.ok(m, `the landing declares .${cls}`);
     return m.slice(1, 5).map((s) => s.trim());
   };
@@ -1604,7 +1606,7 @@ test('the materials (task 1003337): a whole object per plate, the crop recompute
     const rule = `.worldOrb[data-material="${material}"][data-shape="${shape}"]{--tpl-src:var(--plate-${material}-${shape}-cut);--tpl-ar:${f5(w / h)};--tpl-zoom:${f5(zoom)};--tpl-px:${f5(-U0 * zoom)};--tpl-py:${f5(-V0 * zoom)};}`;
     assert.ok(COSMOS.includes(rule), `the ${key} crop follows from its box: ${rule}`);
     assert.ok(COSMOS.includes(`--plate-${material}-${shape}-cut:url(/assets/world/r3-${material}-${shape}-cut.webp);`), `the ${key} plate token`);
-    const file = path.join(ROOT, 'public-landing', 'assets', 'world', `r3-${material}-${shape}-cut.webp`);
+    const file = path.join(LANDING, 'assets', 'world', `r3-${material}-${shape}-cut.webp`);
     assert.ok(fs.existsSync(file), `${key}: the cutout ships`);
     assert.ok(fs.existsSync(file + '.json'), `${key}: with its sidecar`);
     const head = fs.readFileSync(file).subarray(0, 40).toString('latin1');
@@ -1620,7 +1622,7 @@ test('the field carries a rendered backdrop (task 1003337): one token, cover, a
   assert.match(COSMOS, /\.field \.ground\{position:absolute;inset:-4%;background:var\(--sky-bg\) var\(--field-plate\) center\/cover no-repeat;\}/);
   assert.match(COSMOS, /@media \(prefers-reduced-motion:no-preference\)\{\s*\.field \.ground\{animation:groundDrift 90s ease-in-out infinite alternate;\}/, 'the drift only runs where motion is welcome');
   assert.match(COSMOS, /@keyframes groundDrift\{from\{transform:translate3d\([^)]*\) scale\(1\.02\);\}to\{transform:translate3d\([^)]*\) scale\(1\.06\);\}\}/, 'transform only');
-  const plate = path.join(ROOT, 'public-landing', 'assets', 'world', 'r3-space-nebula.jpg');
+  const plate = path.join(LANDING, 'assets', 'world', 'r3-space-nebula.jpg');
   assert.ok(fs.existsSync(plate) && fs.existsSync(plate + '.json'), 'the plate and its sidecar ship');
   const side = JSON.parse(fs.readFileSync(plate + '.json', 'utf8'));
   assert.equal(side.kind, 'backdrop');
@@ -1680,7 +1682,7 @@ test('the kit proves the field path: the fixture carries a curated template and
   assert.equal(demo.planet_template, 'pair-obsidian-tint', 'the owner\'s choice rides the same wire (task 1003347)');
   assert.equal(demo.planet_accent, 'sea', 'a token NAME, never a colour');
   assert.ok(fixture.projects.every((p) => 'template' in p && 'planet_template' in p && 'planet_accent' in p), 'the wire never drops a key');
-  const states = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.states.json'), 'utf8'));
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8'));
   const attrs = states.states['in-map'].expect.attr.map((a) => a.join(' '));
   assert.ok(attrs.includes('#selfOrb data-template pair-chrome'));
   assert.ok(attrs.some((a) => a.includes('amazonprimea.com') && a.endsWith('data-template bead-wash')), 'the curated template reaches the orb');
@@ -1756,7 +1758,7 @@ test('the picker wears the world by scope: the preview left and four bands right
 });
 
 test('the kit proves the picker: a state renders it on the owner\'s feed-carried choice, three probes save / hand back / fold, and both fixtures carry the choice (task 1003347)', () => {
-  const states = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.states.json'), 'utf8'));
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8'));
   const st = states.states['in-manage-planet'];
   assert.ok(st && st.auth && st.url === '/projects?view=manage&id=101', 'the signed-in owner on Demo');
   assert.ok(st.expect.visible.includes('#mPlanetPick') && st.expect.visible.includes('#mPick [data-pick-reset]'));
@@ -1770,7 +1772,7 @@ test('the kit proves the picker: a state renders it on the owner\'s feed-carried
   const harbor = inst.instances.find((i) => i.slug === 'harbor');
   assert.equal(harbor.planet_template, 'blob-frost-tint');
   assert.equal(harbor.planet_accent, 'sun-lit');
-  const probes = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.probes.json'), 'utf8'));
+  const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.probes.json'), 'utf8'));
   const names = probes.probes.map((p) => p.name);
   assert.ok(names.some((n) => n.startsWith('manage flows: its planet (task 1003347)')), 'the save probe');
   assert.ok(names.some((n) => n.includes('handed back to the platform')), 'the reset probe');
@@ -1884,7 +1886,7 @@ test("the card paints the owner's plate before the project's own picture, and a
 
 test('every plate the picker offers ships as a real file with its provenance sidecar', () => {
   for (const k of ['nebula', 'dust', 'deepfield', 'chrome']) {
-    const file = path.join(ROOT, 'public-landing', 'assets', 'world', `r4-card-${k}.jpg`);
+    const file = path.join(LANDING, 'assets', 'world', `r4-card-${k}.jpg`);
     assert.ok(fs.existsSync(file), `r4-card-${k}.jpg must ship — the picker offers it`);
     const side = JSON.parse(fs.readFileSync(`${file}.json`, 'utf8'));
     assert.equal(side.task, 1003352, 'the sidecar names the task that made it');
@@ -1902,9 +1904,9 @@ test("its card is the planet section's twin: its own heading, the same channel,
   assert.match(SCRIPT, /manageInst\.card_backdrop = \(data\.planet \|\| \{\}\)\.card_backdrop \|\| null;/,
     'the reply is a receipt — the page repaints from the row, never from words in the reply');
   assert.match(SCRIPT, /renderPick\(inst\);\r?\n\s*renderCardPick\(inst\);/, 'both sections fill from the same manage read');
-  const states = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.states.json'), 'utf8'));
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8'));
   assert.ok(states.states['in-manage-card'], 'the section has a rendered state');
-  const probes = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.probes.json'), 'utf8'));
+  const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.probes.json'), 'utf8'));
   const names = probes.probes.map((p) => p.name);
   assert.ok(names.some((n) => n.startsWith('manage flows: its card (task 1003352)')), 'the save probe');
   assert.ok(names.some((n) => n.includes("its card — handing it back")), 'the hand-back probe');
@@ -1960,8 +1962,8 @@ test('the wizard\'s own structures wear the world: hairline fields, cells of one
   assert.match(SCRIPT, /target_ref: state\.owner \+ '\/' \+ state\.repo,/, 'the repo ref is unchanged');
   assert.match(SCRIPT, /onboard_mode: state\.mode === 'adopt' \? 'adopt' : 'greenfield'/, 'the onboard mode is unchanged');
   // the kit walks every step and files against the stub
-  const states = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.states.json'), 'utf8')).states;
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8')).states;
   for (const s of ['type', 'about', 'home', 'address', 'review', 'done']) assert.ok(states['in-new-' + s], `the ${s} step has a kit state`);
-  const probes = JSON.parse(fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.probes.json'), 'utf8')).probes;
+  const probes = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.probes.json'), 'utf8')).probes;
   assert.ok(probes.some((p) => /the wizard driver \(task 1003346\)/.test(p.name) && p.steps.some((st) => st[1] === '#doCreate')), 'the wizard driver files a project end to end');
 });

package/tests/projects_hub_pre_uat.mjs

@@ -11,11 +11,13 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+// the front door is a module since task 1003322 (ADR 0218) — one constant, so the path moves once
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 // LF-normalised: a Windows checkout (core.autocrlf) hands back CRLF, and the
 // anchored regexes below reason about line ends
-const HUB = fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
-const COSMOS = fs.readFileSync(path.join(ROOT, 'public-landing', 'assets', 'cosmos.css'), 'utf8').replace(/\r\n/g, '\n');
-const INDEX = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8').replace(/\r\n/g, '\n');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const COSMOS = fs.readFileSync(path.join(LANDING, 'assets', 'cosmos.css'), 'utf8').replace(/\r\n/g, '\n');
+const INDEX = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8').replace(/\r\n/g, '\n');
 const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
 
 // a function's text runs from its declaration to the next declaration in the

package/tests/public_landing_projects.mjs

@@ -470,7 +470,7 @@ test('the stamp is derived from CONTENT, so it changes only when the file does',
   const cryptoMod = await import('node:crypto');
   const url = await import('node:url');
   const root = pathMod.dirname(url.fileURLToPath(import.meta.url));
-  const css = fsMod.readFileSync(pathMod.join(root, '..', 'public-landing', 'assets', 'cosmos.css'));
+  const css = fsMod.readFileSync(pathMod.join(root, '..', 'modules', 'public-landing', 'public', 'assets', 'cosmos.css'));
   const want = cryptoMod.createHash('sha256').update(css).digest('hex').slice(0, 8);
   const res = await request('/projects');
   assert.ok(res.body.includes(`cosmos.css?v=${want}`),
@@ -488,7 +488,7 @@ test('every landing surface is stamped, not just the one that broke', async () =
 });
 
 test('routes and API paths are never mistaken for assets', async () => {
-  // stamping resolves the URL against public-landing/ — a route names no file,
+  // stamping resolves the URL against the surface dir — a route names no file,
   // so it must come back untouched rather than acquiring a meaningless ?v=
   const res = await request('/projects');
   assert.match(res.body, /href="\/"/, "'/' is a route, not an asset");

package/tests/terms_acceptance.mjs

@@ -94,7 +94,7 @@ async function ta(name, fn) {
 
 console.log('the page (/terms carries the consent the ADR deferred to it):');
 
-const termsHtml = fs.readFileSync(path.join(repo, 'public-landing', 'terms.html'), 'utf8');
+const termsHtml = fs.readFileSync(path.join(repo, 'modules', 'public-landing', 'public', 'terms.html'), 'utf8');
 const { stripApexOnly } = require('../src/platform-server.js');
 
 t('the terms page states what crosses between projects', () => {

package/tests/ui_design_kit.mjs

@@ -33,7 +33,7 @@ test('the platform floors are a pinned list — a floor cannot vanish quietly',
 });
 
 test('the shipped states files validate and sit beside the page they name', () => {
-  for (const rel of ['public-landing/projects.states.json', 'public-landing/projects-empty.states.json', 'public-landing/index.states.json', 'modules/hall-ui/public/ranks.states.json']) {
+  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/projects-empty.states.json', 'modules/public-landing/public/index.states.json', 'modules/hall-ui/public/ranks.states.json']) {
     const json = readJson(rel);
     const v = lib.validateStatesFile(json);
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);
@@ -42,14 +42,14 @@ test('the shipped states files validate and sit beside the page they name', () =
   }
   // the apex is dark only (task 1003336): its states files name the one mode, and
   // render.js reads it as the default so a plain `--page /` never renders light
-  for (const rel of ['public-landing/projects.states.json', 'public-landing/index.states.json']) {
+  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/index.states.json']) {
     assert.deepEqual(readJson(rel).modes, ['dark'], `${rel}: the apex renders dark only`);
     assert.equal(readJson(rel).modeQuery, false, `${rel}: no query walks a second mode`);
   }
 });
 
 test('the shipped probes files validate', () => {
-  for (const rel of ['public-landing/projects.probes.json', 'public-landing/index.probes.json']) {
+  for (const rel of ['modules/public-landing/public/projects.probes.json', 'modules/public-landing/public/index.probes.json']) {
     const v = lib.validateProbesFile(readJson(rel));
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);
   }