@bongos/core 1.19.507 → 1.19.509

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.507",
-  "core_contract": "1.19.507",
-  "source_commit": "f4008a4f0c0527a72d19cfc989889a3610a164d1",
+  "core_version": "1.19.509",
+  "core_contract": "1.19.509",
+  "source_commit": "9605bf28928f63695da44f2f5033d52569701f0c",
   "source_ref": "HEAD",
-  "built_at": "2026-09-03T18:09:01.161Z",
+  "built_at": "2026-09-03T18:27:19.784Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 427,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1946,
+    "functional_verbatim": 1949,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2397,
-  "tree_sha256": "cf9525f9de033ff0382bbc7986cc416062ed1a629caabc30849cc4efa1065398",
+  "file_count": 2400,
+  "tree_sha256": "8caa606e95cdf39a34d1b4f654b3b415dc9e699d7c1a058a9281097e297ae916",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -192,7 +192,7 @@
     {
       "path": ".claude/skills/new-project/SKILL.md",
       "mode": "0000644",
-      "sha256": "21ae14d681f0b8a7056b320c764ffbaa88c9cf777afc67589049e4778bf98d3b"
+      "sha256": "ce864614cf02126a8ccf46b4128f646fc9734d96ad2e3b5a3060249497449d35"
     },
     {
       "path": ".claude/skills/otb-character-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "afe60dae1ca8b55c5f9521b4f23eaad4eb194627a2ee105cae1513745ae71544"
+      "sha256": "2507501215b31032378a856f4a26791921b3e618baedaaa1d6934df458d3023b"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1407,7 +1407,7 @@
     {
       "path": "docs/adr/0182-project-visibility-two-axes.md",
       "mode": "0000644",
-      "sha256": "119637165d2d6b89f8c00afccd07d9f073629f1502f4b2f2cdc673001b2f8d2a"
+      "sha256": "9474378cf54f6d66269797edf6cd1d0d76014cecbfc657f53cd5892999599f20"
     },
     {
       "path": "docs/adr/0183-criteria-close-themselves.md",
@@ -1697,12 +1697,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "1388440a16b1563120683f32ad285c9234c636f54c49a293bc7c1e9aabe55b53"
+      "sha256": "91a31987ff13dd0757ec86db23b6cf86ea4cb95833d702ac7070b75ed4354b49"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "0b5eab5940ae6cf0e8691c6ec59757e8bbfb719a660ec3e8492d9870c95a8c62"
+      "sha256": "42d2388b2d327331b2e78f29dfdbf6db517c9625238a93606a050de74d03ecec"
     },
     {
       "path": "docs/architecture.md",
@@ -1727,12 +1727,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "b6b680304b158480b87c61679bafa3431d6e492aa9323933abf68621ce243365"
+      "sha256": "c3c4bf94c9565778297efc223bd8a3d0adea4b96d6c484d516f21885532dcdaf"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "ed8c0d7c6ab7edd3ae61cd97c530323ed915f32cfa14a4f4ed1bca4d52437a01"
+      "sha256": "e757dec5eb8da4947297f2fdae06b460e888d6e7cad1a5d13d0dae5e03df4aa1"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2577,7 +2577,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ca0326ffd2f4996d2c4f42940ba5c2a2b40b18f9a676023918fd2cde9cd85634"
+      "sha256": "52cb03d41b0eb38da33a436b0ca2912d2b087b33ab3675aca404a77767fdeb34"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5797,12 +5797,12 @@
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "d7c74b8b41b3c0f6d0d072632f4a8d04f11b06c39203c6f759dcaf4e324fd9b0"
+      "sha256": "ea0ef93145343658eb46421ebc435181fe7233c35be7bc73a7cac229f53f6c08"
     },
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "c43bda216cc9c6ec1788dd5d6ef4978594c1ab6db61ad6af33ed8ce451594899"
+      "sha256": "1b626dfb9b8aec98c95d94d8a831e5343018bb6164ef76a160ae6ff5e026a3ad"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -5814,6 +5814,11 @@
       "mode": "0000644",
       "sha256": "2e898799632a2b5c2ead9cb44fa0b8029fcb6d217f7d5f26c8a39b34c75bbea7"
     },
+    {
+      "path": "modules/platform-identity/publish-gate.js",
+      "mode": "0000644",
+      "sha256": "233b2479304b45339b2e31529b47cb1af1ccb48b77a7f6845dd8ef6af52031e0"
+    },
     {
       "path": "modules/platform-identity/recruiter-sliver.js",
       "mode": "0000644",
@@ -5837,7 +5842,7 @@
     {
       "path": "modules/platform-identity/routes/projects.js",
       "mode": "0000644",
-      "sha256": "10e0e86e055063fb33fe5dd0855c1db23c8e0aeb71e1bafb56b4061b8718285a"
+      "sha256": "8652dbbc243f9bb10d759dd140163471d41687b405742f02b5936be818a93472"
     },
     {
       "path": "modules/platform-identity/routes/public-profile.js",
@@ -5867,7 +5872,7 @@
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
       "mode": "0000644",
-      "sha256": "6b523f1fbecaaa29310d3439cc1e4164f7dba3d01057812ccb4ac71bca861b68"
+      "sha256": "6151b6e7d5c4336fece03d0c29dbc94493329ba3bd4d8782702a2d581e5a4cc7"
     },
     {
       "path": "modules/platform-identity/ui/.gitkeep",
@@ -5972,7 +5977,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "db8e97581ea3b23e31f23cce7246e6fc498ad34005575e234e6537c197d0702b"
+      "sha256": "aafd317ed353c3aa6b28fc6432d13758f3305fb7593aaaa8271555b658245a01"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -6482,7 +6487,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "258d73c5e38fcb99b8f1ebe6aebbd5c50dd2eb28ac8165cb7504353208b6b3be"
+      "sha256": "f744bab1254cec8220d3399c829bd566f8a6f2d07b412e531720476798837d7b"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -7227,12 +7232,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e59012a1aaea2c2e25ac2a7f0c40f096bfe2cae832502cdabfe3519fdb37322d"
+      "sha256": "da37c28e1647b70c11a589446419029d7dd7f05218cf88b0f357599aa1903836"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "aae944a6300fb887bd38a4692813e2f03965d7bb044c843fe7f23a26715233d8"
+      "sha256": "d468e341086d86826eccaa2a062e84c3199ae2e7169bb1e97dfa46a7e00e4589"
     },
     {
       "path": "public-docs/index.html",
@@ -8902,7 +8907,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c8e168b4ae8a7dc956802de03248b6509b871e98bf0315dbd94d8dc7cc16be50"
+      "sha256": "fc08dfd1d74b0e89c903f8365f1e969286dbe2af19b75cf0a75f47e54d97fd0a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10317,7 +10322,7 @@
     {
       "path": "tests/hall_page_gate_map.mjs",
       "mode": "0000644",
-      "sha256": "d529685063de8c4aa6676abf86f1180bb9cd13d27a3c372d8a3d9cf078af1999"
+      "sha256": "e65e22471469a9bf4551925f0549cfd6720aa7d5b7b7cf9df17984604e07c3cb"
     },
     {
       "path": "tests/hall_palette.mjs",
@@ -10879,6 +10884,11 @@
       "mode": "0000644",
       "sha256": "079d7eef5828912e306e9dbbe081fef6004526067bd15aa6433dc2ff1873a4be"
     },
+    {
+      "path": "tests/my_projects_surface.mjs",
+      "mode": "0000644",
+      "sha256": "03b61cb8de6713b03fe17b2b3c5d70af7c511b33b17a42295f49c36e27771470"
+    },
     {
       "path": "tests/needs_rebase.mjs",
       "mode": "0000644",
@@ -11092,7 +11102,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "273da7ef31439224c4c1dade351848c821dd8294333439ea82b5aef039e3c696"
+      "sha256": "2cdad6b12240d3556614aa0e77874f41651e59884f1b07bd9af664334eb90c20"
     },
     {
       "path": "tests/projects_hub_pre_uat.mjs",
@@ -11204,6 +11214,11 @@
       "mode": "0000644",
       "sha256": "485b2b965bcf44a515571de43851c42a32f278dcdd02510f0d3cd9f6ac53e61c"
     },
+    {
+      "path": "tests/publish_gate.mjs",
+      "mode": "0000644",
+      "sha256": "3e3b97d2c7e4e67a412eaa04bbf3d8fd4ad649ae46f9e194c8e07eedfc2349bb"
+    },
     {
       "path": "tests/publish_manifest.mjs",
       "mode": "0000644",

package/.claude/skills/new-project/SKILL.md

@@ -30,6 +30,8 @@ Both ride the provisioning request as `description` and `detail: { team_shape }`
 
 Never gate the standup on this step, and never invent an answer the owner didn't give — a recommendation built on a guess is worse than no recommendation.
 
+**Read the verdict back rather than asserting one (task 1002335).** Every instance read and the detail PATCH answer with `publish: { publishable, missing, missing_phrase }` — the server's own derivation of the gate. Report *that*, verbatim: "it's on the public map" or "it has no description, so it isn't on the map yet". Do not compute publishability yourself from the fields you happen to have sent; the owner's project page renders the same server verdict, and two surfaces disagreeing about whether a project is published is worse than either being briefly stale. If `publish` is absent, this platform has no public map — say nothing about one.
+
 ### 3. DNS token preflight — BEFORE you commit the address (task 1980)
 
 Before anything is provisioned, verify the control-plane's Cloudflare token can actually manage the domain's zone (a mismatched-zone token is exactly what broke the Emersonian standup mid-flow):

package/clients/bongos-client/index.d.ts

@@ -169,7 +169,7 @@ export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown;
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
 export interface PatchProvisioningInstancesIdDetailRequest { description?: string; detail?: Record<string, unknown> }
-export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown }
+export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown; publish: unknown }
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; planet: unknown; push: unknown }
 export interface PatchTaskRecommendationsIdRequest { status: "declined" | "withdrawn" }
 export interface PatchTaskRecommendationsIdResponse { ok: boolean; recommendation: unknown }

package/docs/adr/0182-project-visibility-two-axes.md

@@ -159,6 +159,7 @@ Until then: `stealth` unqualified in product code and copy means the project sta
 - R05 moves host: instance-side settings, not a hub page.
 - R08 defaults fail-closed on an unreported project.
 - Anything reading `featured = true AND status = 'active'` as "is this public" is now wrong and must be found. `modules/platform-identity/routes/projects.js` is the known site.
+- **R16 makes D3's bound real, and D4's gate reach a second module.** Shipping R16 (task 1002335) surfaced one thing this ADR left implicit. D3 says `featured` may never put an unpublishable project on the map, so `PATCH /projects/:id/featured` now refuses a dark-matter row (409 `not_publishable`, `missing` in the details); un-featuring stays unconditional, since an already-featured husk must remain removable. And D4's "name what is missing" is owed to the owner *before* their project is ever catalogued on the hub — which is the `provisioning` plane, a different module that ADR 0083 forbids from importing `platform-identity`. Rather than let a two-field rule exist twice, the gate is published as a kernel seam port, `project.publishGate` (`modules/platform-identity/publish-gate.js`). `provisioning` resolves it **optionally** and declares no `consumes`: `platform-identity` is hub-only, the public map is a hub concept, and a platform without one must answer "no verdict" rather than invent a local rule — which is the same drift-avoidance argument that produced `publishableSql` in the first place.
 
 ## Alternatives rejected
 

package/docs/api/openapi.json

@@ -10859,7 +10859,7 @@
           "projects"
         ],
         "summary": "PATCH /projects/:id/featured",
-        "description": "the feature / unfeature control (the ADR 0141 §5 curation gate).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.curate` (all required).",
+        "description": "the feature / unfeature control (the ADR 0141 §5 curation gate), BOUNDED BY THE PUBLISH GATE (ADR 0182 D3, task 1002335). Featuring ranks among projects already on the map; it is not a way ONTO it, so featuring a dark-matter row is refused — and the refusal names the identity field that is missing rather than merely saying no (D4). Un-featuring is never refused.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.curate` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/platform-identity/routes/projects.js",
         "x-permissions": [
@@ -17905,13 +17905,15 @@
           },
           "description": {},
           "detail": {},
-          "options": {}
+          "options": {},
+          "publish": {}
         },
         "required": [
           "ok",
           "description",
           "detail",
-          "options"
+          "options",
+          "publish"
         ]
       },
       "PatchProvisioningInstancesIdSettingsResponse": {

package/docs/api-reference.md

@@ -438,7 +438,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/projects` | `metic+archon` | — | the full curation list (includes unfeatured + owner attribution). |
 | POST | `/api/bongos/projects` | `metic+archon` | `origin`, `name`, `tagline`, `description`, `art_url`, `type`, `template` | create / update a catalog entry (manual seed for hand-wired instances; federated projects auto-catalogue at registration). |
-| PATCH | `/api/bongos/projects/:id/featured` | `metic+archon` | `featured` | the feature / unfeature control (the ADR 0141 §5 curation gate). |
+| PATCH | `/api/bongos/projects/:id/featured` | `metic+archon` | `featured` | the feature / unfeature control (the ADR 0141 §5 curation gate), BOUNDED BY THE PUBLISH GATE (ADR 0182 D3, task 1002335). |
 | GET | `/api/bongos/projects/featured` | `public` | — | a curated public showcase; no auth by design. |
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | invite a builder into a project (ADR 0141 §5, task #1002115). |